Limited IRB review is a focused type of ethics oversight introduced by the 2018 Revised Common Rule. Unlike a full board review, it applies only to certain exempt research and checks a narrow set of requirements, primarily whether a study has adequate protections for participant privacy and data confidentiality. It does not evaluate the full range of criteria that a standard IRB review covers, such as risk-benefit analysis or informed consent adequacy.
The Revised Common Rule was published in January 2017, amended in January 2018, and took effect in July 2018. Twenty federal agencies follow it. Limited IRB review was one of the key additions, creating a middle ground between fully exempt research that needs no IRB involvement and non-exempt research that requires expedited or full board review.
When Limited IRB Review Is Required
Limited IRB review is triggered by specific exemption categories under the federal regulations. Not all exempt research requires it. It only applies when a study qualifies for exemption but still carries some privacy risk that warrants a check. The most common scenarios fall under three exemption categories.
Exemption Category 2(iii): Research involving educational tests, surveys, interviews, or observation of public behavior where participants can be identified. If a study uses these methods and the researcher could link responses back to individuals, a limited IRB review is required. Categories 2(i) and 2(ii) don’t trigger this requirement because in those cases, either participants can’t be identified or disclosure of their responses wouldn’t put them at risk. Note that surveys and interviews involving children cannot use this exemption at all.
Exemption Category 3(i)(C): Research involving benign behavioral interventions (things like asking participants to solve puzzles, watch videos, or play simple games) combined with data collection from adults. Again, limited review kicks in only when participants are identifiable. Like Category 2, this exemption cannot be used for research with children.
Exemption Category 7: Research involving the storage, maintenance, and secondary use of identifiable private information or identifiable biospecimens, where broad consent has been obtained. This category triggers a different set of checks during the limited review, focused on whether broad consent was properly obtained and documented.
What the IRB Actually Reviews
The scope of a limited review depends on which exemption category applies. This is the key distinction from standard IRB review: the reviewer is not evaluating the full list of approval criteria. They are checking only the specific requirements tied to that exemption.
For Categories 2(iii) and 3(i)(C), the IRB must determine one thing: that when appropriate, the study has adequate provisions to protect participants’ privacy and maintain the confidentiality of data. In practical terms, the reviewer looks at how data will be collected, stored, and shared. Are survey responses kept on a secure server? Is there a plan for de-identifying data after collection? Could a data breach realistically expose participants to harm? The reviewer is not weighing the overall risks and benefits of the research or scrutinizing the study design.
For Category 7, the review is broader but still limited. The IRB must confirm three things: that broad consent for storage and secondary research use was obtained following the required consent elements, that this consent was properly documented (or that a waiver of documentation is appropriate), and that if the way identifiable information or biospecimens are stored has changed for research purposes, there are adequate privacy and confidentiality protections in place.
How the Review Process Works
A limited IRB review does not require a meeting of the full board. It can be conducted by a single designated reviewer using expedited procedures. The IRB Chair either handles it personally or assigns another experienced IRB member to serve as the reviewer.
The designated reviewer has the authority to approve the research or to require modifications before granting approval. However, they cannot disapprove it. If a reviewer believes the research should not proceed, it must go to the full convened IRB board for a disapproval decision. This is the same authority structure used for expedited review of non-exempt research.
After a limited review is completed, the rest of the IRB is kept informed. Approved studies are reported to all IRB members and listed on the agenda for the next convened meeting. This transparency ensures the full board has visibility into what’s been approved even though they didn’t vote on it.
How It Differs From Expedited and Full Board Review
The three levels of IRB review differ in scope, not just speed. Full board review requires a quorum of IRB members to meet and evaluate all approval criteria: risks to participants, potential benefits, informed consent procedures, data monitoring plans, privacy protections, and equitable subject selection. Expedited review uses a single designated reviewer but still evaluates the same full set of criteria. It’s available for research that poses no more than minimal risk and fits into federally defined categories.
Limited IRB review also uses a single designated reviewer, but the reviewer evaluates only the narrow criteria specified for that exemption category. The research has already been determined to be exempt, so the broader questions about risk, benefit, and consent (except broad consent for Category 7) are not on the table. Think of it as a targeted check rather than a comprehensive evaluation.
This narrower scope typically means a faster turnaround for researchers. The reviewer has fewer determinations to make, and the documentation requirements are correspondingly lighter.
Continuing Review Requirements
One practical benefit of limited IRB review: continuing review is generally not required. Under the 2018 Common Rule, research approved through limited IRB review does not need annual re-review unless the IRB or designated reviewer specifically determines otherwise and documents the reason. This is a significant change from older regulations, where many exempt studies still faced periodic check-ins at some institutions. For researchers, it means less administrative burden once the initial review is complete.
What Researchers Should Prepare
If your study falls into one of the exemption categories requiring limited review, your submission should focus on the specific criteria the reviewer will evaluate. For Categories 2 and 3 studies, that means clearly describing your data security plan. Spell out how you’ll collect information (paper forms, online platforms, recorded interviews), where it will be stored, who will have access, and whether you’ll strip identifying details from responses. If participants are identifiable throughout the study, explain why that’s necessary and what safeguards are in place.
For Category 7 studies involving broad consent, you’ll need to show that the consent process covers the required elements: what types of research might be conducted, how long specimens or data may be stored, whether commercial profit could result, and whether participants will receive results. The consent document itself will be a central piece of the review.
Because a single reviewer handles the process, responses to any questions or requested modifications tend to move quickly. If modifications are requested, address them specifically and resubmit. The back-and-forth is usually simpler than with a full board review, where changes might need to wait for the next scheduled meeting.