A full guide to data privacy regulations in user research: GDPR & more

More teams are running more research. In fact, 66% of product professionals say demand for research is rising faster than their capacity and systems can keep up with.

As research increases, so does the amount of participant data teams need to manage. This can include personal information, recordings, transcripts, survey responses, and consent records. Without clear processes, it becomes harder to protect that data consistently across markets, tools, and teams.

In this article, we break down what user research data privacy means in practice, from consent and GDPR compliance to secure storage, anonymization, and compliance in AI use. You’ll learn how to protect participant data without slowing down the research your team needs to make better decisions.

Privacy laws shape how research teams get informed consent, collect participant data, store recordings, use AI tools, and respond to requests to access or delete user data. Most rules apply to personally identifiable information (PII), any data that can identify a participant, such as their name, email address, screen recording, voice recording, transcript, location, or IP address.

The exact requirements depend on several factors, like:

For example, GDPR can apply to organizations outside the EU when they process personal data from people in the EU, while California privacy laws apply to qualifying businesses that collect personal information from California consumers.

These are the main laws research teams should take into account:

Let’s look more closely at GDPR, one of the most wide-reaching frameworks governing how research teams collect, store, and use participant data.

GDPR sets the bar for how teams collect, use, and manage personal data from European participants. Even if your company is not based in the EU, it can still apply if you research participants located there. In practice, it shapes how user research is planned, run, and stored.

Here’s how to approach GDPR compliance in user research:

Next, let’s look at the best practices that help teams protect participant data, maintain ethical standards, and run research across different tools, regions, and study types.

Here are seven best practices that help you protect participant data and keep your research process consistent, secure, and compliant.

Informed consent protects participants' privacy by explaining how their personal information will be collected, used, stored, and shared before the study begins.

It needs to explain:

Under GDPR, consent must be freely given, specific, informed, and unambiguous, so avoid vague consent language or bundled approvals.

For example, don’t write: “We may use your data for research purposes.” Instead, write: “We’ll record your screen, audio, and responses during this 30-minute usability test. We’ll use the recording to analyze where users struggle in the checkout flow, and only the research and product teams will have access.”

Maze gives research teams dedicated ways to collect consent inside a study. You can add a specific consent step (for example, a Yes/No consent question or a dedicated consent screen) at the very start of a study and make it required so participants cannot continue without agreeing.

You can upload a consent form or privacy policy as a PDF, add your own wording about data use, and use branching to route people who do not consent out of the research experience.

Anonymization (and pseudonymization) reduces the chance that research participants can be identified if data is exposed, shared, or reused. It usually means stripping or masking names, email addresses, usernames, locations, company names, and other identifiers in your notes, interview transcripts, and clips.

For example, instead of sharing a raw interview clip that shows a participant’s face and mentions their company, you can share a trimmed clip with the name removed, the face blurred, and the company reference redacted. In transcripts, replace identifiers with labels like ‘Participant 3’ and remove details that could point back to a specific person.

Maze supports this best practice in two ways.

First, Maze generates automatic transcripts for Clips and recorded sessions so research teams can quickly scan and edit the text instead of widely sharing full raw video. This makes it easier to remove or mask identifiers before distributing insights.

Second, Maze’s research‑grade AI ensures that your text and speech data is sent only to a small set of vetted providers—OpenAI and Anthropic (via Amazon Bedrock) for language models, and Rev AI for speech‑to‑text.

These providers process your data only to return the AI output you requested and do not use your Clips, transcripts, or results to train their own models. The data is also encrypted in transit and at rest as part of Maze’s overall data security position.

This best practice comes from the data minimization principle in privacy laws like the GDPR and the CCPA. In simple terms, these laws say you should only collect personal data that is “adequate, relevant, and limited to what is necessary” for your stated purpose.

For example, if you’re running unmoderated UX testing on navigation, you might need task success, click paths, and a few behavioral questions. But you may not need full names, exact locations, or detailed demographics. Over-collecting personal data increases your privacy risk and your exposure in the event of a data breach, without necessarily improving your insights.

Maze supports data minimization by limiting unnecessary data collection. Maze doesn’t add extra tracking cookies or collect additional analytics on test‑taker URLs by default, so the only personal data in a maze is the data your team chooses to collect in questions and tasks.

In our GDPR guidance, we explicitly advise teams not to ask for personally identifiable information—such as names, emails, or company names—unless it is essential for the research study. And note that if your mazes do not contain identifiers, the resulting test data will generally sit outside the scope of the GDPR.

When you store recordings, transcripts, and notes from UX research, you are holding sensitive user data. Enterprise‑grade data security means you protect that research data with audited controls (like SOC 2 and ISO/IEC 27001), strong encryption, and strict access management.

The core pieces of enterprise-grade data security for user research include:

Maze applies these same principles to how it handles your research data. Maze is SOC 2 Type II and ISO/IEC 27001:2022 certified, meaning independent auditors have tested and approved its security controls and information security management system against recognized standards.

