Protecting Participant Privacy in Survey Research: A Practical Guide
How modern privacy regulations are reshaping survey methodology — and why that's a good thing for everyone.
The question behind every question
Every survey begins with an implicit contract. A person agrees to share something about themselves — an opinion, an experience, a piece of their life — in exchange for the belief that this information will be handled with care. When that contract is honoured, research flourishes. When it isn't, people stop answering.
This is not a hypothetical concern. Response rates for surveys have been declining for decades. The Pew Research Center documented a drop from 36% in 1997 to 6% in 2018 for telephone surveys. Online surveys face similar headwinds. The reasons are complex, but one thread runs through all of them: people are increasingly skeptical about what happens to their data after they click "Submit."
For researchers working with sensitive populations — patients in rehabilitation programs, survivors of domestic violence, whistleblowers reporting institutional misconduct, people living with stigmatized health conditions — this skepticism is not abstract. It is existential. A participant who fears that their identity could be linked to their responses may decline to participate at all. Or worse, they may participate but withhold the truth, introducing a bias that undermines the very research they were asked to support.
The good news is that privacy regulation, often perceived as a burden, is actually solving this problem. By establishing clear rules about what can be collected, how it must be protected, and when it must be destroyed, modern privacy frameworks give researchers a credible basis for the promises they make to participants. "Your data is protected" is no longer a vague assurance — it is a legal obligation with real consequences.
The global privacy landscape
Privacy regulation has evolved rapidly since the European Union's General Data Protection Regulation (GDPR) came into effect in 2018. What was once a patchwork of voluntary guidelines has become a global framework of enforceable law.
In Europe, the GDPR established the template that most subsequent legislation follows. Its core ideas — collect only what you need, use it only for the purpose you stated, get clear consent before handling sensitive data, and let people request deletion of their information — have become the common language of privacy law worldwide. The penalties are substantial: up to 4% of an organization's global revenue.
In the United States, there is no single comprehensive privacy law. Instead, different sectors have their own rules. HIPAA covers health information. FERPA protects educational records. A growing number of states — California, Virginia, Colorado, and others — have enacted their own consumer privacy laws. For survey research involving health data, HIPAA's detailed requirements for de-identifying information are particularly relevant.
In Brazil, the LGPD (Lei Geral de Proteção de Dados) closely follows the GDPR model, including strong protections for sensitive personal data and requirements for explicit consent.
In Canada, the picture is uniquely layered — and, for survey researchers, uniquely instructive.
The Canadian framework: federal, provincial, and why it matters
Canada's privacy regime operates on two levels, and understanding both is essential for anyone conducting survey research in the country.
The federal layer: PIPEDA
The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to all commercial activity across Canada. It is built on ten Fair Information Principles — including consent, limiting collection, accuracy, safeguards, and accountability — that establish a solid baseline.
The core idea is common-sense: collect personal information only for purposes that a reasonable person would consider appropriate, and only to the extent necessary for those purposes. If you are running a customer satisfaction survey, you can ask for an email address to verify identity — but you cannot secretly use it for marketing unless you said so up front.
For most surveys collecting everyday data — product feedback, community engagement, service quality — PIPEDA compliance is straightforward. Collect what you need, explain why, protect it properly, and dispose of it when you are done.
The provincial layer: where it gets interesting
Several Canadian provinces have enacted their own privacy legislation:
- Quebec: Law 25 (formerly Bill 64), in force since September 2023, with final provisions taking effect in 2024
- Alberta: the Personal Information Protection Act (PIPA)
- British Columbia: the Personal Information Protection Act (also called PIPA)
Ontario has been developing its own legislation, and other provinces reference federal PIPEDA as their standard.
These provincial laws all share a common foundation in the fair information principles that underpin PIPEDA. They all require consent, purpose limitation, data minimization, and reasonable safeguards. Where they differ is in how specific and how strict they are.
Quebec's Law 25: the high-water mark
Law 25 is, by a considerable margin, the most demanding privacy law in North America. It was explicitly modelled on the European GDPR, and in several respects, it goes further. Understanding its key provisions helps illustrate what modern privacy law expects — and why it matters for survey research.
Privacy by default. Organizations must ensure the highest level of confidentiality as their starting point — not as an option that users can turn on, but as the way things work unless there is a good reason to do otherwise. For survey platforms, this means that if a less intrusive way to authenticate participants exists, the platform should make it easy to use.
