HEW-NODE-0123 · How Education Works · research governance, research ethics, ethics review, consent, assent, children, school gatekeepers, power imbalance, privacy, administrative data, data linkage, de-identification, secure access, data sharing, open science, publication, reproducibility and research closure
A school contains extraordinarily rich evidence about learning: assessment responses, attendance, teaching practice, interventions, transitions, timetables, student records, classroom interactions and years of accumulated institutional history.
That richness creates a temptation. If education wants better evidence, why not simply let researchers use the data and observe the learners?
Because learners are not raw material, schools are not frictionless laboratories, and administrative records were usually collected to run education rather than to answer every future research question. Research becomes legitimate only when purpose, authority, participant rights, data access, security and publication are designed as carefully as the method.
Education research governance is the system that makes inquiry possible without allowing the desire to know more to erase the rights of the people and institutions being studied.
This node sits beside the How Education Works hub, Educational Research, Education Data Privacy & Student Records Governance, Education Records Retention, Disposition & Archival Continuity, Education Statistics Quality Assurance & Data Validation and Learner Identity & Education Data Interoperability.
Those pages keep their jobs. Educational Research owns research design, evidence and inference broadly. Data Privacy owns operational governance of student records. Records Retention owns lifecycle and archival controls. Statistics QA owns data quality. This node owns the research-access layer: how proposed studies involving learners, schools or education data are reviewed, authorised, consented, secured, linked, analysed, shared, published and closed responsibly.
Boundary: research ethics, privacy and consent requirements differ by jurisdiction and institution. This article is a systems guide, not legal advice or a substitute for an ethics committee, data-protection office, safeguarding policy or applicable law.
The 60-Second Read
- A good research question does not automatically create a right to access learners or records.
- Ethical review should occur before recruitment or data access, not after analysis has begun.
- Gatekeeper permission and participant consent are different forms of authority.
- Children and young people should receive information they can genuinely understand.
- Parental or guardian permission does not make a child’s own assent irrelevant.
- Teachers and students can feel pressure to participate because schools are hierarchical environments.
- Participation should not affect marks, access, discipline or ordinary services unless that relationship is an explicit and ethically justified part of the study.
- Secondary use of administrative data needs a defined purpose and lawful or ethical access route.
- “Anonymised” does not mean impossible to re-identify.
- Small schools and rare characteristics can make indirect identification easy.
- Data minimisation reduces risk before technical security begins.
- Linkage across datasets can create new information that no source held alone.
- Secure research environments can permit useful analysis without distributing raw records widely.
- Researcher access should be logged and time-bounded.
- Pre-analysis plans and versioned code can strengthen reproducibility where the method permits.
- Open science does not mean publishing personal or sensitive learner data.
- Negative, null and inconvenient findings are part of the evidence system.
- Schools deserve a return path: what was learned, what remains uncertain and what happens to the data after the project.
- Research partnerships should not extract data while leaving local educators without access to the resulting knowledge.
- The goal is useful inquiry with proportionate burden and defensible protection.
One-Sentence Definition
Education research governance is the coordinated control of ethical review, participant recruitment, consent and assent, school permission, data access, privacy, security, analysis, sharing, dissemination and closure for research involving educational settings or records.
The First Distinction: Permission Is Not Consent
A principal may permit a study to take place in a school. That permission does not automatically mean every teacher or student has agreed to participate. Likewise, a participant’s willingness does not give a researcher the right to ignore the institution’s safeguarding, data or operational rules.
Research in schools therefore often needs several valid authorities at once: institutional permission, ethics approval where required, appropriate consent or assent, and authorised access to any records used.
The Second Distinction: Administrative Data Are Not Research Data by Default
Attendance, assessment, behaviour and contact records are collected to operate education. Using them for a new research question can change purpose, access, retention and risk. The fact that data already exist does not make all secondary uses automatically acceptable.
Governance should identify who owns or stewards the source, what authority permits research use, what fields are actually needed, and whether participants were informed about secondary use where applicable.
