Practice / Data and records

Data, records and quality

What counts as data, and how to keep it safe

Consent records, audio, notes, transcription, storage, anonymisation and the audit trail.

Data is the study's product. It is also the point of greatest risk in the link worker role, because you will hold material that identifies people. This page is about what counts as data, and how to keep it lawful and usable.

What counts as data

Four kinds, all of them data

  • Recordings: audio, video, photographs, voice notes.
  • Transcripts: typed or written versions of recordings.
  • Notes: field notes, flip chart photographs, sticky notes, a written summary.
  • Consent records: forms, audio consent, witnessed consent.

Your memory is not a data source. If a decision or a theme matters, write it down the same day.

The audit trail

An audit trail is the story of where each piece of data came from and what happened to it. Without one, a finding cannot be defended.

What to record for every session

  1. Study name and reference.
  2. Date, time, venue and format.
  3. Facilitators, interpreters and note takers.
  4. Number of participants, and the identifiers used.
  5. Consent recorded, with the form reference.
  6. Recording: device, file name, and where it was stored.
  7. Anything unusual: a distressed participant, a failure, an interruption.
  8. Where the material went next, and who holds it.

File names and identifiers

Use the study's convention exactly. A typical rule is: a study code, a participant or group identifier, a date, and a version. Never include a person's name in a file name.

Example

ABC-FG-003-20261112-audio-v1.m4a reads as: study ABC, focus group 3, 12 November 2026, original recording. A link sheet, held separately, maps group 3 to the consent forms.

Storage, in five rules

  1. Store only where the study says: the university's approved system, not a personal drive.
  2. Use the study device if one is provided. If you use your own, the study must approve it in writing and explain encryption.
  3. Do not keep a copy on your phone to work on later. Copy, work, delete, and say you did.
  4. Never send data by ordinary email or messaging. Use the approved transfer route.
  5. Return or delete your copies when the study tells you to, and confirm in writing.

Anonymisation is a decision, not a deletion

Removing a name is the first step and rarely enough. In a small community, a role, a street, a service and a family situation can identify a person.

What to remove or generalise

  • Names of people, and names that would be recognised even if they are not the participant's.
  • Exact ages, where a combination is identifying.
  • Places smaller than a town.
  • Occupations held by very few people.
  • Family relationships described in detail.
  • Dates of events that are publicly known in the community.

Where quotation is powerful and identification is possible, the study may keep the quotation and change the detail, with the participant's permission. That decision belongs to the study lead, not to you alone.

Quality checks on your own work

  1. Completeness. Does the recording cover the whole session? Did the consent form get signed and dated?
  2. Accuracy. Do your notes attribute statements correctly, or have two speakers merged?
  3. Fidelity. Did you write what was said, or what you expected?
  4. Timeliness. Are notes written within 24 hours?
  5. Legibility. Could a colleague who was not there understand your record?

When data goes wrong

Four incidents, and the first hour

  • A device is lost or stolen. Tell the study lead immediately, with the device type, what it held, and whether it was encrypted. The lead decides whether it is a reportable breach, within 72 hours of becoming aware.
  • A file is sent to the wrong person. Tell the lead at once. Do not delete the message until the lead says so. Record what was sent and to whom.
  • A recording is unusable. Say so, write your notes immediately, and record the failure in the audit trail.
  • Somebody is identified in a transcript. Flag it to the lead before analysis starts, so the quotation can be handled.

Photographs and visual data

Photovoice work adds two questions: who is in the image, and who owns the image. Get written permission for identifiable people in a photograph, and for the use of any photograph in an exhibition or publication. The IBISES Photovoice study ran an orientation session on the method and consent before anyone took a picture. That sequence matters. Consent first, then camera.

The test of understanding

You recorded a focus group on your own phone because the study recorder failed. You copied the file to the study system and deleted it from the phone. What must you record, and what should you have done differently?

Record: the failure, the device used, the file name, the transfer route, the time of deletion, and the fact that the study lead was told. What you should have done differently depends on the study's rules: a personal device needs written approval and encryption. The decision to use it belonged to the lead, not to you at the moment of failure.

Check your understanding & apply it · 3 questions, 2 essays

1The study recorder fails and you use your own phone. What is the correct sequence?
2Which file name follows a defensible convention?
3A transcript contains a quotation that would identify a participant in a small community. Who decides how to handle it?
4Essay Write the audit trail entry for a focus group of six people held on 12 November 2026 at a community centre, where one participant became distressed and left for ten minutes. Include what an incident note adds.
5Essay You are asked to keep a copy of the recording on your own laptop so you can work on the transcription at home. Write the reply and the alternative you would offer.