Research Ethics, Governance and Data Management

Introduction

Brand-management projects frequently involve people, personal data, commercially sensitive information, and claims that may influence organisational decisions. Examples include customer interviews, employee surveys, social-media analysis, concept testing, competitor research, influencer studies, and the evaluation of brand campaigns. Such work is not ethically neutral. The quality of a dissertation depends not only on its research question and methods, but also on whether participants were treated fairly, data were handled responsibly, and conclusions were reported honestly.

Research ethics concerns the principles governing acceptable conduct in research. Governance concerns the structures, approvals, roles, controls, and accountability mechanisms through which research is authorised and monitored. Data management concerns the systematic handling of data throughout its life cycle: collection, storage, use, sharing, retention, archiving, and deletion. Together, these areas protect participants, researchers, organisations, brands, and the credibility of knowledge.

In brand management, ethical failure can create legal exposure, reputational damage, invalid findings, loss of consumer trust, and harm to vulnerable groups. Ethical practice is therefore a strategic capability rather than an administrative obstacle.

Learning objectives

By the end of this chapter, students should be able to:

1. Explain the ethical principles relevant to brand-management research.
2. Design an informed-consent process appropriate to the research context.
3. Distinguish research ethics approval from organisational or data-protection approval.
4. Apply privacy, confidentiality, ownership, retention, and security principles.
5. Identify conflicts of interest, deceptive practices, and risks involving vulnerable participants.
6. Develop a proportionate data-management and governance plan.
7. Evaluate the responsible use of artificial intelligence and publicly available digital data.
8. Communicate findings honestly and reproducibly.

1. Ethical foundations of research

The central ethical principles are respect for persons, beneficence, non-maleficence, justice, autonomy, and integrity.

Respect for persons recognises that participants are agents with the right to make informed choices. Participation must ordinarily be voluntary, and refusal or withdrawal should not result in unjustified disadvantage.

Beneficence and non-maleficence require researchers to maximise anticipated benefits and minimise foreseeable harm. Harm may be physical, psychological, social, economic, legal, or reputational. A seemingly low-risk brand interview may nevertheless expose an employee to workplace consequences if criticism of management becomes identifiable.

Justice concerns the fair distribution of research burdens and benefits. Researchers should not recruit groups merely because they are easy to access, inexpensive to study, or less able to challenge the researcher. Nor should a study exclude relevant groups without a defensible reason.

Autonomy requires meaningful choice. Consent is not meaningful when information is incomprehensible, when participation is coerced, or when incentives are so large that they undermine free choice.

Integrity requires honesty in design, data collection, analysis, authorship, reporting, and communication. Fabrication, falsification, plagiarism, selective reporting, and misrepresentation are serious breaches.

A useful ethical decision test asks:

• Who may benefit and who may be harmed?
• What information does each person need before deciding?
• Can participation or refusal affect employment, grades, services, or reputation?
• Is the data collection necessary and proportionate?
• Would the procedure be defensible if disclosed publicly?
• Have independent reviewers challenged the assumptions and safeguards?

Ethical approval does not guarantee that a project is ethical in every situation. It authorises a defined plan; the researcher remains responsible for responding to new risks and deviations.

2. Informed consent

Informed consent is a continuing process, not simply a signature. A participant should understand the study sufficiently to make a voluntary decision. A consent information sheet normally explains:

• the research purpose and sponsoring institution;
• why the person has been invited;
• what participation involves, including time and procedures;
• foreseeable risks, discomforts, and possible benefits;
• how recordings, quotations, images, and personal data will be used;
• confidentiality limits and any required disclosures;
• voluntary participation and the right to withdraw;
• compensation or incentives;
• data retention, storage, sharing, and deletion arrangements;
• contact details for the research team and complaints or ethics procedures.

Consent must be specific enough for the proposed uses. Consent to participate in an interview is not automatically consent to publish a recognisable photograph, share raw transcripts with a client, or use the material to train an artificial-intelligence system. Where future use is genuinely uncertain, researchers should explain the categories of possible use and seek appropriate broad consent only where permitted by institutional policy and applicable law.

Consent can be documented by a signed form, secure electronic record, recorded verbal agreement, or another approved method. The method should suit the risks and the participants. For a low-risk anonymous survey, an information page followed by an explicit agreement may be sufficient. For a recorded interview involving sensitive opinions, written or recorded consent is more appropriate.