The Third Distinction: Anonymous, Anonymised and Pseudonymised Are Not the Same
Anonymous data were never linked to an identifiable person, or no practical identifier exists within the research process. Anonymised data have been transformed so individuals are not reasonably identifiable under the relevant standard. Pseudonymised data replace direct identifiers with codes while a re-identification key may still exist elsewhere.
These states carry different risks. Calling a coded dataset “anonymous” can create false confidence and inappropriate sharing.
Begin With the Research Job
Governance becomes easier when the question is precise. “Study student success” can justify almost unlimited data collection if left vague. “Estimate whether attendance during the first six weeks predicts withdrawal from this specific programme after adjusting for prior enrolment status” has a defined population, outcome and likely data requirement.
Precision allows reviewers to ask whether the proposed burden and data access are proportionate to the knowledge the study could create.
Ethical Review Should Test the Whole Path
An ethics application is weak if it describes recruitment but not publication, or analysis but not retention. Review should follow the project from first contact through final deletion or archive.
- Who is being studied?
- Why are they needed?
- Who approaches them?
- What might make refusal difficult?
- What data are collected?
- What happens if sensitive information is disclosed?
- Who can access identifiable information?
- What linkage occurs?
- What will be shared?
- How will findings be reported?
- When will data be destroyed, de-identified or archived?
Current Ethical Guidance Emphasises Ongoing Informed Consent
The British Educational Research Association’s Ethical Guidelines for Educational Research, fifth edition (2024) frame voluntary informed consent as an ongoing condition, address transparency and withdrawal, and include specific responsibilities around privacy, data storage, secondary data and research involving children and young people. The guidelines are not a universal legal code, but they are a useful professional reference for the governance questions an education study should be able to answer.
School Hierarchy Can Create Invisible Pressure
A teacher invited by their principal may believe participation is expected. A student invited by their own teacher may worry that refusal affects marks or relationships. A family may interpret a school-branded research request as compulsory.
Recruitment should therefore state voluntariness clearly and, where feasible, separate ordinary educational authority from the act of requesting participation. The more dependent the relationship, the more carefully the refusal route should be designed.
Children Need More Than Adult Paperwork
A twelve-page consent form written for university administrators does not become meaningful simply because a child signs it. Information should fit age, language, reading ability and the actual decision the learner is being asked to make.
Where law or policy requires guardian permission, the child’s willingness still matters ethically. A learner showing clear discomfort should not be treated as a passive data source merely because an adult signed earlier.
Assent Can Be Ongoing and Behavioural
A participant may initially agree and later disengage. Researchers should notice more than formal withdrawal emails. Repeated avoidance, visible discomfort or refusal to answer can be evidence that continued participation needs to be reconsidered.
Non-Participation Needs an Operational Plan
Classroom studies create a practical problem when some learners consent and others do not. Researchers need to know whether non-participants remain in the room, whether their speech or work can enter field notes, whether cameras avoid them, and how group tasks are handled.
Ethics becomes real at these edges. A consent form is not enough if the observation method cannot actually exclude a learner who declined.
Safeguarding Overrides Ordinary Research Flow
A research interview can reveal abuse, self-harm risk, serious threats or other information that cannot simply be held under an ordinary promise of confidentiality. Participants should be told the relevant limits before disclosure occurs, and researchers should know the institution’s escalation route.
Researchers should not invent their own safeguarding procedures in the moment.
Minimise Data Before Protecting Data
The safest unnecessary data field is the one never collected. If age band is enough, exact birth date may be unnecessary. If district is enough, home address may create risk without analytic value. If the study needs prior attainment but not names, identifiers can be separated early.
Security matters, but data minimisation reduces the consequence of security failure.
Administrative Data Access Needs a Steward
Researchers should not obtain extracts through personal relationships with staff who happen to have database access. A controlled request identifies the dataset steward, approved fields, permitted purpose, named users, storage environment, linkage rights, retention and destruction date.
That process protects researchers too. They can demonstrate that access was authorised rather than relying on informal permission that later becomes disputed.
Current International Practice Often Separates Researcher Access From Live Systems
The OECD Digital Education Outlook 2023 reports that, across the education and student information systems it examined, researchers typically did not access operational systems directly but instead worked with anonymised databases derived from them. The exact model varies by jurisdiction, but the design principle is strong: research access does not need to equal administrator access.
