GDPR for Market Research Companies: Managing Survey Data and Participant Consent
Market research companies occupy a uniquely exposed position under GDPR. You process personal data at scale — survey responses, panel profiles, demographic breakdowns, behavioral data, sometimes health or political opinions. You collect data from people who've agreed to participate, but the precise scope of that agreement is rarely as clear as it should be. You share findings with clients. You retain archives for longitudinal research. You use third-party survey platforms. And you often work across borders.
Every one of those activities creates compliance obligations. This guide covers the key GDPR requirements for market research companies — practical, specific, and structured around how research operations actually work.
Why Market Research Companies Are High-Risk Under GDPR
The ICO and other European data protection authorities take market research seriously — not because the industry is unusually bad, but because the data volumes and use cases create inherent risk.
A few specific reasons market research attracts regulatory attention:
- Scale of processing: Even a small research panel involves hundreds or thousands of participants. GDPR risk scales with volume.
- Breadth of data types: Research often captures demographic data, attitudes, purchasing behavior, location, and sometimes health or political views — all of which are either personal data or (in the case of health and political opinions) special category data.
- Repurposing risk: Research data collected for one study is tempting to use in another. GDPR's purpose limitation principle makes this legally complex.
- Third-party sharing: Sharing findings with clients creates data processor and data controller questions that many research companies handle incorrectly.
- Long retention periods: Market research archives can span decades. GDPR requires specific justification for extended retention.
The regulatory expectation isn't that research stops — it's that it happens within a documented, transparent, rights-respecting framework.
Consent vs. Legitimate Interest for Survey Participants
The most fundamental question in market research GDPR compliance is: what's your legal basis for processing participant data?
You have two realistic options:
Consent
Consent must be freely given, specific, informed, and unambiguous. For research panels, this typically means:
- Participants opt in to the panel with a clear explanation of what they're agreeing to
- The consent form names the types of research they may be contacted about
- Consent for sensitive topics (health, politics) is obtained separately
- Withdrawal is as easy as opting in — a simple unsubscribe mechanism
The problem with consent in market research is granularity. If someone joins your panel agreeing to "consumer research," can you survey them about their voting intentions? Almost certainly not without a separate consent. This creates administrative overhead that many research companies underestimate.
Legitimate Interest
Legitimate interest (Article 6(1)(f)) is available for research purposes, but it requires a legitimate interest assessment (LIA) documenting three things:
- The purpose is a genuine legitimate interest (research, analytics, improving products)
- Processing is necessary for that purpose
- The individual's interests don't override the research interest
The ICO's guidance on research and statistics acknowledges that legitimate interest can apply to market research — particularly B2B research where participants are contacted in a professional capacity. For consumer panels, it's a harder argument to make, and consent is usually safer.
Practical guidance: Use consent for consumer panels. Consider legitimate interest for B2B research where you're contacting people at their work email about their professional roles. Document whichever basis you use in your records of processing activities.
Anonymisation and Pseudonymisation of Research Data
GDPR doesn't apply to truly anonymous data. If you can produce anonymised research outputs — aggregate findings where no individual can be identified — those fall outside GDPR's scope. This is a significant practical benefit: anonymised findings can be retained indefinitely, shared freely, and used for any purpose.
The challenge is that genuine anonymisation is harder than it looks.
What Counts as Anonymous
Data is anonymous under GDPR only if re-identification is "reasonably impossible." The ICO and European Data Protection Board have repeatedly found that "de-identified" data still qualifies as personal data when:
- A dataset can be cross-referenced with other available data to re-identify individuals
- Small sample sizes make individuals identifiable by combination (e.g., "female, 60+, lives in rural Wales, works in agriculture")
- The data controller retains a separate key linking pseudonyms to identities
For research companies, the practical implication is this: your published findings and client reports can likely be structured as anonymous data. Your raw survey responses, participant databases, and panel records are almost certainly personal data and subject to GDPR in full.
Pseudonymisation as a Risk-Reduction Tool
Pseudonymisation — replacing identifying information with codes while retaining a separate lookup table — doesn't take data outside GDPR, but it does reduce risk and can be part of your technical security measures. It's particularly useful for research archives: store the pseudonymised survey responses separately from the participant identity database, with strict access controls on the latter.
Panel Data and Ongoing Participant Relationships
If you run a research panel, you have an ongoing relationship with participants that creates specific obligations:
Regular privacy notice updates: If your panel's purpose or data use changes, participants must be notified.
Data minimisation: Don't maintain more panel data than you need. If someone joined your panel five years ago and hasn't responded to a survey in three years, do you need to retain their full profile? GDPR says you should periodically review and delete what you don't need.
