Please note the below important changes for anyone planning on using any platforms that are hosted outside the UK or EU. These changes have come into effect immediately and must be reflected in research going forwards.
If you are currently planning your research, you must take these changes into account when completing your PG2 form.
This guidance applies to all those using digital platforms, such as e-commerce platforms, that are hosted outside the UK or the EU.
Ethical requirements for use of non-UK/EU Digital Platforms or apps in Postgraduate Research Data Collection
In situations where we cannot be certain that data will stay in the UK or EU, then informed, explicit consent from each participant must be obtained before use.
Please create a separate Participant Information Sheet (PIS) for the app that provides:
- Full details of the app, including an explanation of the ways in which it may process the data as outlined in their privacy notice or contract. A link to the privacy notice should also be included.
- A statement along the lines of: “By taking part in this research you agree to use the […] app, which may store and process your information outside of the UK. You agree that UWTSD is not responsible for any way your data might be used by […]”
- A signature (either digital or written is acceptable) and date area. The PIS must be signed and dated before participation in your research can commence. A tick box that a participant actively selects may also be acceptable as evidence of consent in lieu of a digital or written signature.
Use of WeChat and Similar Social Media or Messaging Platforms: Researchers intending to use WeChat (Weixin), or similar platforms such as Weibo, WhatsApp, Facebook, Instagram, X (formerly Twitter), LinkedIn for recruitment, communication, or data collection should be aware that personal data may be processed or stored outside the UK/EU and may be subject to different legal, regulatory, and privacy frameworks. Before collecting or sharing research data through such platforms, researchers must consider data protection, confidentiality, informed consent, and any cross-border data transfer requirements. Participants should be informed of any privacy limitations associated with the platform being used, and identifiable research data should be transferred to secure university-approved systems and not retained unnecessarily on third-party applications. Researchers should seek advice from their supervisor or Research Ethics Committee, where appropriate.
NOTE: If the digital platform/app has no privacy statement, or if it is not clearly stated on a contract or within its terms and conditions, its use will not be approved.
These updates relate to the relevant part of our Research Data Management Policy:
6.11. The UK GDPR does not allow transfer of personal data outside the EU or a country without adequate protection without meeting a condition like explicit consent or a binding contract. Researchers must always therefore obtain explicit consent or anonymise data before sending data outside the European Economic Area (the EU plus Norway, Iceland and Liechtenstein).
If you have any questions please contact the Chairs of the Research Ethics Committee at