Research Ethics, Governance and Data Management

Introduction and context

Human resource management research often concerns people’s employment, income, health, identity, performance, relationships and future career opportunities. This gives HR research considerable strategic value, but it also creates ethical risks. An interview about workplace bullying, a survey about discrimination, an analysis of absence records or an experiment involving performance feedback may affect participants even when the researcher’s intentions are positive.

Research ethics is therefore not a formality completed after a research design has been written. It is a continuing process of identifying possible harms, protecting participants, justifying the production and use of knowledge, and demonstrating responsible stewardship of information. Governance provides the organisational structures through which ethical research is reviewed, authorised, monitored and documented. Data management translates ethical principles into operational controls covering collection, access, storage, analysis, retention and disposal.

In HRM, ethical practice is especially important because researchers may study people within relationships of unequal power. Employees may believe that participation is expected by a manager, fear that refusal will damage their career, or doubt that confidentiality can really be maintained. A sound dissertation must therefore protect both the rights of participants and the credibility of the research.

Learning objectives

By the end of this chapter, students should be able to:

1. Explain informed consent, confidentiality, anonymity, fairness and harm minimisation.
2. Identify power imbalances and heightened risks in employee research.
3. Design appropriate procedures for sensitive employee data.
4. Prepare an ethics application and understand the purpose of ethics approval.
5. Apply privacy, intellectual property, retention and research-integrity requirements.
6. Construct a proportionate data-management plan.
7. Evaluate ethical decisions in an applied HR research scenario.

1. Ethical foundations of HR research

1.1 Respect for persons and autonomy

Respect for persons means recognising participants as individuals capable of making voluntary, informed decisions. Participation should not be treated as an organisational resource that managers can command. A participant must understand what the study involves, what information will be collected, how it will be used, foreseeable risks, possible benefits, the identity of responsible researchers, and the right to decline or withdraw where withdrawal is practicable.

Autonomy is limited when people lack relevant information, are under pressure, or cannot realistically refuse. Consent is consequently more than signing a form. It is a communication process in which the researcher provides accessible information and checks that participation is voluntary and understood.

1.2 Beneficence and non-maleficence

Beneficence requires researchers to seek worthwhile benefits, such as improved understanding of employee wellbeing or fairer HR policies. Non-maleficence requires them to avoid or reduce harm. Possible harms include:

• psychological distress when discussing harassment or dismissal;
• professional or financial harm if critical comments are disclosed;
• social harm if colleagues infer a participant’s identity;
• privacy loss through exposure of health, demographic or disciplinary information; and
• legal or reputational harm to participants, organisations or researchers.

A useful ethical test is whether the research question is important enough to justify the residual risk after reasonable safeguards have been applied. Low risk does not mean no risk.

1.3 Justice and fairness

Justice concerns the fair distribution of research burdens and benefits. Researchers should not recruit a convenient group merely because it is accessible or less able to object. Nor should they exclude groups without a defensible reason. Fairness requires attention to inclusion, accessibility, compensation, selection criteria and the use of findings.

For example, a study of remote work that surveys only senior office-based staff may produce systematically misleading conclusions. A fair design considers whether disabled employees, shift workers, temporary workers and employees with limited digital access can participate meaningfully.

1.4 Respect for privacy

Privacy is a person’s interest in controlling access to their body, personal life, communications and information. Privacy is not identical to secrecy. An employee may agree to disclose information for a defined research purpose while objecting to its use for performance management. Researchers must specify boundaries and avoid collecting information simply because it is available.

1.5 The principle of proportionality

Ethical review should be proportionate to risk. An anonymous survey about general training preferences normally requires fewer safeguards than interviews about sexual harassment linked to identifiable departments. Proportionality does not remove the need for ethics review; it determines the intensity of review and controls required.

2. Consent in employee research

2.1 Elements of valid informed consent

A robust consent process normally includes:

1. Information: purpose, procedures, duration, data collected, risks, benefits, funding and contacts.
2. Comprehension: information is written in clear language, with technical terms explained.
3. Voluntariness: participation is free from coercion, undue influence and inappropriate inducement.
4. Capacity: the person is able to understand and decide, with appropriate support where required.
5. Recording: consent is documented in a form appropriate to the study.
6. Ongoing opportunity: participants can ask questions and, where feasible, withdraw.

