A data breach puts sensitive or personal information at risk through unauthorized exposure. In analytics and research, the possibility of a breach makes privacy protection part of participant care and responsible data use. section 8.1.2 section 8.2.1
Reduce breach risk by combining consent practices with operational controls:
- Explain how personal information will be captured, stored, and protected, using language appropriate to participants. section 8.1.2
- Anonymize records with participant IDs and mask personal data when names, email addresses, phone numbers, or locations are unnecessary. section 8.1.2 section 8.2.1
- Follow organizational rules for access, sharing, retention, and deletion; avoid downloading personal data locally or sending it by email. section 8.2.1
- Involve IT, security, and legal specialists when interpreting obligations or deciding how sensitive data may be used. section 8.2.1
A consent risk
A product team uses a third-party service to capture audio, video, or images. Participants may worry that the provider could use those materials to train machine-learning models or suffer a breach; the team should respect those concerns and consider privacy-preserving alternatives. section 8.1.2
