Research Ethics, Integrity and Data Governance

Introduction

Business analytics research increasingly uses customer transactions, employee records, social-media content, sensor data, health information, and algorithmically generated or inferred characteristics. These resources can improve decisions, but they also create responsibilities. A technically accurate analysis may still be unacceptable if participants were deceived, privacy was violated, data were manipulated, intellectual property was misused, or an automated system produced discriminatory outcomes.

Research ethics concerns the moral principles governing the design, conduct, reporting, and use of research. Research integrity concerns honesty, rigor, transparency, accountability, and responsible stewardship of evidence. Data governance translates these principles into organizational rules for data ownership, access, quality, security, retention, and disposal. Together, they protect participants, preserve public trust, and improve the credibility and usefulness of research.

For business analytics students, ethics is not an administrative obstacle added after analysis. It is part of methodological quality. The way a dataset is collected determines what claims may legitimately be made from it; the way access is controlled determines whether confidentiality can be maintained; and the way results are communicated determines whether decision-makers understand uncertainty and limitations.

Learning Objectives

By the end of this chapter, you should be able to:

1. Explain the principles of respect for persons, beneficence, non-maleficence, justice, autonomy, and transparency.
2. Design an appropriate informed-consent process, including safeguards for vulnerable participants.
3. Distinguish privacy, confidentiality, anonymity, pseudonymisation, and data security.
4. Apply principles of research integrity, responsible authorship, intellectual property, and conflict-of-interest management.
5. Develop practical data-governance controls for collection, access, retention, sharing, and deletion.
6. Identify ethical risks in artificial intelligence and analytics systems.
7. Evaluate legal, regulatory, and institutional requirements without confusing legal compliance with ethical adequacy.

1. The Ethical Foundations of Research

1.1 Why ethics matters in analytics

Research creates relationships among investigators, participants, organizations, data custodians, funders, and the public. Power is rarely distributed equally. An employer may influence whether workers feel able to participate; a platform may possess information that users do not realize is being analyzed; and a predictive model may affect access to credit, employment, insurance, or public services.

Ethical research therefore asks more than “Can this data be obtained?” It asks:

• Is the purpose legitimate and socially valuable?
• Are participants treated as persons rather than merely as sources of observations?
• Are risks minimized and fairly distributed?
• Is participation voluntary and adequately informed?
• Are data used only in ways that participants and data subjects could reasonably expect?
• Are findings reported honestly, including uncertainty and negative results?

1.2 Core principles

The Belmont principles provide a widely used foundation for research involving human participants:

Respect for persons recognizes autonomy and requires meaningful consent. People with limited decision-making capacity require additional protection.

Beneficence requires researchers to maximize potential benefits and minimize foreseeable harm. Harm may be physical, psychological, social, economic, legal, or reputational.

Justice concerns fair selection of participants and fair distribution of research burdens and benefits. Convenience should not result in disadvantaged groups bearing excessive risk or being excluded from beneficial research.

Other important principles include:

• Non-maleficence: avoid causing preventable harm.
• Integrity: represent methods, data, analyses, and conclusions truthfully.
• Respect for privacy: limit intrusion into personal life and personal information.
• Accountability: maintain records and accept responsibility for decisions.
• Transparency: disclose relevant methods, limitations, funding, conflicts, and changes to approved procedures.
• Proportionality: match the intrusiveness of data collection and controls to the research purpose and risk.

Ethical principles can conflict. For example, a highly detailed dataset may increase analytical value but also increase re-identification risk. Ethical judgment requires considering alternatives that achieve the research objective with less intrusion.

2. Informed Consent

2.1 Meaning and purpose

Informed consent is an ongoing process through which a competent person freely agrees to participate after receiving understandable information about the research. A signed form is evidence of the process, not its complete substance.

A valid consent process normally includes:

1. Information: purpose, procedures, duration, data collected, risks, benefits, compensation, confidentiality arrangements, contacts, and withdrawal procedures.
2. Comprehension: information is communicated in language and format appropriate to the participant.
3. Voluntariness: participation is free from coercion and undue influence.
4. Capacity: the person can understand and decide, or an authorized representative acts according to applicable rules.
5. Documentation: consent is recorded unless an approved alternative is more appropriate.