Consent forms should not promise absolute confidentiality if a serious legal or safeguarding exception may apply. They should explain realistic limits, including the possibility that a small workplace group may be identifiable from quotations or job descriptions.

2.2 Consent and organisational permission

Permission from an organisation is not the same as consent from employees. A chief executive may permit access to a workforce, but cannot consent on employees’ behalf. Researchers usually need both organisational access approval and individual participant consent.

Managers should not normally collect completed consent forms or know who declined. Recruitment messages should make clear that participation, refusal and withdrawal will not affect employment.

2.3 Digital and implied consent

Online studies may use a consent screen before a participant proceeds. Implied consent, such as completion of an anonymous survey, may be acceptable only when the information provided is adequate, the study is minimal risk, and the relevant institution permits the approach. Sensitive research usually requires explicit consent.

2.4 Incentives

Reasonable incentives compensate time and inconvenience. Excessive payments may create undue influence, particularly for low-paid or precarious workers. Incentives should not depend on providing a particular answer. Where possible, payment should not reveal participation to supervisors or colleagues.

3. Confidentiality, anonymity and pseudonymisation

These concepts are related but distinct.

Anonymity is often difficult in qualitative HR research. A quotation such as “I am the only night-shift nurse in the regional branch” may identify a person even when the name is removed. Researchers should assess indirect identifiers, redact or generalise quotations, combine categories and avoid reporting very small groups where appropriate.

Confidentiality requires access controls, secure transfer, encrypted storage where available, careful transcription and a clear publication plan. Researchers should not promise that data will be shared anonymously if re-identification remains reasonably possible.

4. Power, vulnerability and sensitive employee data

4.1 Power imbalances

Employment relationships involve authority, dependence and evaluation. A manager-researcher may control schedules, promotion recommendations or performance ratings. Even a polite invitation can be perceived as an instruction. Students researching their own workplace may also face divided loyalties and concerns about career consequences.

Safeguards include independent recruitment, separating research from management functions, allowing private participation, using an independent contact for questions, avoiding recruitment of direct reports, and ensuring supervisors do not receive individual responses.

4.2 Vulnerability is contextual

Vulnerability is not a fixed label attached to a group. It can arise from circumstances such as insecure immigration status, disability, illness, language barriers, financial dependence, low literacy, probationary employment or fear of retaliation. The appropriate response is not automatic exclusion but proportionate protection and accessible participation.

4.3 Categories of sensitive data

Sensitive employee information may include health and biometric data, trade union membership, ethnicity, religion, sexual orientation, gender identity, criminal allegations, disciplinary records, salary, immigration status, whistleblowing reports and information about trauma or harassment. Applicable privacy law differs by jurisdiction, but the ethical expectation is consistent: collect the minimum necessary data, use it for specified purposes, restrict access and protect it throughout its lifecycle.

Researchers should not copy an entire HR database when a small, de-identified extract will answer the research question. A data dictionary should identify each field, its purpose, format, source, sensitivity and retention period.

5. Ethics approval and research governance

5.1 What ethics approval does

An ethics committee, institutional review board or equivalent body independently examines whether a proposed study is ethically acceptable. It considers participants, recruitment, consent, risks, privacy, data security, incentives, researcher safety and dissemination. Approval is an authorisation subject to the approved protocol; it is not a guarantee that the study is risk-free.

Students must determine the relevant institutional process before collecting data. Beginning interviews or distributing a survey before approval may invalidate the project and expose participants and the institution to risk.

5.2 Typical ethics application contents

A strong application normally contains:

• research rationale and questions;
• methodology and sampling strategy;
• participant characteristics and inclusion/exclusion criteria;
• recruitment materials;
• participant information sheet and consent form;
• risk assessment and mitigation measures;
• data-management and security plan;
• arrangements for compensation;
• researcher safety procedures;
• plans for handling distress, disclosures or safeguarding concerns;
• conflicts of interest;
• anticipated outputs and data sharing; and
• supervision and institutional responsibility.