Withdrawal requires careful definition. A participant may withdraw from future participation at any time. Removing already anonymised data may be impossible if the researcher can no longer link it to the person. This limitation must be stated before consent. A withdrawal procedure should specify a deadline, contact route, and what will happen to data already incorporated into analysis.

Special consent situations

For minors, researchers normally require parental or guardian permission together with the child’s age-appropriate assent. Local law and institutional policy determine the precise requirements. Vulnerable adults, people with impaired decision-making capacity, employees, students, patients, and economically dependent participants require additional attention to power relationships and undue influence.

Gatekeepers may introduce the researcher to participants, but permission from a gatekeeper does not replace individual consent. An employer may authorise access to staff, yet each employee must be free to decide whether to participate. Recruitment messages should avoid implying that managers will know who participated unless that is genuinely the case.

3. Ethics approval and research governance

Research governance allocates responsibility and creates an auditable system of control. Common approval layers include:

Approval should be obtained before recruitment or data collection unless an institution explicitly permits an exception. A protocol should describe the research question, methods, population, recruitment, incentives, risks, consent, data flows, analysis, storage, retention, dissemination, and incident response.

Governance also requires role clarity. The principal researcher is responsible for conduct and reporting; supervisors provide oversight; the institution may act as the formal research sponsor; a client may provide access or funding; and a service provider may process data. These roles should be recorded in agreements rather than assumed.

A change-control process is essential. Changing the sample, adding a new data source, collecting identifiers, using facial recognition, transferring data internationally, or sharing raw data with a client may require an amendment or new approval. Continuing with an unapproved design can invalidate the project even when the original approval was sound.

4. Privacy, confidentiality, and anonymity

Privacy concerns a person’s control over information about themselves and the contexts in which it is obtained. Confidentiality is the researcher’s obligation to protect information entrusted to them. Anonymity means that identity cannot reasonably be linked to the data. These terms are not interchangeable.

A dataset is anonymous only when re-identification is not reasonably possible using the dataset itself or information likely to be available. Removing names is often insufficient. A combination of job title, location, age, and a distinctive quotation may identify an individual. Such data are better described as pseudonymised or coded. A code key is itself sensitive and must be protected separately.

The principle of data minimisation requires collecting only information necessary for the research purpose. If age bands answer the research question, exact birth dates should not be collected. If a study needs regional comparison, a full address is generally unnecessary. Minimisation lowers breach risk and improves analytical focus.

Confidentiality promises must be realistic. Researchers should explain exceptions, such as serious risk of harm, legal requirements, or safeguarding obligations, where relevant. Brand projects also require confidentiality concerning trade secrets, unreleased products, campaign plans, customer lists, pricing, and internal strategy.

Practical safeguards include:

• replacing names with participant codes;
• storing the code key separately;
• removing identifying details from transcripts and quotations;
• aggregating small subgroups;
• using password managers and multi-factor authentication;
• encrypting devices and transfers;
• restricting access according to role;
• logging access to sensitive repositories;
• avoiding personal email and unapproved cloud storage;
• securely deleting temporary files and recordings.

5. Ownership, intellectual property, and data rights

Data ownership is not a single universal concept. Rights may arise from copyright, database rights, contract, confidentiality, privacy law, employment arrangements, or institutional policy. A participant may provide information without transferring all rights in a recording or quotation. A client may fund research without automatically owning the student’s dissertation or underlying dataset.

Before data collection, agreements should clarify:

• who may access raw data and processed data;
• who owns questionnaires, interview guides, code, models, and reports;
• whether the client may review or delay publication;
• whether academic independence is protected;
• how confidential information will be redacted;
• whether data may be reused for teaching or future research;
• responsibilities for security, breach notification, and deletion.

A client should not be allowed to suppress inconvenient findings merely because it funded the research. Confidentiality can protect legitimate trade secrets, but it should not become a mechanism for falsifying results. Students should disclose material restrictions to supervisors and readers where possible.

Participants should not be promised ownership of every analytical product unless that is genuinely intended. Instead, explain what will happen to their contribution and whether they will receive a summary of findings.

6. Data management across the research life cycle

A data-management plan converts ethical principles into operational decisions. The life cycle includes planning, collection, processing, analysis, dissemination, archiving, and destruction.

A data inventory should list each data asset, owner or custodian, sensitivity, location, format, access group, retention period, and disposal method. Version control prevents accidental overwriting and supports reproducibility. A read-only master dataset, a working copy, and a decision log are useful basic controls.