The presumption against collecting more than you need. When there is any doubt about whether a piece of personal information is necessary for the stated purpose, the law presumes it is not. This is a subtle but important shift: the burden falls on the organization to demonstrate that the information is needed, rather than on the individual to prove it is not. In practical terms, this means "we have always collected email addresses" is not, by itself, a justification for continuing to do so.
Formal privacy impact assessments. Before processing sensitive personal information, organizations must conduct a structured assessment. Quebec's privacy commission (the CAI) has published guidance requiring a three-part proportionality test: Is there a rational link between the data collection and the objective? Is there no less intrusive alternative that would work? Do the benefits to the organization outweigh the potential consequences for the individual? If the answer to the second question is "yes, there is a less intrusive alternative," the organization is expected to use it.
Explicit consent for sensitive data. When a survey collects information that is sensitive by nature — health data, biometric information, information about a person's intimate life — consent must be express. A pre-checked checkbox does not count. An implied "by continuing, you agree" does not count. The person must actively, clearly, knowingly agree.
Meaningful penalties. Violations can result in fines of up to $25 million CAD or 4% of global turnover. The law also includes a private right of action, meaning individuals can seek damages directly. These are not theoretical deterrents — they change how organizations make decisions about data.
Why meeting Law 25 means meeting everything else
Here is the practical insight for organizations operating across Canada: if you meet Law 25's requirements, you meet or exceed every other Canadian privacy standard. Its data minimization requirements are stricter than PIPEDA's. Its consent requirements are stricter than Alberta's and British Columbia's PIPAs. Its penalties are more severe than any other Canadian jurisdiction.
Rather than maintaining separate compliance approaches for each province, an organization can build to Law 25's standard and know that it is covered everywhere in Canada. And because Law 25 is closely aligned with the GDPR, this also provides a strong foundation for international research involving European participants.
What this means for survey design
Privacy law does not exist in a vacuum. It reflects a set of principles about how research should be conducted — principles that good researchers have always followed, now codified into enforceable standards.
The central principle, for survey methodology, is proportionality: the information you collect should be proportionate to the purpose of the research. This is both a legal requirement and good science.
When identification is appropriate
Many surveys legitimately need to know who is responding.
Longitudinal research. A municipality is conducting a three-year study on resident satisfaction with public services. The same participants will be surveyed annually to track changes over time. Knowing who responded in Year 1 is necessary to ensure the same cohort is surveyed in Year 2. Email-based authentication is not only appropriate — it is methodologically essential.
Accountability and follow-up. A hospital is surveying patients about their experience with a new outpatient program. If a patient reports a serious concern, the hospital needs the ability to follow up. Identified responses serve both the research purpose and the duty of care.
Access control for defined populations. A professional association wants to survey its members about proposed policy changes. Only current members should be able to respond, and each member should respond only once. Email verification against a membership list is the natural approach.
In these cases, collecting an email address is necessary, proportionate, and — with proper consent and data protection — fully compliant with even the strictest privacy regulations. There is nothing wrong with knowing who your participants are, when knowing is part of the purpose.
When anonymity is essential
Other surveys involve contexts where identification would be harmful, counterproductive, or both.
Sensitive health disclosures. A public health agency is studying substance use patterns in a community. Participants are being asked to disclose illegal drug use, addiction history, and mental health status. If a participant's identity were linked to their responses, the consequences could include job loss, criminal investigation, or social stigma. Collecting an email in this context is not only unnecessary — it is a deterrent to honest participation and a liability if the data were ever breached.
Vulnerable and marginalized populations. A nonprofit is surveying residents of a domestic violence shelter about the effectiveness of support services. These individuals are, by definition, in situations where their physical safety depends on controlling who knows where they are. Asking for an email address — even with assurances of confidentiality — introduces a risk that no encryption or access control can fully eliminate.
Whistleblowing and institutional accountability. Employees are being asked to report on workplace safety violations, discriminatory practices, or financial misconduct. The value of these surveys depends entirely on the participants' confidence that they cannot be identified. Even the perception of identifiability — "they say it's anonymous, but they asked for my email" — can suppress truthful reporting.
Stigmatized conditions. Surveys about HIV status, sexual orientation, immigration status, or criminal history all involve information that, if linked to a person's identity, could cause genuine harm. It is worth noting that the U.S. Federal Trade Commission ruled in 2024 that hashed email addresses are not anonymous — common email addresses can be reversed from their hashes using widely available lookup tables. True anonymity requires that the identifier never be collected in the first place.
In these cases, the proportionality calculus is clear: the research purpose does not require knowing who responded, and collecting identity information creates risk without corresponding benefit.
