Research Data Guide: Survey data

Research data vary considerably, and therefore the solutions used to manage them also differ. Data management is a form of creative problem-solving and an essential component of responsible and ethical research. The aim of data management is not to apply a single model to all research projects. Rather, guidance and support services are intended to help researchers identify solutions that are appropriate for their data, research design, and research environment. 

Well-designed data management supports the reliability, transparency, reproducibility, and potential reuse of research. Data management encompasses the entire lifecycle of research data, from research planning through data collection or acquisition, processing, analysis, documentation, and storage, to the sharing, archiving, or deletion of data after the completion of the research project. 

Research data may vary, for example, with respect to how they are generated, their data protection and information security requirements, contractual obligations, technical solutions, and opportunities for future reuse. This data-specific guide examines key data management issues from the perspective of survey data.

Not all research data can or should be made available for reuse. Data sharing may be restricted, for example, by the protection of personal data, copyright, contractual obligations, or research ethics considerations. Even when the data themselves cannot be published, metadata, documentation, analytical methods, or software code used in the research can often be made available to other researchers. This supports research transparency, the evaluation of research findings, and the broader goals of open science. 

The purpose of this guide is to help researchers identify the key data management issues associated with their particular type of research data and to find practical solutions for different stages of the research process. The guide complements the organisation's general guidance on research data management, data protection, information security, and open science. 

The University of Helsinki Data Support service provides researchers with as well as  

In this guide, survey data refers to data collected from a selected group of individuals through a survey administered electronically, by post, by telephone, or in person. Survey data are generated when all participants are presented with the same questions or statements in a predetermined format. 

Survey data may contain both quantitative and qualitative data. Quantitative data typically consist of predefined response options, such as rating-scale questions or yes/no questions, whereas qualitative data arise from open-ended responses. A single survey may contain both types of data. 

A survey may be conducted once or repeatedly. For example, in experience sampling studies, responses may be collected several times a day over a short period, whereas in longitudinal studies the same individuals may be followed for several years. The mode of survey administration also affects how the data are documented, organised, and stored.

The management of survey data begins before data collection starts. Many decisions relating to the future use, storage, sharing, and preservation of research data are effectively made during the survey design stage. For this reason, data collection, processing, storage, and the eventual archiving or deletion of data should be planned in advance. 

From a data management perspective, particular attention should be paid to the content of survey questions, the selected data collection method, and the potential for future reuse of the data. For example, questions concerning intimate topics or information that may enable respondents to be identified can affect data protection and information security requirements. Likewise, the features of the survey platform influence how data can be collected, stored, and processed securely. 

If future reuse or sharing of the data is being considered, this should be taken into account already at the research planning stage. Research permits, consent procedures, documentation, and metadata all affect whether the data can later be reused. Considering these issues in advance facilitates data management throughout the entire research process. 

If personal data are collected through a survey, there must be a lawful basis for processing them. Personal data include any information through which an individual can be identified directly or indirectly, such as a name, address, telephone number, or personal identity code. The processing of personal data is regulated by the EU General Data Protection Regulation (GDPR). In scientific research, the legal basis is typically the performance of a task carried out in the public interest. 

Survey data may contain identifiable personal data. Researchers should plan in advance which personal data are genuinely necessary for the study and collect only those data. Identifiable personal data should be removed from or separated from the research data as soon as this is possible from the perspective of the research. Respondents must also be informed clearly about what information is collected, how it will be used, and how it will be processed. This implements the principle of data minimisation required by data protection legislation. 

Open-ended responses may compromise the anonymity of a survey. A survey may be considered anonymous if no personal data are collected and respondents cannot be identified directly or indirectly on the basis of the information contained in the data. Open-ended response fields do not in themselves make a dataset identifiable or sensitive. However, respondents may enter information that reveals their identity or contains other personal data. Particular attention should also be paid to questions asking respondents to describe their personal circumstances or experiences in their own words. If personal data are collected in open-ended responses, or if respondents can be identified on the basis of those responses, the data must be treated as data containing personal information. In such cases, open-ended responses may need to be pseudonymised or removed before analysis, data sharing, or archiving. 

If survey data are linked with register-based data, the ethical, data protection, and legal principles governing the use of register data must also be followed. Further guidance is available in the . 

Questions relating to data protection, the processing of personal data, and research agreements should be discussed with legal experts already at the research planning stage. The University of Helsinki's legal service contact address is . 