Retention should be necessary and proportionate. Keeping identifiable recordings indefinitely “in case they become useful” is difficult to justify. A retention schedule may distinguish consent records, de-identified analytical data, raw audio, contractual records, and the final dissertation. Institutional policy, funding conditions, legal obligations, and the possibility of audit may influence the period.

Security should follow a risk-based approach. Important controls include encryption in transit and at rest, least-privilege access, secure backups, patching, device protection, staff training, and an incident-response plan. A breach should be reported promptly through institutional channels; researchers should not conceal it or independently contact affected people without guidance.

Reproducibility does not require publishing confidential raw data. A project can be reproducible through a transparent protocol, codebook, analysis script, version history, de-identified materials where safe, synthetic examples, and a clear account of unavailable data. Researchers should distinguish raw observations, transformations, analytical judgments, and final claims.

7. Conflicts of interest and researcher independence

A conflict of interest exists when a secondary interest could improperly influence professional judgment or appear to do so. Examples include financial links to a brand, personal relationships with participants, employment by the sponsor, pressure to obtain a favourable result, or assessment of a campaign created by the researcher.

Conflicts are not automatically misconduct. The appropriate response is disclosure, assessment, mitigation, and monitoring. Possible controls include independent recruitment, separation of identifiable data from managers, preregistering an analysis plan, dual coding of qualitative material, independent supervision, and transparent reporting of funding and relationships.

Researchers should not promise a client a positive result before collecting evidence. If a sponsor controls access to data, this limitation must be acknowledged because it may affect generalisability and interpretation. Students should escalate pressure to alter findings, exclude inconvenient cases, or misrepresent methods.

8. Deception and covert research

Deception involves deliberately withholding or misrepresenting information relevant to participation. It can sometimes be justified in research on natural behaviour or responses to misleading advertising, but it requires strong justification, minimal risk, independent approval, and a debrief where feasible.

A brand study should not falsely claim to be independent if it is sponsored by the brand. Nor should researchers impersonate consumers, manipulate online communities, or collect employee opinions under a false identity merely to obtain candid responses. Covert observation of public behaviour remains ethically sensitive when individuals can be identified or when the setting is reasonably perceived as private.

Less intrusive alternatives should be considered first: transparent recruitment, fictional stimuli, scenario experiments, anonymised reporting, or delayed disclosure approved by an ethics committee. Deception must never be used simply because it is cheaper or more convenient.

9. Digital research, social media, and artificial intelligence

Public availability does not automatically mean unrestricted ethical use. Social-media posts may be technically accessible yet contextually private. Researchers should consider user expectations, platform rules, sensitivity, vulnerability, searchability, and the likelihood that quotations can be traced to an individual.

When using digital trace data, document the source, collection date, inclusion rules, transformations, consent basis where relevant, and safeguards against re-identification. Avoid reproducing usernames or searchable quotations unless necessary and approved.

Generative AI can assist with transcription, coding suggestions, translation, literature organisation, and drafting. However, uploading interview transcripts, customer complaints, or confidential brand strategy to a public AI service may disclose protected information. Researchers should use institutionally approved tools, minimise data, remove identifiers, verify outputs, and retain human responsibility for interpretation.

AI-generated content may contain fabricated references, biased classifications, hidden training-data influences, or inconsistent decisions. A responsible disclosure should state whether AI materially assisted the work and describe its role. AI should not make unreviewed decisions about participant eligibility, risk classification, or sensitive profiling.

10. Responsible analysis and reporting

Ethics continues after data collection. Researchers must report methods accurately, preserve negative cases, distinguish evidence from interpretation, and avoid overstating causal claims. In qualitative research, selective quotation can create a misleading impression. In survey research, reporting only favourable subgroups may conceal sampling bias.

A strong report states limitations such as non-response, convenience sampling, sponsor influence, measurement weaknesses, small samples, missing data, and restricted access. Confidentiality may require disguising a company or combining quotations, but this should be explained to readers.

Brand recommendations should avoid discriminatory targeting, manipulation of vulnerable consumers, exploitation of personal crises, and claims unsupported by evidence. Ethical governance therefore links research ethics to brand purpose, consumer trust, responsible marketing, and long-term legitimacy.

Illustrative case: The confidential product test

Background

A fictional beverage company, Northstar Drinks, asks a student team to test an unreleased energy drink. The company wants interviews with university students and proposes sending raw recordings to its advertising agency.

Problem

The proposed study involves a confidential product, participants who may be classmates, audio recordings, and a client request for identifiable raw material. The agency also wants to use selected comments in advertising.

