College of Science and Health > Academics > Psychology > Research > IRB Information for Psychology Researchers > Confidentiality in Psychology Research

Confidentiality in Psychology Research

As you describe your plan to safeguard confidentiality in your IRB proposal, keep in mind these suggestions:

If identifying information is not necessary, do not collect it.

If it is necessary, collect it in a way that is easy to separate from the data (such as on a separate sheet that can easily be detached from the surveys).  This is particularly important in light of the IRB regulations regarding the storing and archiving of data (see below).

Separate the identifying information from the data as soon as it is no longer needed (as soon as you have placed a subject number on the survey and on the identifying sheet that will allow you to match them up, for example).

Once the identifying information is removed, store the identifying information (such as the list of names and their matching subject numbers) separately from the data.

Destroy the identifying information once it is no longer needed (such as at the conclusion of the study, or after all the data has been collected).

The more sensitive and personal the information collected is, the more the researcher must make careful and detailed plans for safeguarding confidentiality.

Some definitions to keep in mind:

  • Anonymous – no identifying information of any kind is at any time linked to the data.
  • Confidential – not anonymous, but effective steps are taken to prevent the identities of participants from being revealed.

Collecting fully anonymous data in surveys with Qualtrics:
For sensitive information that you want to collect fully anonymously, it is important to make sure that your survey does not record the IP address of the participant’s computer. If you go to "Survey Options" in Qualtrics and select "Anonymize Response," then the IP addresses will not be collected and your data can be fully anonymous.


  • Anonymous data may be archived (stored) indefinitely.
  • Data that contains any sort of identifiers (including Confidential Participant Codes, initials, or any codes that are derived from personal information such as initials, birthdays, etc.) may be kept for a maximum of 3 years with initial IRB approval of a project.  The IRB will not approve a period longer than 3 years in the initial project application.
  • Data may be kept longer than 3 years if the researcher then submits a continuing review application to the IRB asking for permission to keep the data for a specific additional period of time. 
  • Tip: In the section of the IRB Application Template that asks for information about where and how the data will be stored, you should state that the data will be stored in a (specified) secure location for a specified period of time (no more than 3 years), and that following the removal of all identifying information the data will be archived indefinitely.