4. Research Ethics and Research Permits 

Survey research must comply with . During the planning stage, researchers should assess whether the study requires prior review by a research ethics committee. Ethical review is required if one or more of the following conditions apply: 

• the study departs from the principle of informed consent (uncommon in survey research, but possible, for example, in survey experiments) 
• the study involves children under the age of 15 without parental consent or without an information procedure that allows participation to be refused 
• participants are exposed to exceptionally strong stimuli (certain survey questions may constitute such stimuli) 
• the study may cause psychological harm exceeding the boundaries of ordinary daily life to participants or those close to them 
• conducting the research may pose a safety risk to participants or those close to them 

See: . 

If any of the above conditions may apply to your study, carefully assess the possible impact of the research on participants and plan how potential harms can be minimised or prevented. This may involve modifying or removing certain parts of the survey. 

Pay particular attention to respondents who may be in a vulnerable position due to minority status or other personal circumstances. Researchers should also assess whether participants have a realistic opportunity to complete the survey in private. 

A formal research permit is required if participants are recruited through an organisation that requires such permission. The permit must be obtained from the relevant organisation. For example, recruitment of patients through healthcare organisations, such as HUS, requires a research permit issued by the organisation. Applying for a research permit generally requires either a research ethics committee review or a justified explanation of why such a review is not required. If respondents are recruited through open channels, such as university student mailing lists, a separate research permit is typically not required. Even in these cases, however, the need for ethical review may still need to be assessed. 

Survey research is based on informing participants and obtaining their consent. Before taking part, participants must be provided with clear and understandable information about how their personal data will be processed in the study. Information provided to participants should be concise and appropriate for the target group. Particular attention should be paid when participants are children, older adults, or otherwise in a vulnerable position. 

Data protection information is generally provided through a privacy notice, which is supplied to participants in advance or included as part of the survey. The privacy notice should also be made available, for example, on the research project's website. (See ) 

Make use of existing data. Before collecting new data, researchers should determine whether suitable existing data are already available for the research purpose. In many countries, large-scale survey datasets are collected through coordinated national or international efforts and made available for secondary analysis. 

Examples include the and the . The community maintains directories of openly available datasets in psychology. Some datasets, such as longitudinal study, are available subject to agreement. Finnish survey datasets are available, for example, through the . 

These datasets typically include extensive documentation concerning data collection methods and content. Data service websites often enable both downloading and analysing data without local storage. When using data collected by others, researchers should cite the dataset in accordance with good scientific practice. 

Data collection may also be outsourced to a commercial service provider. In such cases, appropriate procurement procedures, information security requirements, and contractual arrangements must be taken into account. Particular attention should be paid to how the external provider is instructed during the various stages of data collection, how the data are stored and transferred to the research group, and what services are included in the contract. In addition to the procurement agreement, a separate data management agreement should be established covering issues such as storage during data collection, information security, and transfer of the data to the research team. 

Survey data may be collected either by distributing a questionnaire to participants or by administering the survey as an interview. Survey modes include paper questionnaires, telephone interviews, and web-based survey forms that respondents access through a link. The link may be distributed through various channels, including websites and email. 

The features of the survey platform directly affect the data collection workflow. For this reason, the suitability of a survey platform should be assessed before it is adopted. Researchers should verify, in particular, whether the platform supports required functionalities such as multilingual surveys and user interfaces in multiple languages. Where surveys are conducted in more than one language, the associated time and resource requirements should be considered in data management planning. If response times are relevant to the research design, researchers should ensure that the platform can record them appropriately. 

Where are survey data stored during collection? Before data collection begins, researchers should determine where the data collected through the survey platform are stored and where they are processed. 

Particular attention should be paid to the processing of personal data and the location of data storage. Transfers of personal data outside the EU/EEA are restricted under the GDPR and must always be supported by an appropriate legal basis and adequate safeguards (see ). The purpose of these safeguards is to ensure that personal data are processed securely even when they are handled in services located outside the EU/EEA (see ). 

If data are shared through or another research platform, researchers must verify that the storage environment is located within the EU/EEA or that the service complies with GDPR requirements for international data transfers. Researchers should also determine where data and personal information collected through commercial survey tools are stored and under what terms. In addition, they should assess how access rights are managed, whether organisational credentials are required, and how user roles are defined. 

