When you run studies on Prolific, you'll receive some information about your participants. As the researcher, you're responsible for handling this data in line with applicable data protection laws.
What personal data will I receive?
Depending on how your study is set up, you may receive personal data in a few different ways.
Information from Prolific
When a participant signs up for your study, you'll be able to access certain information from Prolific, including:
Basic demographic information
Responses to any screening questions you've used
Information about the participant's submission history on Prolific
Although this information may not directly identify a participant, it is still considered personal data under UK data protection law and, where applicable, European data protection laws.
Study responses
When participants complete your study in your external study software, you'll receive the responses they provide as part of the study.
Messages with participants
If you need to contact participants, you must use Prolific's messaging system. Messages should only relate directly to a study, such as clarifying a submission or providing study-related information.
You must not contact participants for marketing, promotional, or other unrelated purposes.
How should I handle participants' personal data?
The participant information provided by Prolific is pseudonymized. This means participants are identified only by their Prolific ID rather than by direct identifiers such as their name, email address, or postal address.
It's important to understand that pseudonymized data is not the same as anonymized data and is still treated as personal data under applicable data protection laws. Here’s more information about the difference between anonymized and pseudonymized data.
When handling participant data, you must:
Keep personal data secure and process it in accordance with applicable data protection laws.
Never attempt to identify or re-identify a participant using the pseudonymized data provided by Prolific or any other information available to you. In some jurisdictions, attempting to re-identify individuals may be a criminal offence.
Never ask participants to provide direct personal identifiers (such as their name, email address, phone number, or home address) unless you have received written approval from Prolific. For the approval process, see: Requesting approval to collect personal data.
Your responsibilities as a researcher
When you receive personal data through Prolific or collect personal data during your study, you are generally acting as the data controller for that data.
This means you're responsible for ensuring that your collection, storage, use, sharing, and deletion of personal data complies with all applicable data protection laws.
Do I need to provide a privacy notice?
Yes.
You have to comply with applicable data protection law when you receive personal data from us, and when you receive personal data directly from participants when conducting your studies. In particular, that means you must ensure that in any study listing your identity is clear and the participant is provided with or directed to a privacy notice meeting the requirements of applicable law in your territory.
Before participants take part in your study, you must ensure they know:
Who you are (or which organisation is conducting the research)
What personal data you'll collect
Why you're collecting it
How you'll use it
Who it will be shared with, if anyone
How long you'll keep it
How participants can exercise any applicable privacy rights