REQUIREMENTS AND POLICIES

Depedning on the scope of your project, UMD has specific requirements and policies that may apply to your work. From IRB requirements to data security, this information will help you collect and use data responsibly.


  • Institutional Review Board (IRB)

    Do I need IRB approval for my survey?

    • IRB approval is required for any survey that meets the IRB definition of Human Subject Research. If you are not sure if this applies to your survey, fill out and submit a Human Subject Research Determination Form to the IRB.
    • Your survey may not require IRB approval if it is an internal quality improvement survey that will not be shared with external audiences.
    • However, consider all potential audiences. If there is any chance that you might present the results to external audiences (including any public-facing websites), then you should obtain IRB approval.

    How do I get IRB approval?

    • You can learn about the IRB submission and review process here. Work with the IRB to navigate this process.
    • When creating your IRB submission, you will need to include survey questions, any communications to recipients, and language around informed consent.
    • You and anyone on your research team will need to have completed the CITI training within the last three years in order to obtain IRB approval.

  • Requesting Contact Information

    How do I request lists of emails for my survey participants?

    • To request a list of emails, complete the office of the Registrar Data Request Form (for student contact information) or contact UHR Data Services (for employee contact information.
    • Using these forms, you can provide details about what you need for your sample.
    • If you plan to address participants by their name in any communications, make sure to ask for "name_informal" for their preferred name.
    • You may need to attach your IRB approval, communications drafts, and the survey questions.
    • Remind users of appropriate use (e.g., what not to do with power user access, confidentiality flags).

  • Data Privacy and Security

    Data Classification Standards

    • Familiarize yourself with UMD's Data Classification Standards and determine the level of data sensitivity that applies to your survey data. This will determine how you should store and handle the data.
      • For example, data classified as Moderate Risk or below can be stored in Google Drive, whereas data classified as High Risk can be stored in Box, but not Google Drive.
    • Additional data requirements may apply in association with IRB approval, FERPA, and HIPAA beyond those listed in the Data Classification Standards. It is your responsibility to comply with these requirements.
      • For example, the nature of your research may determine how long do you need to retain research data files.

    Survey Administration and Analysis Software

    • Only use software that has been approved and vetted by the DIT Compliance team. You can search the UMD software catalog for approved software.
    • Qualtrics is generally recommended because UMD has an enterprise-level agreement with them and it is approved for High Risk data.
    • Do not feed data into unvetted generative AI tools. Familiarize yourself with UMD's guidelines for using generative AI while respecting data privacy.
    • Please see UMD's Guidelines for the Use of Generative Artificial Intelligence (GenAI) Tools at UMD for additional guidance about GenAI use in research, teaching, and learning.

    Ethical and Responsible Data Use

    • Only collect data needed to meet your project's goals, and anonymize as much as you can. Do not ask for personally identifiable information (PII) unless necessary; if possible, design your survey so that participants do not provide any identifying information.
    • Report data in the aggregate. If you need to disaggregate data by certain variables (e.g., major), be careful about small n-sizes to be sure that individual responses don't become identifiable.
    • Use open text questions carefully. Respondents might freely provide identifying information. It is good practice to remind participants on how data will be used, shared, and reported. It is your responsibility to anonymize responses.
    • Resources on ethical data use:

  • Large-Scale Surveys

    Data Classificaiton Standards

    • If conducting a large-scale (e.g., campus-wide) survey directly through Qualtrics, you may need to reach out to UMD's Qualtrics service owner to expand the number of people to which you can distribute the survey.
      • Only send reminders to nonrespondents.
    • The Office of Marking and Communication (emailrequest@umd.edu) needs to review all approved communications for campus-wide and large-scale surveys and may have input on timing.