Consent should explain whether data will be reused, linked with other sources, transferred internationally, used to train models, or shared with collaborators. Participants should not be promised absolute confidentiality when legal disclosure or security incidents remain possible.

2.2 Consent in analytics research

Analytics projects often involve secondary data collected for another purpose. Consent may be absent, broad, impractical, or limited by the original notice. Researchers must examine the original purpose, expectations of data subjects, sensitivity of the data, identifiability, public interest, and applicable law or institutional policy. A dataset being publicly accessible does not automatically make every use ethical.

When individual consent is not feasible, an ethics committee or authorized governance body may permit an alternative basis, such as documented public interest, legitimate organizational purpose, or a justified waiver. Such decisions require safeguards, necessity, proportionality, and risk assessment.

2.3 Withdrawal and limits

Participants should know how to withdraw and what withdrawal means. If data have been irreversibly anonymized, it may be impossible to identify and remove a person’s records. If results have already been aggregated or published, complete removal may also be impossible. These limits must be explained before participation.

3. Vulnerable Participants and Fair Participation

Vulnerability is contextual rather than a permanent label. People may be vulnerable because of age, illness, disability, poverty, language barriers, dependency relationships, incarceration, displacement, limited digital literacy, or reduced legal capacity. Employees, students, patients, and benefit recipients may feel that refusal could affect their status.

Safeguards may include:

• additional explanation and comprehension checks;
• translated and accessible materials;
• consent from an authorized representative where legally required;
• assent from children or persons with limited capacity, in addition to permission;
• independent recruitment rather than recruitment by a direct supervisor;
• separation of participation decisions from employment or service decisions;
• modest, non-coercive compensation;
• additional privacy protections and safety monitoring;
• a clear route for complaints or withdrawal.

Researchers must avoid both exploitation and unjustified exclusion. Excluding all vulnerable groups may produce biased evidence and deny them the benefits of research. Inclusion should be justified by scientific value, feasible safeguards, and fair treatment.

4. Privacy, Confidentiality, Anonymity and Security

These terms are related but not interchangeable.

True anonymity is difficult in large or rich datasets. A person may be re-identified by combining dates, location, occupation, transaction patterns, or public records. Removing names alone is therefore not sufficient.

4.1 Data minimization and purpose limitation

Data minimization means collecting and retaining only what is reasonably necessary for a specified purpose. Purpose limitation means not using data for incompatible purposes without an appropriate basis, notice, or approval. These principles improve privacy and often improve analytical quality by reducing irrelevant variables and uncontrolled sources of bias.

Useful controls include aggregation, suppression of rare categories, coarsening of dates or locations, pseudonymisation, privacy-preserving record linkage, and restricted research environments. De-identification reduces risk but does not guarantee anonymity.

4.2 Security controls

A proportionate security program includes:

• classification according to sensitivity;
• least-privilege access and role-based permissions;
• multi-factor authentication;
• encryption in transit and at rest;
• secure backups and disaster recovery;
• logging and monitoring of access;
• vulnerability management and patching;
• staff training and confidentiality agreements;
• incident-response procedures;
• secure deletion of files, devices, and credentials.

Security is not only an information-technology responsibility. Researchers must avoid sending identifiable files through personal email, storing sensitive data on unapproved devices, or placing confidential information into public AI tools.

5. Data Governance Across the Research Lifecycle

Data governance is the system of decision rights, responsibilities, standards, and controls that ensures data are trustworthy, secure, appropriately used, and available to authorized users.

A practical lifecycle is:

1. Plan: define purpose, legal or institutional basis, data sources, risks, roles, and retention period.
2. Collect or acquire: verify provenance, consent or permission, quality, licensing, and restrictions.
3. Store: apply classification, encryption, backup, and access controls.
4. Process: document transformations, linkage methods, exclusions, and quality checks.
5. Use and share: approve access according to role and purpose; use data-sharing agreements where appropriate.
6. Retain or archive: preserve necessary records in a controlled, documented format.
7. Destroy: securely delete or anonymize data when the approved retention period ends.