Linkage Creates New Risk
A school dataset may contain age and attainment. A health dataset may contain a condition. A neighbourhood dataset may contain location. Each may appear relatively safe alone. Linking them can create a profile that is much more identifiable and sensitive.
Data-linkage approval should therefore examine the combined dataset, not only the permissions attached to each source separately.
A Trusted Third Party Can Separate Identity From Analysis
In some designs, a designated service performs linkage using identifiers, then provides researchers with a de-identified analytic file. The research team never receives names or direct identifiers.
This does not eliminate re-identification risk, but it reduces unnecessary exposure and makes roles clearer.
Secure Research Environments Change the Access Model
Instead of copying sensitive datasets to researchers’ laptops, a secure environment can allow approved users to analyse data inside controlled infrastructure. Downloads may be restricted, outputs checked and access logged.
This is especially useful when the analytic value of detailed data is high but ordinary file distribution would create unacceptable risk.
Access Should Expire
Research access granted for a two-year study should not quietly become permanent because nobody removed the account. Projects need start and end dates, named users and a closure process that revokes credentials and confirms the status of working files.
Small Cells Can Re-Identify People
A table showing “one female student, age 17, in the only advanced physics class in a small school” may identify the person without a name. Suppression, aggregation, perturbation or output checking may be necessary when combinations of variables create uniqueness.
Qualitative Research Has Different Identification Risks
A quotation can identify a principal because colleagues recognise the incident, writing style or school context. Changing a name may not be enough. Researchers should consider whether contextual details can be altered without changing the analytic meaning and should be honest about limits to anonymity in close-knit settings.
Researcher Notes Are Data Too
Field notes, contact lists, audio files, transcription files, consent forms, codebooks and analytic memos can contain sensitive information even when the final dataset has been cleaned. Data-management plans should cover the whole project environment.
AI Does Not Remove Researcher Responsibility
Researchers may use AI to transcribe, code, summarise or classify data. Before uploading educational data to an external service, they need to understand where data travel, whether inputs are retained, who can access them, whether the service is authorised and whether sensitive information is necessary for the task.
An AI-generated theme or classification remains a research output requiring validation. Automation can scale analytic error as easily as analytic labour.
Pre-Registration Can Clarify What Was Planned
Where appropriate to the research tradition, registering hypotheses, outcomes or analysis plans before examining results can distinguish confirmatory analysis from later exploration. It does not make the study automatically valid, but it improves transparency about when decisions were made.
Version Code and Data Transformations
Administrative datasets change. Variables are recoded. Exclusions are applied. Derived measures are created. A reproducible project records source versions, transformation logic and analysis code well enough that another authorised analyst can understand how the result was produced.
Open Science Has Ethical Boundaries
UNESCO’s Recommendation on Open Science, adopted in November 2021, argues for scientific knowledge that is as open as possible while recognising justified restrictions for privacy, confidentiality, human subjects and other protected interests. It explicitly recognises mediated access, anonymisation and pseudonymisation when unrestricted release is inappropriate.
For education research, “open” can mean publishing methods, metadata, code, instruments and sufficiently aggregated results while keeping personal learner records inside controlled access.
Publication Should Not Increase Participant Risk
A paper can be safe during analysis and harmful after publication if it identifies a vulnerable school, stigmatises a small group or releases detailed appendices that allow re-identification. Disclosure review should therefore occur at the output stage, not only when data are first received.
Sponsors and Conflicts Need Disclosure
If a technology vendor funds research about its own product, readers need to know. Sponsorship does not prove the findings are biased, but undisclosed sponsorship prevents readers from evaluating incentives and governance.
Contracts should not give sponsors silent power to suppress legitimate negative findings merely because they are commercially inconvenient.
Schools Need a Burden Budget
One survey may be harmless. Twenty simultaneous studies can consume lesson time, staff attention and student goodwill. Research offices should see the aggregate burden on schools rather than approving each request in isolation.
High-value research can justify substantial burden, but the trade-off should be visible.