A practical approach: privacy-preserving authentication
The challenge, then, is to reconcile two legitimate needs: the researcher's need for data integrity (one response per participant, no duplicates, no outside interference) and the participant's need for genuine anonymity.
Traditional approaches have treated these as a binary choice. Either you collect an email and get deduplication, or you post an open link and accept that anyone can respond as many times as they like. This is a false dilemma.
Pre-generated access tokens
The approach we use at Septenar is built on pre-generated, single-use access tokens — unique codes created by the researcher before the survey begins and distributed to participants through physical channels: printed cards, sealed envelopes, QR codes handed out at a clinic or community centre.
Each token can be used exactly once. When a participant enters their code, the system verifies that it is valid and unused, then grants access to the survey. No email is requested. No IP address is recorded. No browser fingerprint is captured. The token is consumed, and the response is stored with a cryptographic identifier that prevents reuse but cannot be traced back to the individual.
This preserves data integrity — each token corresponds to exactly one authorized participant, and each can be used only once — while providing genuine anonymity. Even if the database were compromised, there would be no way to determine which participant submitted which response. This is not a policy promise. It is an architectural fact.
Metadata without identity
Researchers often need to segment their data without identifying individuals. A multi-site clinical study needs to compare response patterns across facilities. A randomized controlled trial needs to distinguish treatment and control groups.
Access tokens can carry metadata variables — researcher-defined attributes like site, cohort, or group assignment — that are attached to the token at generation time and flow into the response data automatically. The participant never sees this metadata; it simply appears in the dataset alongside their anonymized responses.
This means a researcher can analyse responses by site, by cohort, by treatment arm, or by any other dimension they define — without ever knowing who responded. The segmentation is built into the distribution method, not the participant's identity.
Matching the approach to the context
Privacy protection is not one-size-fits-all, and neither is survey methodology. The appropriate level of anonymity depends on what is being asked, who is being asked, and what the consequences of identification would be.
| Context | Sensitivity | Suggested Approach | Why |
|---|---|---|---|
| Customer satisfaction | Low | Email verification | Follow-up may be needed; data is not sensitive |
| Employee engagement | Moderate | Email with pseudonymization | Aggregate analysis; individual follow-up only if opted in |
| Community needs assessment | Low–Moderate | Email or group membership | Access control matters; data is generally not stigmatizing |
| Clinical research (non-sensitive) | Moderate | Group membership with consent | Identified responses support longitudinal tracking |
| Substance use study | High | Anonymous tokens | Disclosure could lead to legal consequences |
| Domestic violence services | High | Anonymous tokens | Physical safety depends on non-identification |
| Whistleblower reporting | High | Anonymous tokens | Retaliation risk makes anonymity essential |
| Mental health assessment | High | Anonymous tokens | Stigma and discrimination risk |
The principle is straightforward: use the least intrusive method that achieves the research objective. When identification serves the research, use it — with proper consent, clear purpose limitation, and strong safeguards. When identification would harm participants or suppress honest responses, eliminate it at the architectural level so that no breach, subpoena, or human error can compromise the promise you made.
Building trust through transparency
Privacy regulation is sometimes framed as an obstacle — something that makes research harder, slower, more expensive. We think the opposite is true.
The organizations conducting survey research today are, overwhelmingly, trying to do good work: understanding community needs, improving healthcare delivery, evaluating social programs, giving people a voice. The participants they are asking to contribute are, overwhelmingly, willing to share — if they believe their contribution will be treated with respect.
Privacy law gives that belief a foundation. When a researcher can tell a participant "we do not collect your name, email, or any identifying information — and our system is designed so that even we cannot link your response to your identity," that is not a legal disclaimer. It is an invitation to honesty. And honest data is the only kind worth collecting.
The regulations will continue to evolve. Quebec's Law 25 will influence other provinces. Canada's framework will influence international standards. The direction is clear: toward more transparency, more proportionality, more respect for the people whose participation makes research possible.
Our goal is to make it practical to meet these standards — not as an afterthought, but as a natural part of designing a survey. The right privacy posture for a customer satisfaction poll is different from the right privacy posture for a clinical study involving vulnerable patients, and both should be straightforward to set up and easy to explain to participants.
The research will be better for it. And so will the trust that makes it possible.
Septenar is a Canadian survey platform built for privacy-conscious research. We support PIPEDA baseline compliance for all accounts, with Law 25 compliance for organizations working with sensitive data in Quebec and across Canada. HIPAA compliance for U.S. healthcare contexts is planned. For more about our approach to participant privacy, see our documentation or reach out to our team.