Ethics approval may be full, delegated, expedited, conditional or exempt according to institutional rules. “Exempt” does not mean “unethical”; it means the activity falls within a recognised low-risk category. Any material change to participants, instruments, data use or recruitment should be submitted for amendment before implementation.

5.3 Researcher safety and duty of care

Ethical governance includes researchers. Interviews about violence, discrimination or organisational failure may create emotional, physical or professional risks. Researchers should use suitable locations or secure platforms, establish check-in procedures, avoid unnecessary personal disclosure, and know how to respond to threats or distress. A lone-researcher risk assessment is particularly important for fieldwork outside normal working hours.

6. Data management across the research lifecycle

Data management is the planned handling of information from design to destruction or archiving.

6.1 Before collection

Define the research purpose and data requirements. Create a data inventory and classify data by sensitivity. Decide who needs access, where files will be stored, how long they will be retained and whether data will be shared. Use privacy-by-design principles: build protection into the method rather than attempting to repair weaknesses later.

A useful data-management plan answers five questions:

1. What data will be collected?
2. Why is each item necessary?
3. Who may access it and under what conditions?
4. How will it be protected, retained and disposed of?
5. How will results be shared without causing harm?

6.2 Collection and transfer

Use approved systems rather than personal email, unprotected USB drives or consumer applications that have not been assessed. Verify recipients before sending files. Where feasible, separate identifiers from research data at the point of collection. Paper records should be secured and transported discreetly.

Audio recording requires specific consent. Transcription services, cloud platforms and AI tools may transfer data across borders or retain prompts. Sensitive transcripts should not be uploaded to an AI service unless institutional policy, contractual safeguards, legal requirements and participant consent permit it. De-identification is not automatically achieved by deleting names; voices, quotations and contextual details can remain identifying.

6.3 Storage and access

Use strong authentication, role-based access, encryption where available, secure backups and version control. The principle of least privilege means each person receives only the access necessary for their role. Keep the re-identification key separately from coded data, and record access to sensitive files when systems allow.

A simple access matrix can clarify responsibilities:

6.4 Analysis and reporting

Ethical analysis requires accuracy, transparency and restraint. Do not remove inconvenient cases merely because they weaken a preferred conclusion. Maintain an audit trail showing coding decisions, amendments and exclusions. Report limitations, missing data and alternative interpretations.

When reporting employee data, suppress or combine categories that could identify individuals. Use quotations only when necessary and edit identifiable details without changing meaning. Researchers must not provide managers with individual-level findings when participants were promised only aggregate reporting.

6.5 Retention and secure disposal

Retention should be based on institutional policy, legal obligations, funder requirements and the needs of verification—not indefinite possession. The retention period and disposal method should be explained to participants where possible. Secure disposal may involve certified deletion, destruction of paper records and removal of backups according to approved procedures. A file is not necessarily deleted merely because it has been removed from a visible folder.

7. Privacy, intellectual property and research integrity

7.1 Privacy compliance

Privacy laws commonly require a lawful and transparent basis for processing, purpose limitation, data minimisation, accuracy, security, retention control and respect for data-subject rights. Exact requirements vary by country and sector. Students must consult their institution’s privacy office and applicable law rather than assuming that consent alone resolves every privacy issue.

International transfers, cloud storage, employee monitoring data and special categories of personal information may require additional safeguards. Anonymised information may fall outside some legal regimes, but the threshold for true anonymisation is demanding.

7.2 Intellectual property and copyright

Research instruments, scales, interview schedules, databases, reports and software may be protected by copyright or contractual terms. A scale found online cannot automatically be copied into a dissertation. Check licence conditions, request permission when necessary, cite sources and distinguish adaptation from original creation. Employer records remain subject to organisational ownership and access restrictions even when a student analyses them.

Participants own their personal experiences and do not normally surrender all rights merely by signing consent. Consent to research use is purpose-specific and should not be treated as unrestricted commercial permission.

