What to do if a participant withdraws consent
If a participant withdraws consent, for example by emailing you after a research session, you must respect their decision and immediately remove their personal data from your research.
You must:
1. Tell research operations
Research operations keep a secure record of any participants who withdraw consent from DfE user research.
They will also advise and help you throughout this process.
2. Delete all data that is easily linked to the participant
You must delete all personal data linked to the participant, except for the correspondence about their withdrawal.
If data is still in its raw format and has not yet been analysed and anonymised, then you must immediately delete it. You must not anonymise the data to keep it.
Delete emails, participant tracker entries, and notes.
Ask anyone else with access to the data to delete it.
Check for any data held outside of your restricted user research folder, for example recordings or notes that have not yet been uploaded and deleted from your work device.
Anonymised data or data that cannot be identified
If data has been anonymised or can no longer be identified, tell the participant that we cannot identify their data and therefore it cannot be deleted.
3. Inform the participant
Once you have deleted the data, email the participant to tell them that their data has been deleted and that a log will be kept for 6 months. Copy the research operations team into this email.