Analysis

The team identifies several risks: peer pressure, disclosure of trade secrets, re-identification through voices and quotations, unclear ownership, and secondary use beyond the original research purpose. Students may feel that refusing could affect their academic relationships. The request for advertising use is materially different from consent to research participation.

Approach and solution

The team obtains institutional ethics approval and client authorisation separately. Recruitment is conducted by a person who does not teach the participants. The consent sheet distinguishes research use, client reporting, and advertising use. Advertising use requires an additional optional consent process after participants understand the proposed context. Participants may refuse advertising use without losing compensation.

Recordings are encrypted, coded, and stored in an approved institutional repository. The code key is restricted to the research team. The agency receives aggregated findings and de-identified excerpts, not raw recordings. The report states that the sponsor supplied the product and funded the study. A data-management schedule specifies deletion of raw audio after the approved retention period unless a participant has separately consented to archiving.

Outcome

The study identifies strong interest in flavour but concerns about caffeine and sleep. The company receives useful findings without receiving unnecessary personal data. Two participants decline advertising use, and their research contributions remain included in the aggregated analysis.

Learning points

The case demonstrates that access permission is not participant consent, client ownership is not automatic, and confidentiality must be designed into recruitment, storage, analysis, and dissemination. It also shows how ethical safeguards can improve the credibility and practical value of brand research.

Challenges and limitations

Ethical decisions rarely involve zero risk. Anonymisation can reduce the usefulness of rich qualitative data; strict access controls may slow collaboration; deletion can conflict with audit needs; and broad consent may support future value while reducing specificity. Researchers must make these trade-offs explicit and proportionate.

Institutional procedures may also be inconsistent across countries, platforms, or client organisations. Legal compliance is a minimum standard, not a complete ethical analysis. A practice may be lawful but still exploitative, misleading, or inconsistent with participant expectations. Conversely, excessive bureaucracy can discourage valuable low-risk research. Proportionality, independent review, and continuing reflection are therefore essential.

Best-practice checklist

Before submission or fieldwork, confirm that:

• the research question requires the proposed data;
• ethics approval and all access permissions are in place;
• recruitment avoids coercion and conflicts of interest;
• participants receive understandable information;
• consent covers recording, quotations, sharing, and future use;
• withdrawal limits are clearly explained;
• identifiable and confidential brand information are minimised;
• ownership and publication rights are documented;
• access, encryption, backup, retention, and deletion are planned;
• conflicts and funding are disclosed;
• AI and third-party tools have been assessed;
• findings and limitations will be reported honestly.

Chapter Summary

Ethical brand-management research protects participants, preserves confidential information, and strengthens the credibility of strategic decisions. Respect, autonomy, beneficence, justice, and integrity provide the foundation. Informed consent must be understandable, voluntary, specific, and treated as a continuing process. Ethics approval, organisational permission, privacy review, and information-security controls address different governance questions and should not be confused.

Privacy, confidentiality, anonymity, pseudonymisation, ownership, and data rights require precise treatment. A data-management plan should cover the complete life cycle, including minimisation, secure storage, access control, retention, destruction, and reproducibility. Conflicts of interest must be disclosed and managed; deception requires exceptional justification and approval. Public digital data and artificial-intelligence tools create additional risks involving context, re-identification, confidentiality, bias, and accountability. Responsible reporting remains essential after data collection and links research integrity to trustworthy brand governance.

Key Terms

Research ethics: Principles governing responsible research conduct.

Informed consent: Voluntary agreement based on adequate, understandable information.

Beneficence: Duty to promote benefits and protect participant welfare.

Non-maleficence: Duty to avoid or minimise harm.

Justice: Fair distribution of research burdens and benefits.

Research governance: Structures, roles, approvals, and controls governing research.

Confidentiality: Obligation to protect information entrusted by participants or organisations.

Anonymity: Condition in which identity cannot reasonably be linked to data.

Pseudonymisation: Replacing identifiers with codes while retaining a re-identification key.

Data minimisation: Collecting only data necessary for the stated purpose.

Data-management plan: Document specifying how research data will be handled throughout its life cycle.

Data retention: Controlled preservation of data for a justified period.

Reproducibility: Ability to understand and, where possible, repeat an analysis using documented materials and procedures.

Conflict of interest: Secondary interest that may improperly influence, or appear to influence, judgement.

Deception: Deliberate withholding or misrepresentation of information relevant to participation.

Gatekeeper: Person or organisation controlling access to potential participants or a research setting.