7.3 Research integrity

Research integrity requires honesty, rigour, transparency, accountability and respect. Serious breaches include fabrication, falsification, plagiarism, undisclosed conflicts, selective reporting, inappropriate authorship and unauthorised data access. Questionable practices include changing hypotheses after seeing results without disclosure, presenting exploratory findings as confirmatory, and using unverifiable quotations.

Maintain secure dated records, preserve original data, document analytical decisions and acknowledge contributions accurately. Supervisors should help students understand that a null or inconvenient result is a legitimate research result.

8. Ethical decision-making framework

Ethical problems rarely have one obvious answer. A practical framework is:

1. Identify the stakeholders, interests and power relationships.
2. Describe the proposed activity and the data involved.
3. Identify possible physical, psychological, social, legal and informational harms.
4. Consider autonomy, beneficence, non-maleficence, justice and privacy.
5. Develop alternatives that reduce collection, access or disclosure.
6. Test whether consent is informed and voluntary.
7. Consult the supervisor, ethics committee, privacy officer or safeguarding lead.
8. Document the decision, assumptions and residual risks.
9. Monitor new risks and amend the protocol when necessary.

This framework supports judgment but does not replace institutional rules or legal advice.

Applied case: The engagement survey at Northstar Logistics

This is a fictional illustrative case.

Background

Northstar Logistics asks a final-year HRM student to investigate low engagement among warehouse employees. The HR director offers access to absence records, performance ratings and employee email addresses. The student’s workplace supervisor suggests that all employees should complete the survey and asks for a list of non-respondents.

Problem

The proposed design creates several risks. Employees may perceive the survey as compulsory. The combination of department, shift, age, absence and performance data could identify individuals. The request for non-respondents undermines voluntariness. Linking survey answers to performance ratings could also lead to employment consequences unrelated to the stated research purpose.

Analysis

The research question may be worthwhile, but the initial design violates proportionality and data minimisation. The student has a dual role as researcher and employee, while the HR director controls access and may influence career opportunities. Consent would be questionable if supervisors could monitor participation. Confidentiality would be weak if small teams were reported separately.

Approach and solution

The student revises the protocol as follows:

• recruitment is conducted by an independent HR contact or researcher;
• managers receive only a general invitation and no response list;
• participation and refusal are explicitly described as voluntary;
• the survey collects broad tenure bands rather than exact start dates;
• individual performance and absence records are excluded because they are unnecessary;
• results are reported only for groups large enough to reduce identification risk;
• raw data are stored in an approved institutional system;
• a separate consent form is used for optional interviews;
• the ethics committee reviews the amended design before collection; and
• findings are presented as aggregate patterns, with limitations clearly stated.

Outcome

The revised study produces a lower-risk dataset and credible evidence about workload, supervisor support and development opportunities. The organisation receives useful recommendations but cannot identify individual critics. Participation is lower than the director initially expected, yet the resulting data are more ethically defensible and less likely to be distorted by fear.

Learning points

Organisational access is not participant consent. More data do not necessarily produce better HR research. Independence in recruitment, data minimisation, group-size protection and clear reporting boundaries are practical responses to power imbalance. Ethical safeguards can improve validity because employees are more likely to provide candid information when they trust the process.

Challenges and limitations

Ethical safeguards create practical tensions. Anonymity can limit follow-up and prevent correction of inaccurate data. De-identification may reduce analytical detail. Strict retention limits can make later verification difficult. Independent recruitment may reduce response rates. Compensation can be fair in one context but coercive in another. Aggregate reporting can conceal differences affecting minority groups.

There is also a risk of “ethics washing”, in which approval is treated as evidence that all decisions are ethical. Committees cannot anticipate every fieldwork event, and approved procedures may become inappropriate when organisational conditions change. Ethical research therefore requires reflexivity: researchers should examine how their identity, institutional position and assumptions influence access, interpretation and reporting.

Contemporary developments: digital HR and artificial intelligence

People analytics, workplace platforms and generative AI expand the volume and speed of HR research, but they also intensify governance challenges. Passive data such as keystrokes, badge access or collaboration metadata may be collected without meaningful awareness. Predictive models can reproduce historical discrimination, and apparently anonymous datasets can be re-identified by combining sources.

