Can you send your questionnaire tomorrow, or do you need permission first? If your master’s research involves people, their data or their organisations, you almost certainly need research ethics approval before collecting anything, and in the EU you must also comply with the General Data Protection Regulation (GDPR). Students often treat these as one form to fill in. They are two related but distinct frameworks, and confusing them causes delays.
This article is part of our guide How to Write a Master’s Thesis by the Mastermind PhD team and relates to our Research Proposal support service. Sources last checked: November 2026.
This guide explains when approval is needed, the steps and documents involved, what to put in the information sheet and consent form, and the GDPR rules that matter for a student project. Procedures differ between universities, so treat it as a map and follow your own faculty’s forms.
What is research ethics approval? It is the formal decision of a university research ethics committee (also called an ethics review board or, in some countries, an IRB) that a study’s design protects participants’ dignity, rights, safety and wellbeing, and meets the institution’s standards of research integrity. It is granted before data collection begins, and covers the procedures described in the application; significant changes require an amendment.
Do you need research ethics approval for a master’s thesis?
In most European universities, yes, whenever the study involves human participants (surveys, interviews, observation, experiments) or personal data about people, even from secondary sources. Many faculties begin research ethics approval with a self-assessment checklist: low-risk projects (anonymous survey of adults on a non-sensitive topic) may be approved by the supervisor or through a fast track, while higher-risk projects go to full committee review.
Projects that usually need full review include research with children or other vulnerable groups, sensitive topics, deception, health data, covert observation and fieldwork outside the EU. Data collected without approval may not be usable in your thesis at all, so check before you design the instrument.
How does research ethics approval work in 7 steps?
- Read your faculty’s ethics procedure and identify the committee, forms and deadlines.
- Complete the self-assessment to determine the risk level and review route.
- Prepare the documents listed in the table below.
- Agree the data management plan with your supervisor and, where required, the data protection officer.
- Submit the application, usually through an online portal, signed off by your supervisor.
- Respond to the committee’s questions and revise the documents.
- Start data collection only after written approval, and keep the approval letter for the methods chapter and the appendix.
Research ethics approval can take several weeks, longer near the end of the academic year. Build that time into your thesis plan.
📱 Discuss your proposal idea with a specialist — You are told the specialist’s field and degree before work starts, and a meeting is scheduled to review your department’s requirements.
Which documents does a research ethics approval application include?
| Document | What it contains |
|---|---|
| Research protocol or summary | Aims, design, participants, recruitment, procedures, risks and how they are reduced |
| Participant information sheet | Plain-language explanation of the study, rights and data handling |
| Consent form | Statements the participant agrees to, signature or recorded consent, date |
| Instruments | Questionnaire, interview guide or observation schedule |
| Data management plan | What data are collected, where they are stored, who has access, retention and deletion |
| Recruitment material | Emails, posters or social media posts |
| Permissions | Letters from organisations or schools where you will collect data |
What should the information sheet and consent form say?
The information sheet should explain, in language your participants understand: the purpose of the study and who is running it; what participation involves and how long it takes; that participation is voluntary and can be withdrawn without giving a reason; possible risks and benefits; how data will be stored, anonymised or pseudonymised, and for how long; who will see the data; how results will be published; and contact details for the researcher, supervisor and data protection officer.
The consent form then lists separate, specific statements to tick or initial, for example agreeing to audio recording, to anonymous quotations and to data reuse. Avoid pre-ticked boxes and bundled statements. Under Article 7(3) GDPR, withdrawing consent must be as easy as giving it, so explain the practical limits (for example, once data are anonymised and analysed, they cannot be withdrawn).
How does GDPR apply to student research?
GDPR applies whenever you process personal data: any information relating to an identified or identifiable person. Names, email addresses, voice recordings, IP addresses and detailed combinations of demographic answers can all identify someone. Key points for a thesis:
- Who is the controller? In many universities, the institution acts as the data controller for student research and sets the rules you must follow. Check your university’s research privacy notice.