Typical governance roles include a data owner, who determines permitted use; a data steward, who manages quality and operational rules; a custodian, who implements storage and security; a researcher, who uses data for an approved purpose; and an ethics or review committee, which assesses participant-related risks.

A data-management plan should specify data elements, source, format, quality checks, access rights, encryption, backup, retention, destruction, sharing, and incident response. Retention should not be indefinite merely because storage is inexpensive. It should reflect scientific reproducibility, contractual duties, legal requirements, and risk.

5.1 Data quality and ethical validity

Poor quality is also an ethical issue. Incorrect, incomplete, outdated, or biased data can lead to harmful decisions. Researchers should document missingness, measurement error, sampling limitations, duplicate records, changes in definitions, and the provenance of derived variables. Fabricating precision through undocumented cleaning is a breach of integrity.

6. Research Integrity and Responsible Conduct

Research misconduct commonly includes:

• Fabrication: making up data or results.
• Falsification: manipulating materials, procedures, images, or data so that the research record is misrepresented.
• Plagiarism: presenting another person’s words, ideas, structure, or work as one’s own without proper attribution.

Questionable practices can also damage integrity: selective reporting, p-hacking, undisclosed exclusion of observations, inappropriate reuse of text, undisclosed changes to hypotheses, duplicate publication, and overstating causal conclusions from observational data.

Good practice includes preregistering hypotheses when appropriate, preserving raw and processed data, version-controlling code, recording analytical decisions, conducting sensitivity analyses, reporting null findings, and distinguishing exploratory from confirmatory analysis. Reproducibility requires enough information for a qualified researcher to understand and, where permitted, repeat the work; it does not require publishing confidential or restricted data.

6.1 Responsible authorship

Authorship should reflect substantial contributions to conception or design, data acquisition, analysis, interpretation, or critical drafting and revision, together with accountability for the final work. Honorary authorship gives credit without responsibility; ghost authorship hides contribution and accountability. Contributors who do not meet authorship criteria should be acknowledged where appropriate.

Before analysis begins, teams should agree on contribution expectations, authorship order or criteria, data ownership, publication rights, and procedures for resolving disputes. A supervisor or funder should not receive automatic authorship solely because of status or financing.

6.2 Intellectual property and licensing

Researchers must distinguish ownership from permission to use. Data may be protected by copyright, database rights, trade-secret obligations, contractual restrictions, confidentiality duties, or terms of service. Software and code may carry open-source licenses with conditions concerning attribution, redistribution, or derivative works. A dataset obtained from a vendor may permit internal analysis but prohibit onward sharing.

Keep records of source, license, permitted uses, attribution requirements, restrictions, and expiration. Do not assume that “public” means “free of rights.” Seek institutional or legal advice when ownership or licensing is unclear.

6.3 Conflicts of interest

A conflict of interest exists when personal, financial, professional, or institutional interests could reasonably appear to influence judgment. A conflict is not automatically misconduct; concealment and poor management are the greater risks.

Researchers should disclose relevant interests, separate sponsor influence from analytic decisions, document deviations from the protocol, use independent review where feasible, and communicate funding and limitations. Contracts should protect the researcher’s ability to report results honestly, including unfavorable findings.

7. Artificial Intelligence and Algorithmic Ethics

AI systems create familiar ethical issues at greater scale and speed. Risks include biased training data, proxy discrimination, opaque models, automation bias, privacy leakage, insecure model interfaces, fabricated outputs, model drift, and unclear accountability.

A responsible AI research process should address:

• Purpose and necessity: Is AI appropriate, and is the objective legitimate?
• Data provenance: Were training and evaluation data obtained lawfully and ethically?
• Representation: Which groups are missing or systematically mismeasured?
• Validity: Does performance generalize to the intended population and context?
• Fairness: Are errors and benefits distributed acceptably across relevant groups?
• Explainability: Can affected people and decision-makers understand important reasons?
• Human oversight: Who reviews outputs and can override them?
• Security: Can prompts, data, or model outputs expose confidential information?
• Monitoring: How will drift, harms, complaints, and unexpected uses be detected?
• Accountability: Who is responsible when the system causes harm?