All customer data is encrypted in transit with TLS and at rest with strong ciphers, and access to production systems is restricted and monitored through role-based controls. For research teams, this means that session recordings, Clips, transcripts, and results live in an environment engineered and audited to meet enterprise data security and privacy expectations. Put simply, your data is in good hands when working in Maze.

When participants join the research studies, they may see browser prompts asking for camera, microphone, or screen-sharing access. Without clear context, these prompts can raise privacy concerns about what data is captured, who can access it, and how it will be used.

Set expectations early. Before any prompt appears, clearly explain what access you’ll request and why. For example: “This study will ask for camera and microphone access so we can record your feedback as you complete tasks. Only the research team will review these recordings.” This gives participants important context and reduces friction.

Time the prompt carefully. Trigger camera or mic access only when it’s required, not at the start of the study. For example, ask for access right before a think-aloud task or interview, not during onboarding.

Maze shares additional layers on top of this to keep the experience privacy‑aware. Before a live website test starts, Maze shows a warning that explains any personal data displayed on the site (for example, names, emails, or account details) and any data the participant enters will be visible to the study creator.

If a study relies on video or audio (such as Clips recordings, moderated interviews, or AI‑moderated sessions), Maze triggers the standard browser camera/mic prompt and, when access fails, shows a “We couldn’t access your camera and microphone” message with step‑by‑step instructions for enabling permissions in the browser.

Participants can choose whether to grant camera and microphone access, can close the maze at any time, and can ask the creator to delete their session data. This helps teams collect rich qualitative insights without forcing people into permissions they are not comfortable with.

When you run UX research across countries, you’re working under a patchwork of international data privacy rules that can all apply at once. Alongside setting conditions on how you collect participant data and where you store it, they also dictate how you should transfer it across borders when personal data leaves the country or region where the participant lives.

We’ve already covered the major frameworks like GDPR, CCPA/CPRA, PIPEDA, and LGPD. Here are other important regulations for user privacy protection that can apply depending on your research participants:

Privacy laws like GDPR, CCPA/CPRA, and others give you a legal baseline. They tell you what you must do to avoid fines, but they don’t fully answer questions like “Is this fair to participants?”, “Are we putting people under pressure?”, or “Could this insight be used in ways that harm certain groups?”.

Raising your ethical standards means adding your own guardrails around power, transparency, and respect for the people in your studies.

In practice, ethical standards in user research often include:

As soon as you add automation into this mix, hidden bias in your data or models can shape patterns, themes, and top insights. This means your findings can drift away from what your participants said, at scale, without any obvious warning.

According to our 2026 Future of User Research report, nearly 2 in 3 researchers now use AI in their workflows, and 69% use it in at least some projects. That’s exciting for speed and scale, but it also raises ethical questions about how much you can—and should—trust AI in user research.

AI can help teams draft questions, summarize responses, identify themes, and support analysis. But user research depends on context. A participant’s hesitation, tone, word choice, or contradiction can change the meaning of a response. If AI misses that nuance, researchers risk turning complex human feedback into oversimplified findings.

That’s why trust remains a challenge. Of those surveyed, 82% say interpreting nuance and emotion still requires a human, while another 80% say ethical decision-making can’t be handed off to AI. At the same time, 73% call human review a key challenge when using AI, and 66% worry about trust and credibility.

These concerns matter for data privacy, too. Without clear rules, teams can lose track of where participant data is used, what AI-generated outputs are based on, and whether findings reflect the original evidence.

The answer is to use AI with clear guardrails. Research teams should tell participants when AI is involved, label AI-assisted outputs in reports, and review AI-generated themes against the original clips and transcripts. They should also define where AI can and can’t be used, especially when studies involve sensitive participant data.

Many teams are already moving in this direction. In response to AI trust and privacy concerns, 80% of researchers say they’ve built human review of AI outputs into their workflows, often alongside privacy controls and clear rules for AI use.

Maze’s AI ethics guidance for UX research highlights specific risks. These include biased prompts, opaque or overconfident summaries, and teams that rely too heavily on AI without human review. You should tell participants when AI is involved, label AI‑assisted outputs in your reports, and always check AI‑generated themes against the original clips and transcripts.

Maze supports ethical research with research‑grade AI and its AI moderator, but it keeps researchers in charge of what’s asked and how findings are used.

Every AI‑generated insight in Maze can be traced back to the exact questions and participant responses it came from, so you can see the raw moments behind themes. Researchers can preview and edit the AI moderator’s behavior before a study goes live, adjust the level of automation, and apply human review to outputs.

Teams need systems that make privacy and compliance part of the research process. Maze builds privacy, security, and compliance into how studies are set up, run, and shared:

With Maze, teams can scale user research while keeping participant privacy, security, and compliance built into every study to keep you and your participants safe.