Researchers should take into account the time required to learn and implement a new survey platform. Before use, they should ensure that the platform meets the needs of the study from multiple perspectives. In particular, the following questions should be considered: 

• Is user support, documentation, or training available? 
• Does participation require respondents to install an application, or does the survey run in a web browser? 
• Is the platform accessible and suitable for the target population? 
• Does it support the study design (for example, random assignment of respondents to groups)? 
• Does the system generate audit logs relating to users and project activities? 
• Does it produce documentation automatically, such as a data dictionary or codebook? 
• Does it collect technical identifiers, such as IP addresses, that might allow respondents to be identified? 

At the University of Helsinki, survey tools include E-lomake and REDCap. Faculties and units may provide access to additional tools intended for research use. The suitability of a survey platform depends on the data protection requirements of the project. E-lomake is suitable for general survey data collection but should not be used for processing sensitive personal data because it does not provide all logging features required under data protection regulations. REDCap may also be used for collecting sensitive research data, provided that data protection and access control requirements are met. For more information and support with using REDCap, you can contact . 

Survey data are typically not analysed directly within the survey platform. Instead, they are transferred to statistical or analytical software for analysis. During transfer, researchers must ensure the secure handling and storage of the data. Analysis should be conducted in a secure environment. Access to analytical software and storage locations must be restricted to authorised users. Data containing sensitive personal information should be transferred to a secure research environment (at the University of Helsinki, for example, Umpio) and analysed only within approved environments. 

If identifiers are used within the data, for example to link data from different sources, identifiers and personal information should be stored separately from the analytical dataset and protected with particular care. Data analysis may also involve linguistic and practical considerations. If research is conducted in multiple languages, researchers should ensure that analysis can be carried out appropriately in all research languages or that suitable translation services are available. The use of translation services requires appropriate agreements and participants must be informed if a translation process is involved.

Survey platforms may generate part of the documentation automatically. For example, REDCap produces a data dictionary and/or codebook describing survey variables and coding schemes. These should be supplemented with other documentation created during the project. Documentation is a central component of data management and should be maintained throughout the entire research process. Retrospective documentation may be incomplete or even impossible. 

Project documentation includes practices such as file naming and folder structure. Folder structures should be designed according to the needs of the study. An excessively deep structure may make files difficult to locate, whereas an overly simple structure may result in all files being stored in a single folder. Raw data should be stored separately from processed data, and the raw data should be "frozen" so that they are not modified during analysis. If weighting variables are used, their creation, content, and intended use should be clearly documented alongside the data. 

Administrative documents associated with the research project, such as consent forms and participant information materials, should also form part of the documentation. It is advisable to store these separately from the analytical data. Grant applications and publication drafts should likewise be organised separately. Where a project involves multiple researchers, folder structures and documentation practices should be agreed upon in advance. (see ) 

Implementing the FAIR principles requires careful documentation and the production of metadata. Metadata describe the content, structure, and use of the data and make them Findable, Accessible, Interoperable, and Reusable. The more systematic the documentation, the better the data support FAIR principles. 

Even when research data cannot be shared, metadata can often be published. In such cases, care must be taken to ensure that the metadata do not contain sensitive information. Metadata may be published, for example, through . 

As part of the documentation, researchers are also encouraged to preserve scripts used for data processing and analysis. Although these are closely tied to the implementation of a specific study, they form an important component of documentation and support transparency and reproducibility in accordance with the principles of open science.

Survey platforms are not intended for long-term storage of research data. Data should be exported from the survey platform once collection has been completed. When selecting a storage location, researchers should determine who requires access to different versions of the data. For example, if only analytical outputs are needed, raw data may be stored in a more restricted location. A person responsible for managing access rights should also be designated within the project. 

Make use of institutional storage services. During a research project, data may be stored in a personal home directory (Z drive) when working individually or a shared group directory (P drive) when working collaboratively. The storage services provided by the University of Helsinki are described in this . Researchers should document where data are stored and who has access to them throughout the project. This facilitates data management and supports the implementation of agreed data deletion procedures. 

University of Helsinki home directories and group directories are automatically backed up every hour and are available across Windows, macOS, and Linux environments. All university staff and students have access to a home directory, and group directories can be established for collaborative work. (see ) 

External hard drives may be necessary, for example, during fieldwork, but they should not be used as the sole storage location for data. External drives require careful backup procedures and may break or become lost. When used, particularly for sensitive data, they should be encrypted, for example using Cryptomator (). Data should be transferred from external drives to secure institutional storage services as soon as possible. 