Fairness cannot be reduced to one universal metric. For example, equal selection rates, equal false-positive rates, and equal calibration may not all be achievable simultaneously when groups differ in base rates. Researchers must define the relevant harm, justify the chosen measure, and consider social and institutional context.

Generative AI may assist with coding, drafting, translation, or brainstorming, but users remain responsible for accuracy, confidentiality, attribution, and originality. Sensitive research data should not be entered into a tool unless its security, terms, retention, and approved use are understood. AI-generated citations, quotations, data, or analyses must be verified rather than trusted automatically.

8. Legal and Institutional Requirements

Ethical obligations arise from several sources: national data-protection and privacy law, sector-specific regulation, intellectual-property law, contractual terms, professional codes, institutional policies, and research-ethics review requirements. Requirements differ by jurisdiction and sector. Examples of issues that may require review include cross-border transfers, employee monitoring, health information, children’s data, biometric identifiers, automated decisions, and breach notification.

Legal compliance is a minimum, not a complete ethical analysis. An action can be lawful yet unexpected, unfair, or harmful. Conversely, institutional policy may impose stricter safeguards than legislation.

Before collecting data, researchers should determine whether institutional ethics review, a privacy impact assessment, information-security approval, data-access committee approval, or contractual review is required. Approval must be obtained before relevant research begins, and amendments should be submitted when procedures, populations, risks, or data uses materially change.

9. Applied Case: Customer Churn and Employee Data

Background

This illustrative case concerns a telecommunications company conducting a university-industry research project to predict customer churn. The team proposes combining billing records, service complaints, mobile-app activity, and employee notes from customer-service interactions. The intended benefit is earlier support for customers likely to leave.

Problem

The proposed data include free-text notes that may contain health information, financial hardship, or family circumstances. The company wants to retain all records indefinitely and use a third-party generative AI service to summarize notes. The research team also plans to include employee performance scores as predictors. Customers were originally informed that their data would be used to provide services, not necessarily for research or individualized retention offers.

Analysis

The team identifies several risks. First, the purpose of research and the purpose of service delivery may not be identical. Second, free text is difficult to minimize and may contain highly sensitive information. Third, employee scores may create unfair inferences and expose workers to employment consequences. Fourth, sending data to an external AI provider may create confidentiality and international-transfer risks. Fifth, indefinite retention increases the consequences of a breach and may exceed necessity.

Approach and solution

The team creates a data-management plan and conducts a privacy and ethical risk assessment. It excludes health and family details from modeling unless specifically justified, uses structured complaint categories where possible, and pseudonymises customer and employee identifiers. Employee data are separated from operational performance decisions and used only with explicit governance approval.

The team evaluates whether consent or another approved basis is available for secondary research use, provides clear notice where feasible, and obtains ethics and institutional approvals before analysis. A secure environment is used; access is role-based and logged. The external AI tool is not used for identifiable notes. If automated summarization is necessary, an approved private environment is selected, inputs are minimized, and outputs are reviewed for hallucinations and sensitive disclosure.

The model is evaluated across customer groups for predictive performance and unequal error patterns. Results are reported as decision support rather than certainty. Customers are not automatically penalized; staff review recommendations, and a process exists for correction and complaint. A defined retention schedule requires deletion or irreversible anonymization after the approved period.

Outcome

The revised project produces a less intrusive model using fewer variables, with documented limitations and stronger controls. Some predictive accuracy decreases slightly, but the organization gains defensible governance, clearer accountability, and reduced risk of discriminatory or unauthorized use.

Learning points

Ethical design can improve rather than prevent useful research. Data minimization, human review, transparent purpose, and secure architecture should be designed at the beginning, not added after model development. A predictive model is not ethically acceptable merely because it is accurate.