Before using AI or automated tools, researchers should ask whether the tool is approved, whether data leave the institution, whether prompts are retained, whether outputs are reliable, and whether confidential information could be exposed. AI may assist with generic drafting or organisation of fully de-identified material, but researchers remain responsible for accuracy, confidentiality, bias assessment, citation and disclosure of use. AI-generated text or analysis must not replace methodological judgment or be presented as independently verified evidence.

Best-practice checklist for a dissertation

Before data collection, confirm that:

• the research question requires the proposed data;
• ethics approval and organisational permissions are in place;
• recruitment is voluntary and avoids direct supervisory pressure;
• participant information and consent materials are understandable;
• risks, withdrawal and confidentiality limits are explained;
• sensitive data are minimised and classified;
• storage, access, transfer, retention and disposal are documented;
• copyright and licence requirements are checked;
• researcher safety and safeguarding procedures are available; and
• amendments will be submitted before material changes are made.

Before submission, confirm that:

• no participant is identifiable through names, quotations or combinations of details;
• findings are reported honestly, including limitations;
• raw data are not included unnecessarily;
• contributions, sources and permissions are acknowledged; and
• the final dataset is retained or destroyed according to the approved plan.

Chapter Summary

Ethical HR research protects autonomy, wellbeing, privacy, dignity and fairness while producing trustworthy knowledge. Informed consent must be voluntary, understandable and appropriately documented; organisational permission cannot substitute for individual consent. Confidentiality, anonymity and pseudonymisation have different meanings, and indirect identifiers can make employees recognisable even after names are removed. Power imbalances require independent recruitment, clear separation between research and management, and protection from retaliation.

Ethics approval provides independent scrutiny of risks, consent, recruitment, data security and dissemination. Data governance extends across the full lifecycle: minimise collection, control access, secure storage, maintain an audit trail, report responsibly and dispose of data appropriately. Privacy law, intellectual property, research integrity and institutional policy must be considered together. Digital HR systems and AI create additional risks involving surveillance, re-identification, bias and external processing. Ethical practice is continuous, proportionate and reflexive rather than a single approval event.

Key Terms

Anonymity: A condition in which a participant cannot reasonably be identified from the data.

Beneficence: The obligation to pursue worthwhile benefits and positive outcomes.

Confidentiality: Protection of information known to authorised researchers from unauthorised disclosure.

Consent: A voluntary and informed agreement to participate in research.

Data minimisation: Collecting only information necessary for the stated research purpose.

Data governance: Structures, policies and responsibilities controlling data use and protection.

Data integrity: Accuracy, completeness, consistency and reliability of research data.

De-identification: Modification of data to reduce the possibility of identifying individuals.

Ethics approval: Formal authorisation following review of a study’s ethical acceptability.

Fairness: Equitable treatment and distribution of research burdens and benefits.

Informed consent: Consent based on adequate information and understanding.

Intellectual property: Legally protected creations, works, instruments, databases or inventions.

Justice: Fair selection of participants and fair distribution of risks and benefits.

Least privilege: Giving each user only the access necessary for their role.

Non-maleficence: The obligation to avoid or minimise harm.

Pseudonymisation: Replacing identifiers with codes while retaining a separable re-identification key.

Research integrity: Honest, rigorous, transparent and accountable conduct of research.

Sensitive data: Information that could cause significant harm, discrimination or privacy loss if misused.

Power imbalance: Unequal authority or dependence that may affect voluntary participation.

Retention period: The approved length of time research data are kept.

Review Questions

Short Answer Questions

1. Distinguish confidentiality from anonymity.
2. Why is organisational permission insufficient as evidence of employee consent?
3. Identify three safeguards for research involving a manager’s direct reports.
4. What is data minimisation, and why is it important in HR research?
5. Name four matters normally considered in an ethics application.