Profiling transparency: If you build demographic and behavioral profiles of panel members to match them to relevant surveys, this is profiling under GDPR. Your privacy notice must disclose it, and participants have the right to object.
Consent records: For consent-based panels, you must maintain records of when consent was given, what was consented to, and through what mechanism. This becomes important if a participant later challenges your right to process their data.
Sharing Research Findings with Clients Without Exposing Individuals
This is where many market research companies create compliance problems without realising it.
Client Data Sharing: The Basic Framework
When you share research findings with clients, you need to establish who is responsible for the data:
- If the client commissioned the research and has the primary relationship with participants, they may be the data controller and you the data processor — requiring a Data Processing Agreement (DPA).
- If you're selling syndicated research findings, you're likely the data controller for the underlying data and sharing anonymised outputs with clients.
- If you're sharing raw data with clients (participant-level responses), you're likely acting as joint controllers — which requires a joint controller agreement documenting each party's responsibilities.
Raw Data Transfers
Transferring raw survey responses (even with names removed) to clients is risky territory. The ICO's position is that client data access should be proportionate to the client's legitimate need. "We want to validate your methodology" usually doesn't justify handing over participant-level data.
If clients genuinely need access to individual-level data, build this into your participant consent upfront: "Your responses may be shared with [client type] for the purpose of [specific purpose]." Vague consent won't cover it.
Cross-Border Transfers
If your clients are outside the UK or EU (particularly in the US), sharing data — even pseudonymised research data — may constitute a restricted international transfer. Standard Contractual Clauses (SCCs) or the UK's International Data Transfer Agreement (IDTA) may be required.
Special Category Data in Health and Political Research
If your research touches on health, political opinions, trade union membership, religious beliefs, racial or ethnic origin, or sexual orientation, you're processing special category data under Article 9. This requires:
- An explicit consent (not just consent — explicit consent) or another Article 9 condition
- Additional security measures
- Specific disclosure in your privacy notice
- A Data Protection Impact Assessment (DPIA) if the processing is high-risk
For health research specifically, Article 9(2)(j) allows processing for "scientific research purposes" with appropriate safeguards. The ICO has published guidance on this, but the bar is high: you need to demonstrate the research is genuine, that anonymisation would undermine it, and that additional safeguards (like ethics board approval) are in place.
For political opinion research — polls, voting intention studies, political behavior surveys — explicit consent is usually the only viable basis. Don't rely on legitimate interest for political data.
Participant Rights: Access, Erasure, and Withdrawal
Participants in your research have all the standard GDPR rights:
Right of access: A participant can request all the data you hold about them. For panel members, this might include their profile, every survey they've participated in, and any behavioral data you've collected. You need a process to fulfill these requests within one month.
Right to erasure: Participants can request deletion of their data. For research archives, there's a specific exception: Article 17(3)(d) allows continued processing "for archiving purposes in the public interest, scientific research or historical research purposes" where erasure would "seriously impair or render impossible" the achievement of the research objective. But this exception is narrow — it doesn't cover your panel database or your active research operations.
Right to withdraw consent: If consent is your legal basis, participants must be able to withdraw it at any time, and withdrawal must be as easy as giving consent. Practically, this means a one-click unsubscribe from your panel.
Right to object: If you're relying on legitimate interest, participants have the right to object to processing. You must have a mechanism to receive and honor those objections.
Build your DSAR (Data Subject Access Request) response process before you receive requests — not after. A DSAR arriving during a busy field period is not the time to work out where your data lives.
Data Retention for Research Archives
Research archives have genuine value — longitudinal data is scientifically important, and some clients pay for access to historical trend data. GDPR doesn't prevent you from maintaining archives, but it does require you to justify retention.
Your data retention policy should specify:
- How long raw survey data is retained (common approaches: 12 months for ad-hoc projects, 3-5 years for tracking studies, longer with specific justification)
- When panel member profiles are deleted (commonly: after 12-24 months of inactivity)
- The difference between anonymised archives (no GDPR limit) and personal data archives (require documented justification)
- The process for reviewing and deleting data that has passed its retention period
The default position should be: if you can't articulate why you still need the data, delete it.
Online Survey Tools as Data Processors
SurveyMonkey, Typeform, Qualtrics, Alchemer, and similar platforms are data processors under GDPR. They process personal data on your behalf. This means:
You need a DPA with them. Most major platforms provide this — check their compliance documentation. SurveyMonkey and Qualtrics have DPAs available; Typeform offers a DPA on request. If a platform doesn't offer a DPA, that's a significant red flag.
