Data collection methods that involve recording personal, sensitive, or identifiable information pose the most risk to research participants. The specific type of risk depends on the method: surveys can cause psychological distress, interviews and focus groups can breach confidentiality, biomedical sampling can cause physical harm, and any method that stores personal data can expose participants to legal, financial, or social consequences if that data is mishandled.
If you’re encountering this question in a course or exam, the answer almost always points to methods that collect identifiable, sensitive information, particularly about illegal behavior, health status, sexual history, or trauma. Here’s how risk breaks down across common data collection methods.
Three Categories of Research Risk
Institutional review boards typically evaluate research risk in three broad categories: physical, psychological, and informational. Physical risks include pain or discomfort from medical procedures like blood draws or biopsies. Psychological risks include anxiety, depression, guilt, shame, or loss of self-esteem triggered by the research experience. Informational risks cover everything related to privacy: the possibility that a participant’s data could be leaked, re-identified, or used against them in social, legal, or financial contexts.
A method is considered “minimal risk” when the chance and severity of harm are no greater than what someone encounters in daily life or during a routine physical exam. Anything beyond that threshold requires additional ethical safeguards.
Surveys on Sensitive Topics
Surveys seem harmless on the surface, but asking people about traumatic experiences can cause real psychological distress. Research on survey-related emotional harm has examined topics including terrorism, sexual and physical violence, intimate partner abuse, traumatic injuries, and bereavement. Participants who completed surveys on trauma and sexuality reported slightly greater negative emotion compared to those answering neutral cognitive questions.
The risks include depression, increased anxiety, shame, embarrassment, fear, and receiving unwanted information about oneself. Even body image questions can trigger distress in some populations. The risk increases when questions touch on experiences the participant hasn’t fully processed, or when the survey unexpectedly resurfaces painful memories.
Focus Groups and Social Risk
Focus groups introduce a risk that most other methods don’t: participants hear each other’s responses. If the topic involves health conditions, substance use, political views, or personal struggles, simply being present in the group can reveal information a participant would rather keep private. Unlike a one-on-one interview, the researcher cannot guarantee confidentiality because other group members may share what they heard.
This social risk is especially significant for participants in small communities where they might be recognized, or when the research topic carries stigma. A person discussing mental health treatment or immigration status in a focus group has no control over whether another participant repeats that information outside the room.
Collecting Data on Illegal or Stigmatized Behavior
Any method that records information about illegal activity, such as drug use, undocumented immigration status, or unreported income, creates legal risk for participants. If records are subpoenaed or breached, participants could face criminal penalties. Similarly, collecting data on HIV status, genetic conditions, or mental health diagnoses creates financial and employment risk. Employers and insurers who gain access to health information obtained for one purpose may use it for another, like denying coverage or making adverse hiring decisions.
In the United States, federal law (GINA) prohibits employers from using genetic information in employment decisions, but the concern that drove that legislation is telling: without explicit legal protections, collected data can easily be repurposed in ways that harm participants. Genetic and medical privacy laws in many jurisdictions still allow law enforcement to access medical records without the patient’s authorization.
Digital Data and Re-identification
Researchers often strip names and obvious identifiers from datasets before sharing or analyzing them. But “de-identified” doesn’t always mean “anonymous.” Combining a few data points, like zip code, birth date, and gender, can sometimes re-identify individuals in large datasets.
The actual risk, however, is lower than many people assume. A review of re-identification attacks on health data found only six publicized attempts, and most targeted datasets that weren’t properly de-identified in the first place. The one attack on a dataset that met existing de-identification standards found an extremely low re-identification rate of 0.013%. During 2019 to 2021, over 90 million U.S. health records were leaked or hacked from healthcare servers, but researchers found no documented cases of individual patient re-identification or harm from those breaches.
That said, digital data collection methods like web scraping and social media monitoring carry unique privacy risks. Researchers have demonstrated that just two hours of manually reviewing public social media posts can reveal private information the poster never intended to share, including home addresses, phone numbers, property records, and dates of birth. That kind of incidentally collected data could be exploited for identity theft, phishing, or burglary.
Biomedical and Physical Data Collection
Blood draws, tissue biopsies, MRI scans, exercise testing, and experimental drug trials all carry physical risk ranging from minor discomfort to serious adverse effects. These methods are the most straightforward to evaluate because the harms are tangible: pain, bruising, allergic reactions, or loss of physical functioning. Federal regulations consider routine procedures like a single blood draw to be minimal risk, comparable to what you’d experience during a standard medical checkup.
The risk escalates with more invasive procedures or when participants are asked to stop existing medications, try experimental treatments, or undergo repeated testing over long periods.
Vulnerable Populations Face Greater Risk
The same data collection method can pose very different levels of risk depending on who the participant is. Prisoners cannot freely refuse to participate when researchers have institutional access. Children cannot fully understand what they’re consenting to. People with cognitive impairments may not grasp how their data will be used. Undocumented immigrants face deportation risk from any method that records their identity or location.
During the COVID-19 pandemic, infectious disease models that relied on mobile phone location data effectively excluded people in prisons and nursing homes, whose mobility patterns weren’t captured. This illustrates a related problem: when data collection methods miss vulnerable groups entirely, the resulting research can deepen existing health disparities rather than address them.
Which Method Poses the Most Risk?
No single data collection method is inherently “the risky one.” Risk depends on three factors: what information is being collected, how identifiable the participants are, and what would happen if the data were disclosed. A survey about favorite colors is virtually risk-free. A survey about illegal drug use stored with participants’ names is high-risk. A focus group about parenting tips is low-risk. A focus group about sexual health in a small town is high-risk.
If you’re answering a multiple-choice question, look for the option that combines sensitive subject matter with identifiable data, especially methods involving face-to-face interaction (like focus groups or interviews) where anonymity is impossible, or methods that record information about illegal behavior, health conditions, or stigmatized identities. Those consistently represent the highest-risk data collection scenarios in research ethics.