With the following measures you protect the personal data of your participants. The exact measures required for each study are different from study to study. Some measures are mandatory.
1. Collect as little personal data as possible
Only collect data that is necessary for your research. All additional personal data that you collect means a privacy risk for the participant.
2. Pseudonymize (required!)
Information that can identify a person directly is only necessary in order to contact participants or to distinguish them from each other. Storing this data in a separate file outside of Qualtrics reduces the privacy risk for the participants.
Try to use ranges where possible, such as age ranges instead of date or year of birth.
Pseudonymize: also in contact list / panel!
Qualtrics has the inbuilt option of creating a contact list or panel for inviting your respondents. Contacts in this list must contain at least an e-mail address. Please limit yourself to entering only an e-mail address and, if necessary, the pseudonym. The pseudonym is needed whenever you need to link a respondent to their response, for example during follow-up or longitudional research.
Please note: the data remains traceable!
Pseudonymization is reversible: when you have the key file you are able to trace data to an individual. As a result, pseudonymised personal data will always remain personal data. Legal protection still applies. Please take extra care!
The data can also be made anonymous. A distinction must be made between collecting and processing the data. When you collect your data, please follow the guidelines of your ethics committee. You may not collect the data anonymously. In other words: you must be able to prove that you obtained the data from real, existing people. More about anonymizing data.
Data should preferably be processed anonymously. Qualtrics offers the following anonymization options:
When you collect your responses via a so called anonymous link, there is no link with personal data at all. Unless you collect any personal data in one of the survey questions. Your ethics committee however may not allow anonymous data collection. In that case you can’t use anonymous links. Please use Individual / Personal links in combination with Anonymize response.
By anonymizing the responses of a survey in Qualtrics, you can no longer see who gave which response. Please note: the anonymize response option is irreversible, it cannot be reversed!
Anonymizing is irreversible
Anonymous data can no longer be linked to people: the link with a person no longer exists. Anonymizing is therefore irreversible. Privacy laws do not apply to anonymous data.
Anonymizing is not easy…
Anonymizing is not as easy as it seems. Sometimes data seem to be anonymous, but can be traced to people indirectly. For example, by combining data with each other, or with small samples. Make sure that no personal questions are asked in the survey itself so that the responses can be traced back to respondents,
Be careful with repeated measurements!
Be careful with anonymizing when taking repeated measurements with the same participants, for example in studies that need follow ups. After anonymizing you can no longer link respondent and response. That will remain possible with pseudonymizing, however indirectly.
Collection of personal data in the survey itself
If you want to collect personal data in your survey, it is best to do this in a separate survey. You can easily redirect a survey containing personal data (like name, address) to a survey that does not collect personal data.
3. Separate consent from data
If you process personal data on the legal basis “Express consent of the participant”, you must obtain Informed consent. This is often requested at the start of the survey, for example as the first question. However, Qualtrics will then store these personal data in the same data set as the rest of the survey. And thus, all answers can be traced to a person. Therefore, request the consent separately from the actual survey.
4. Do not use email triggers
In Qualtrics you can have survey responses sent to yourself by email. In this way data end up in another system besides Qualtrics, which poses a privacy risk. Therefore, do not use email triggers.
Do not send responses to respondents
In various surveys, respondents receive their responses by email after completing a survey. This is vulnerable for the same reason as the use of email triggers. Please do not have the responses automatically sent to the respondent.
5. After collecting your data: remove data from Qualtrics
Qualtrics is not intended to be a storage medium. As soon as the survey data are no longer needed, they must be removed from Qualtrics. Before deleting the data or survey you can export the data from Qualtrics for further processing or archiving purposes.