Long Answer Questions

1. Explain the principles of autonomy, beneficence, non-maleficence and justice, using HR research examples.
2. Discuss how a researcher should manage sensitive employee interview data from collection through disposal.
3. Explain why indirect identifiers create risks in supposedly anonymous workplace research.
4. Evaluate the relationship between privacy compliance, intellectual property and research integrity.
5. Discuss the ethical opportunities and risks created by people analytics and generative AI.

Analytical / Application Questions

1. You are asked to survey employees about harassment, and the HR director wants access to individual responses. Analyse the ethical issues and propose a revised design.
2. A qualitative report includes a quotation from the only disabled employee in a small branch. Explain the identification risks and recommend how the quotation should be handled.
3. A student discovers after approval that a cloud transcription service stores audio outside the country. Decide what actions should be taken before further transcription occurs.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes anonymity from confidentiality?

A. Anonymity means data are encrypted, while confidentiality means data are deleted.

B. Anonymity means identity is not reasonably linkable, while confidentiality means known identities are protected from disclosure.

C. Anonymity applies only to qualitative research, while confidentiality applies only to surveys.

D. Anonymity requires organisational permission, while confidentiality requires no consent.

Correct Answer: B. Anonymity means identity is not reasonably linkable, while confidentiality means known identities are protected from disclosure.

Question 2

What is the most appropriate response when a line manager recruits their direct reports for a sensitive study?

A. Require employees to participate during paid working time.

B. Give the manager access to individual responses.

C. Use independent recruitment and clearly state that participation is voluntary.

D. Omit the consent process because the manager authorised the study.

Correct Answer: C. Use independent recruitment and clearly state that participation is voluntary.

Question 3

Which practice best demonstrates data minimisation?

A. Copying the complete HR database for possible future analysis.

B. Collecting exact birth dates when age bands answer the research question.

C. Collecting only the fields necessary to answer the stated research question.

D. Retaining all raw data indefinitely.

Correct Answer: C. Collecting only the fields necessary to answer the stated research question.

Question 4

What is the primary purpose of ethics approval?

A. To guarantee that research results will be statistically significant.

B. To provide independent scrutiny of risks, consent, privacy and research procedures.

C. To transfer ownership of participants’ information to the university.

D. To permit researchers to ignore privacy law.

Correct Answer: B. To provide independent scrutiny of risks, consent, privacy and research procedures.

Question 5

Which example is pseudonymisation?

A. Not collecting any participant identifiers.

B. Replacing names with codes while keeping the code key separately.

C. Publishing names only in an appendix.

D. Deleting a participant’s data after analysis.

Correct Answer: B. Replacing names with codes while keeping the code key separately.

Question 6

Why can an apparently anonymous quotation still identify an employee?

A. All quotations automatically contain legal names.

B. Unique job roles, locations or circumstances can act as indirect identifiers.

C. Anonymity is impossible in every survey.

D. Confidentiality rules require quotations to be attributed.

Correct Answer: B. Unique job roles, locations or circumstances can act as indirect identifiers.

Question 7

Which action is most consistent with research integrity?

A. Removing cases that conflict with the researcher’s preferred conclusion.

B. Reporting methods, limitations and analytical decisions transparently.

C. Presenting exploratory findings as pre-specified hypotheses without disclosure.

D. Allowing an employer to rewrite participant findings.

Correct Answer: B. Reporting methods, limitations and analytical decisions transparently.

Question 8

A researcher wants to upload identifiable interview transcripts to an unapproved AI service. What should happen first?

A. Upload them because AI tools are automatically confidential.

B. Remove only the participants’ first names and upload immediately.

C. Check institutional approval, privacy safeguards, processing terms and consent before use.

D. Ask the employer for permission instead of participants.

Correct Answer: C. Check institutional approval, privacy safeguards, processing terms and consent before use.

Question 9

Which principle concerns fair distribution of research burdens and benefits?

A. Justice

B. Pseudonymisation

C. Least privilege

D. Data integrity

Correct Answer: A. Justice

Question 10

What does the principle of least privilege require?

A. Every project member receives access to every file.

B. Only the principal investigator may ever access research data.

C. Each person receives only the access necessary for their role.

D. Participants receive access to other participants’ responses.

Correct Answer: C. Each person receives only the access necessary for their role.