10. An Ethics and Governance Decision Framework

For each proposed project, ask:

1. What legitimate question or public benefit justifies the research?
2. What data are strictly necessary?
3. Who may be harmed, excluded, or disadvantaged?
4. What consent, permission, or approved alternative applies?
5. Can the objective be achieved with less identifiable or less sensitive data?
6. Who owns or controls the data, and what licenses or contracts apply?
7. Who may access the data, for what purpose, and for how long?
8. How will quality, bias, security, and incidents be monitored?
9. How will results, uncertainty, conflicts, and limitations be communicated?
10. When and how will the data and derived materials be archived or destroyed?

Documenting answers creates an auditable trail and makes ethical reasoning visible to collaborators, reviewers, and affected stakeholders.

Challenges and Limitations

Ethical decision-making is not mechanical. Principles may conflict, laws may differ across jurisdictions, and risk estimates may be uncertain. Anonymization can reduce usefulness; strict access controls can impede collaboration; and fairness interventions may change performance or create new trade-offs. Consent may not fully predict future uses of data, especially in rapidly changing AI environments. Institutional review can also become overly procedural if it focuses on forms rather than real-world power and harm.

Ethics must therefore be continuous. Researchers should revisit assumptions when new data are linked, models are deployed, participants’ circumstances change, or outputs are used for decisions beyond the original purpose. Consultation with privacy officers, security specialists, domain experts, affected communities, and legal advisers is often necessary.

Contemporary Best Practices

A professionally responsible analytics researcher should:

• use privacy and security by design;
• maintain a current data dictionary and provenance record;
• separate identifying data from analytical data;
• apply least privilege and multi-factor authentication;
• version-control code and document transformations;
• preregister or timestamp important decisions where appropriate;
• test models across relevant populations;
• disclose funding, conflicts, limitations, and AI assistance;
• establish retention and secure-destruction schedules;
• report incidents promptly through approved channels;
• provide meaningful human review for consequential decisions;
• treat affected people and communities as stakeholders, not merely variables.

Chapter Summary

Research ethics, integrity, and data governance are interconnected foundations of credible business analytics. Respect for persons requires informed, voluntary, and comprehensible consent, with additional safeguards for vulnerable participants. Privacy, confidentiality, anonymity, pseudonymisation, and security describe different protections and should not be treated as synonyms. Data governance manages the full lifecycle from planning and collection through access, retention, sharing, and secure destruction.

Integrity requires honest data, transparent methods, accurate reporting, proper attribution, responsible authorship, and disclosure of conflicts. Intellectual-property rights and licensing determine whether data, software, and outputs may be used or shared. AI introduces additional concerns involving provenance, bias, explainability, privacy, human oversight, security, and accountability. Law and institutional review establish important requirements, but ethical responsibility extends beyond minimum legal compliance. The strongest projects integrate these considerations into design rather than treating them as post hoc approvals.

Key Terms

Anonymity: A condition in which identity cannot reasonably be linked to research data.

Beneficence: The obligation to maximize potential benefits and minimize harm.

Confidentiality: The duty to protect information entrusted to the researcher.

Conflict of interest: An interest that could influence, or appear to influence, professional judgment.

Data governance: Rules, roles, standards, and controls for responsible data management.

Data minimization: Collecting and retaining only data necessary for a defined purpose.

Fabrication: Inventing data, observations, or results.

Falsification: Manipulating research materials or processes to misrepresent findings.

Informed consent: Voluntary agreement based on adequate information and comprehension.

Intellectual property: Legally protected creations, data rights, software, inventions, and expressions.

Justice: Fair distribution of research burdens and benefits.

Least privilege: Giving users only the access necessary for authorized tasks.

Non-maleficence: The obligation to avoid preventable harm.

Pseudonymisation: Replacing identifiers with codes while retaining possible re-linking through a key.

Privacy: Control over access to a person, personal life, or personal information.

Research integrity: Honest, rigorous, transparent, and accountable conduct of research.

Responsible authorship: Assigning authorship according to substantial contribution and accountability.

Vulnerability: A context-specific reduction in ability to protect interests or make free decisions.