Check their sub-processors. Survey platforms typically use cloud infrastructure (AWS, Google Cloud, Azure) and various SaaS tools. GDPR requires you to be aware of sub-processors and to be notified of changes.
Data location matters. If your participants are EU-based, check where the survey platform stores data. Most major platforms now offer EU data residency options — use them.
Review their breach notification commitments. Your survey platform should commit to notifying you of data breaches "without undue delay" so you can fulfill your 72-hour notification obligation to supervisory authorities.
Client Contracts and Data Sharing Agreements
Your client contracts need to address the GDPR framework upfront. Specifically:
- Specify the data controller/processor relationship for the project
- Include data use restrictions: clients should not be able to use participant data for purposes beyond the research objectives
- Address international transfers if the client is outside the UK/EU
- Include breach notification obligations if you're sharing personal data
- Specify data deletion obligations at project end
Many research companies inherit client contract templates that predate GDPR and don't address any of this. Updating your standard contract template is a one-time effort that prevents ongoing risk.
ICO Registration Requirements for Research Companies
In the UK, most organisations that process personal data must register with the ICO under the Data Protection (Charges and Information) Regulations 2018. The annual fee is £40-£2,900 depending on your size and turnover.
For market research companies:
- Registration is almost certainly required unless you qualify for an exemption (very few research companies do)
- Your registration must accurately describe your processing activities
- Failure to register is a criminal offence with fines up to £4,350
Check your registration is current at ico.org.uk and that it accurately reflects what you do. A significant mismatch between your registration and your actual activities is itself a compliance risk.
GDPR vs. CCPA for US-Based Research Panels
If you run panels that include both EU/UK participants and US (particularly California) participants, you're navigating two overlapping frameworks.
Key differences:
| Issue | GDPR | CCPA/CPRA |
|---|---|---|
| Consent for non-sensitive data | Required (opt-in) | Opt-out sufficient |
| Special category / sensitive data | Explicit opt-in | Opt-out sufficient (with notice) |
| Right to erasure | Strong, with exceptions | Available, with exceptions |
| Data portability | Yes | Yes |
| Research exemption | Narrow, requires safeguards | Available for certain research |
| Penalties | Up to €20M or 4% global turnover | Up to $7,500 per intentional violation |
In practice, building to GDPR standard usually means you satisfy CCPA requirements for the same activities — GDPR is stricter in most respects. The main exception is that GDPR requires opt-in consent while CCPA only requires opt-out for non-sensitive data, so your US participants may not need the same consent flow as EU participants.
10 Common GDPR Mistakes Market Researchers Make
1. Using a single consent tick-box for everything. Research on consumer preferences, health data, and political opinions requires separate, specific consent for each type.
2. Treating anonymisation as easier than it is. Removing names from a dataset doesn't make it anonymous if participants can be identified from combinations of other variables.
3. No Data Processing Agreement with the survey platform. If you're using SurveyMonkey or Typeform and haven't signed a DPA, you're out of compliance.
4. Sharing raw participant data with clients without consent. Research participants didn't consent to their individual responses being reviewed by your client. Aggregate findings ≠ participant-level data.
5. Indefinite panel data retention. Inactive panel members aren't a free resource — they're a liability. Review and purge inactive panel members at least annually.
6. No DPIA for high-risk research. Health surveys, political polling, and profiling of large panels all likely require a Data Protection Impact Assessment.
7. Consent that doesn't cover all the surveys you're sending. If your consent language doesn't cover the specific types of research you're conducting, you don't have valid consent.
8. No process for participant rights requests. Research companies regularly receive data subject access requests and erasure requests — particularly from panel members who've had a change of mind. If you have no process, you'll miss the one-month deadline.
9. Non-compliant international data transfers. US-based survey platforms, US clients, or US panel members can all create international transfer obligations that need SCCs or equivalent safeguards.
10. Treating compliance as a one-time setup. Privacy laws evolve. Your research portfolio changes. New survey tools get added. Compliance requires periodic review, not just initial setup.
Get a Compliance Baseline for Your Research Operation
Market research companies don't need to choose between good research and good compliance — but they do need to take both seriously.
Start with a privacy audit: what data are you collecting, on what basis, from whom, and where does it go? If you can answer those questions clearly and document your answers, you're ahead of most research companies in the sector.
Custodia scans your website and research infrastructure to identify what personal data you're collecting, what third-party tools are processing it, and where your compliance gaps are. Run a free scan at app.custodia-privacy.com/scan — results in 60 seconds, no account required.
Last updated: March 2026
Top comments (0)