- Legal basis. Article 6(1) lists six bases. Research consent and the GDPR legal basis are not always the same thing: many public universities process research data under “public interest” (Article 6(1)(e)), while still obtaining informed consent to participate as an ethical requirement. Use the basis your university specifies, and name it in your research ethics approval form.
- Special categories. Health, ethnic origin, political opinions, religious beliefs, trade union membership, genetic and biometric data, sex life and sexual orientation are special categories under Article 9. They need an additional condition, such as explicit consent or the research exemption in Article 9(2)(j), together with stronger safeguards.
- Safeguards and minimisation. Article 89(1) requires safeguards for research processing, including data minimisation; pseudonymisation is one such measure. Collect only what your research question needs.
- Data protection impact assessment. Article 35 requires one for processing likely to result in high risk, such as large-scale processing of special categories. Your data protection officer will advise.
Anonymous, pseudonymised or identifiable: what is the difference?
| Type | Meaning | GDPR status |
|---|---|---|
| Identifiable | Names or direct identifiers are kept with the answers | Personal data |
| Pseudonymised | Identifiers replaced by codes; a key links codes to people | Still personal data (Article 4(5), Recital 26) |
| Anonymised | No reasonably likely means of re-identifying anyone | Outside the scope of GDPR (Recital 26) |
A survey that collects email addresses for a prize draw is not anonymous. Store contact details separately from the answers, and delete the key as soon as the research allows. In small populations, such as one department of twelve staff, job title plus age band can identify a person, so treat such data as personal.
Which tools and storage are acceptable?
Use the survey, storage and transcription tools your university approves, usually ones with data processing agreements and servers in the EU or the European Economic Area. Free tools that store data outside the EU, or AI transcription services that reuse uploaded audio, may not be permitted. Encrypt laptops and portable drives, and never keep raw recordings on personal cloud accounts unless your institution allows it. Your research ethics approval application should describe these choices.
Which mistakes delay research ethics approval?
- Starting recruitment before the approval letter arrives.
- Information sheets written in academic language or copied from another project.
- Claiming a survey is anonymous while collecting identifiers.
- No retention period, or “data will be kept forever”.
- Missing permission letters from schools or companies.
- Changing the instrument after approval without submitting an amendment.
📱 Ask on WhatsApp now — 5 years of experience across all disciplines and 14 academic services. Two-stage payment (80/20); revisions are free until supervisor approval, within 30% of the chapter.
Frequently asked questions
How long does research ethics approval take?
It depends on the university and the risk level. Low-risk applications can be decided within days or a few weeks; full committee review often takes longer and may require revisions. Check the meeting calendar and submit early.
Do I need approval for an anonymous online survey?
Usually you still need to complete the faculty’s ethics procedure, even if it results in a quick low-risk approval. Some universities exempt certain anonymous studies, but only the committee or the official checklist can confirm that.
Is consent always the GDPR legal basis for my research?
No. Ethical informed consent to participate is almost always required, but the GDPR legal basis may be public interest or another basis set by your university. Follow your institution’s research privacy guidance.
Can I use data I collected at work for my thesis?
Possibly, but it is secondary use of personal data. You need the organisation’s permission, a lawful basis, and usually ethics review. Inform participants where required, and anonymise data where you can.
What happens to my data after graduation?
The data management plan must state how long data are kept, where, and when they are destroyed or archived. Many universities require retention for a defined period to support verification of results; follow your institution’s policy.
Sources
- Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation). https://eur-lex.europa.eu/eli/reg/2016/679/oj
- ALLEA. (2023). The European Code of Conduct for Research Integrity (Revised ed.). https://allea.org/code-of-conduct/
- European Commission, DG Research and Innovation. (2021). Ethics and Data Protection (guidance note, 5 July 2021). https://ec.europa.eu/info/funding-tenders/opportunities/docs/2021-2027/horizon/guidance/ethics-and-data-protection_he_en.pdf
- European Data Protection Board. (2020). Guidelines 05/2020 on consent under Regulation 2016/679. https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en
- GDPR text, Article 89 (Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes). https://gdpr-info.eu/art-89-gdpr/
Sources last checked: November 2026. This article is general educational guidance and does not replace your university regulations or your supervisor’s instructions. How we prepare our content.