Review Questions

Short Answer Questions

1. Distinguish privacy, confidentiality, anonymity, and pseudonymisation.
2. What four elements are normally required for informed consent?
3. Define fabrication and falsification.
4. Why is data minimization an ethical as well as a security principle?
5. State two safeguards for research involving vulnerable participants.

Long Answer Questions

1. Explain how the principles of respect for persons, beneficence, and justice apply to a customer analytics project.
2. Describe a complete data-governance lifecycle for a university-industry research study.
3. Discuss responsible authorship, intellectual property, and conflicts of interest in collaborative research.
4. Explain why legal compliance does not necessarily guarantee ethical adequacy.
5. Evaluate the main ethical risks of using generative AI with confidential research data.

Analytical / Application Questions

1. A retailer wants to combine loyalty-card records with publicly available social-media data to predict financial hardship. Identify the main ethical and governance risks and propose a defensible research design.
2. An algorithm has equal overall accuracy across two demographic groups but substantially higher false-positive rates for one group. Explain why this may be ethically significant and recommend further analysis or action.
3. A researcher discovers that a sponsor is suppressing an unfavorable result. Outline the integrity, authorship, reporting, and escalation steps the researcher should take.

Multiple Choice Questions with Answers

Question 1

Which principle requires fair distribution of research burdens and benefits?

A. Justice

B. Anonymity

C. Data minimization

D. Least privilege

Correct Answer: A. Justice

Question 2

Which statement best describes pseudonymisation?

A. All data are permanently destroyed

B. Identifiers are replaced by codes and may be re-linked using a separate key

C. No personal data are ever collected

D. Data are published without access controls

Correct Answer: B. Identifiers are replaced by codes and may be re-linked using a separate key

Question 3

Which practice is an example of falsification?

A. Acknowledging a research assistant

B. Using a licensed dataset

C. Changing recorded results to support a preferred conclusion

D. Encrypting a research file

Correct Answer: C. Changing recorded results to support a preferred conclusion

Question 4

What is the primary purpose of informed consent?

A. To guarantee that research produces a benefit

B. To allow voluntary agreement based on adequate information and understanding

C. To transfer data ownership to the participant

D. To eliminate every possible research risk

Correct Answer: B. To allow voluntary agreement based on adequate information and understanding

Question 5

Which control most directly supports the principle of least privilege?

A. Giving every team member administrator access

B. Allowing access only to data and functions required for an authorized role

C. Publishing the entire dataset openly

D. Keeping passwords in a shared document

Correct Answer: B. Allowing access only to data and functions required for an authorized role

Question 6

Why is a publicly accessible dataset not automatically unrestricted for research use?

A. Public data are always inaccurate

B. Access may still be subject to privacy expectations, licenses, contracts, or law

C. Public data cannot be analyzed statistically

D. Researchers may never use secondary data

Correct Answer: B. Access may still be subject to privacy expectations, licenses, contracts, or law

Question 7

Which practice best supports research integrity?

A. Reporting only statistically favorable results

B. Deleting inconvenient observations without documentation

C. Version-controlling code and documenting analytical decisions

D. Allowing sponsors to approve all conclusions

Correct Answer: C. Version-controlling code and documenting analytical decisions

Question 8

A direct supervisor recruits employees for a sensitive study. What is the principal ethical concern?

A. Possible undue influence that may weaken voluntariness

B. The study cannot use quantitative methods

C. Employees cannot provide any form of consent

D. Supervisors are never allowed to conduct research

Correct Answer: A. Possible undue influence that may weaken voluntariness

Question 9

Which is a responsible practice when using generative AI in research?

A. Uploading identifiable confidential data to any free public tool

B. Assuming generated citations are accurate

C. Using an approved secure environment and verifying outputs

D. Allowing the model to make consequential decisions without review

Correct Answer: C. Using an approved secure environment and verifying outputs

Question 10

What should determine a research dataset's retention period?

A. The desire to keep every file indefinitely

B. Scientific, legal, contractual, and risk-based requirements

C. The amount of free cloud storage available

D. Whether the file has an attractive name

Correct Answer: B. Scientific, legal, contractual, and risk-based requirements