Vulnerability: Increased risk of coercion, harm, or limited ability to protect one’s interests.

Research integrity: Honesty, transparency, accuracy, and accountability in research.

Review Questions

Short Answer Questions

1. Distinguish privacy, confidentiality, and anonymity.
2. Why does organisational permission not replace individual informed consent?
3. Identify four elements that should appear in a participant information sheet.
4. What is pseudonymisation, and why is the code key sensitive?
5. Why should public social-media content not automatically be treated as ethically unrestricted?

Long Answer Questions

1. Explain how respect for persons, beneficence, justice, and integrity apply to a brand-management dissertation.
2. Design a data-management plan for a project involving recorded consumer interviews and confidential product information.
3. Discuss how conflicts of interest can affect research design, analysis, and reporting, and propose appropriate controls.
4. Evaluate the ethical conditions under which deception might be considered in brand research.
5. Explain why reproducibility can be pursued without publishing confidential raw data.

Analytical / Application Questions

1. A client asks for the names and raw recordings of employees who criticised a new brand strategy. Analyse the ethical and governance issues and propose a response.
2. A student wants to paste unredacted customer complaints into a free generative-AI tool for thematic analysis. Assess the risks and design a safer workflow.
3. A survey is distributed by managers who can see which employees responded. Evaluate the consent and confidentiality problems and redesign the recruitment and data-collection process.

Multiple Choice Questions with Answers

Question 1

Which principle requires collecting only the information necessary for the research purpose?

A. Data minimisation

B. Deception

C. Reciprocity

D. Open access

Correct Answer: A. Data minimisation

Question 2

Which statement best distinguishes anonymity from pseudonymisation?

A. Anonymity always requires a signed consent form

B. Pseudonymisation uses codes while a re-identification key remains possible

C. Anonymity means that the client owns the data

D. Pseudonymisation makes all data publicly shareable

Correct Answer: B. Pseudonymisation uses codes while a re-identification key remains possible

Question 3

A gatekeeper’s permission to access employees means that:

A. Employees must participate

B. Individual informed consent is unnecessary

C. Access is authorised, but each employee still decides whether to participate

D. The gatekeeper owns all resulting data

Correct Answer: C. Access is authorised, but each employee still decides whether to participate

Question 4

Which action is most appropriate when a researcher changes the approved sample and begins collecting sensitive identifiers?

A. Continue without documentation

B. Delete the original protocol

C. Ask participants to approve the change informally

D. Seek an amendment or new approval as required

Correct Answer: D. Seek an amendment or new approval as required

Question 5

Why is a public social-media post not automatically ethically unrestricted for research use?

A. Public posts cannot contain opinions

B. Context, user expectations, sensitivity, and re-identification risks still matter

C. Researchers may use only printed material

D. All online data are owned by universities

Correct Answer: B. Context, user expectations, sensitivity, and re-identification risks still matter

Question 6

Which practice best supports reproducibility while protecting confidential raw data?

A. Publishing identifiable transcripts

B. Deleting all analysis records after submission

C. Providing a protocol, codebook, decision log, and safe de-identified materials where possible

D. Allowing only the sponsor to inspect the analysis

Correct Answer: C. Providing a protocol, codebook, decision log, and safe de-identified materials where possible

Question 7

A conflict of interest is best managed initially through:

A. Disclosure, assessment, mitigation, and monitoring

B. Automatic cancellation of every project

C. Concealment until publication

D. Allowing the sponsor to rewrite results

Correct Answer: A. Disclosure, assessment, mitigation, and monitoring

Question 8

Consent to participate in an interview automatically permits the researcher to:

A. Use the participant’s quotation in advertising

B. Share raw recordings with any agency

C. Publish identifiable photographs

D. Do none of these unless the additional use is properly covered

Correct Answer: D. Do none of these unless the additional use is properly covered

Question 9

Which is the safest approach to using generative AI with confidential interview transcripts?

A. Upload them to any free public tool

B. Use an approved tool, minimise and remove identifiers, and verify outputs

C. Allow the tool to make final participant-risk decisions

D. Assume that AI systems guarantee confidentiality

Correct Answer: B. Use an approved tool, minimise and remove identifiers, and verify outputs

Question 10

Why should a client’s funding be disclosed in a research report?

A. It proves the findings are invalid

B. It eliminates the need for ethics approval

C. It helps readers assess possible influence and interpret the findings transparently

D. It gives the client authority to alter the results

Correct Answer: C. It helps readers assess possible influence and interpret the findings transparently