Storage of sensitive data. Highly sensitive data may be stored in the University of Helsinki's Umpio environment, which is suitable for secure storage and processing during the research project. If data need to be accessed by researchers outside the University of Helsinki or shared more broadly, should be used. Sensitive data must not be sent as email attachments. 

Protective measures may include pseudonymisation, anonymisation, encryption, aggregation, secure data transfer, access restrictions, user authentication, audit logging, and contractual data protection clauses (see ). For example, REDCap provides audit logging features. 

If survey data are linked with register-based data, the storage requirements governing the register data must also be followed. (see the ) 

Responsibilities relating to data management and the division of labour within the project should be agreed in advance. Not all members of the project necessarily need access to raw data if their responsibilities require only processed data. 

Data sharing becomes more demanding when projects involve collaborators outside the organisation. In such cases, secure services, such as those provided by CSC, should be used. For international collaborations and other complex projects, researchers are encouraged to consult services to identify appropriate solutions.

The sharing, archiving, and deletion of research data must comply with the agreements made during the research project, the information provided to participants, and any legal and ethical obligations governing the data. Even where the research data themselves cannot be shared, metadata, documentation, methodological descriptions, or software code used in analysis can often be published to support research transparency and reproducibility. 

In Finland, the principal repository for survey research data is the Finnish Social Science Data Archive (FSD), which accepts only anonymised datasets (see ). The University of Helsinki's , , and services are available to researchers for the preservation, publication, and sharing of research data and metadata after the active phase of research or once a project has ended. The suitability of these services depends on the nature of the data, access rights, and data protection requirements. 

Other trusted repositories may also be used for archiving. Suitable repositories can be identified through services such as Re3data.org. Researchers are encouraged to use curated repositories that provide persistent identifiers (PIDs) and support either open or restricted licences. Curated repositories also provide long-term preservation services and may be recognised through certifications such as the CoreTrustSeal. 

The reuse of data in future research requires that such use has been described in the privacy notice before data collection begins or, at the latest, when data are collected. In other words, participants must either have been informed in advance or reuse must have been authorised through a separate permission included in the original consent process. Data should be preserved in open file formats suitable for long-term preservation, such as CSV. Where necessary, data may be stored in multiple formats so that future use is not restricted to a particular software package. 

Data retention and deletion practices must comply with the description provided in the research privacy notice. If the data have been promised to be deleted after a specific period, this must be carried out as planned. Calendar reminders may be useful for ensuring that required follow-up actions are completed, particularly where they occur far in the future. If data are retained only for a verification period, they should be deleted once that period has ended. 

Survey data should also be deleted from the survey platform. At the same time, researchers should retain any necessary survey templates and verify which export formats are available. The platform's own data retention and deletion policies should also be reviewed. 

Data selected for deletion must be disposed of securely. Not all research data can or should be retained once a project has ended. If data are deleted, they must be removed in a manner that prevents later recovery. The organisation's information security guidelines should be followed with particular care when disposing data containing personal information or other types of sensitive data (see the guidelines by ). Physical storage media, such as external hard drives, USB drives, and optical discs, should also be disposed of securely. Researchers may seek assistance from their organisation's IT services or information security specialists where necessary (see ). Local IT support () may also be requested to carry out the deletion if the researcher is uncertain about the correct procedure or if the data are highly sensitive.  

Boynton, P. M., & Greenhalgh, T. (2004). Selecting, designing, and developing your questionnaire. Bmj, 328(7451), 1312-1315. 

Gideon, L. (2012). Handbook of Survey Methodology for the Social Sciences. Springer.

Plutzer, E. (2019). Privacy, sensitive questions, and informed consent: Their impacts on total survey error, and the future of survey research. Public Opinion Quarterly, 83(S1), 169-184. 

Vehkalahti , K. (2014). Kyselytutkimuksen mittarit ja menetelmät. Finn Lectura. 

Data protection: 

Research ethics: 

Open data: 

Creating surveys:

(Available only in Finnish)

Data storage during the project:

Data archiving:

The data management handbooks are designed as living resources that are continuously updated to meet the evolving practices of the field and the needs of researchers.

You can give feedback on the Survey data guide, such as additional information, comments, or corrections, via this .