Research Access Should Not Depend on Who Knows the Principal
Informal networks can make some schools repeatedly researched while others remain absent from evidence. A transparent request process can improve fairness, coordinate burden and help match studies to schools where the question is relevant.
Return Findings in a Form Schools Can Use
A peer-reviewed paper published two years later may be valuable but still leave participating teachers wondering what happened. Where appropriate, researchers should provide a plain-language summary, explain limitations and distinguish group-level findings from claims about individual students.
The school should not be promised an intervention effect the study was not designed to estimate.
Negative Findings Are Part of the Return Path
If an intervention shows no clear effect, hiding the result wastes participant contribution and encourages repetition of the same uncertain approach. Responsible dissemination includes findings that are null, mixed or inconvenient, with the same care about overclaiming.
Research Closure Is a Real State
A project is not closed merely because the paper was submitted. Access should be revoked, identifiers deleted or archived according to approval, consent records retained appropriately, code and documentation stored, outstanding participant commitments completed and any continuing data-sharing arrangements recorded.
Case Study: The Helpful Teacher Who Shared Too Much
Invented example: a researcher asks a teacher for prior test scores to match interview participants with attainment bands. The teacher emails a spreadsheet containing names, addresses, parent contacts and medical notes because those columns already exist in the export.
The research question needed only a pseudonymous identifier and test score. The failure occurred before encryption: unnecessary data were disclosed. A controlled data request and steward-generated extract would have prevented the exposure.
Case Study: The Consent Form Students Could Not Refuse
Invented example: a teacher distributes research forms during class and tells students to return them before they can leave. Every student signs. The response rate looks excellent.
The governance review identifies a power problem: the logistics made participation feel compulsory. The repair separates recruitment from ordinary classroom authority, gives time to consider, and makes non-participation operationally invisible to grading and discipline.
Case Study: The Anonymous Dataset That Was Not
Invented example: names are removed from a dataset, but school, year level, rare disability category and exact age remain. Only one learner in the district matches the combination.
The output is not safely anonymous merely because the name field disappeared. The team aggregates age, suppresses rare cells and moves detailed analysis into a secure environment.
Case Study: The Research Partnership That Extracted and Left
Invented example: schools provide interviews, lesson access and data for two years. The university publishes several papers but gives schools no findings, no instruments and no explanation of what changed.
A revised partnership agreement includes a dissemination plan, reusable non-sensitive tools and scheduled feedback sessions. Reciprocity does not mean schools control the findings; it means participation has a visible return path.
Failure Mode 1: Treat School Permission as Participant Consent
Repair: separate institutional gatekeeping from individual consent and assent.
Failure Mode 2: Collect Every Available Variable
Repair: map each field to a research purpose and exclude information that does not change the analysis.
Failure Mode 3: Call Coded Data Anonymous
Repair: describe identifiers, keys and re-identification risk accurately.
Failure Mode 4: Let Researchers Into the Live Administrative System
Repair: use stewarded extracts, de-identified databases or secure research environments appropriate to the risk.
Failure Mode 5: Ignore Power Relationships
Repair: design recruitment and refusal so students and staff can genuinely decline without educational consequence.
Failure Mode 6: Promise Absolute Confidentiality
Repair: explain safeguarding and lawful disclosure limits before participation.
Failure Mode 7: Publish Detailed Small-Cell Tables
Repair: perform disclosure review at output, not only at data intake.
Failure Mode 8: Equate Open Science With Open Personal Data
Repair: open methods, code and safe outputs while using justified controlled access for sensitive records.
Failure Mode 9: Keep Access After the Project Ends
Repair: revoke credentials and reconcile data copies at formal closure.
Failure Mode 10: Take Data Without Returning Knowledge
Repair: plan responsible dissemination to participants and institutions without compromising research independence.
The Education Research Governance Operating Chain
- Define the research question and decision value.
- Identify the population and setting.
- Map participant and institutional risks.
- Identify applicable ethics, safeguarding, privacy and legal requirements.
- Define the minimum data needed.
- Prepare the protocol and data-management plan.
- Define recruitment and refusal routes.
- Prepare age- and language-appropriate information.
- Define consent and assent requirements.
- Seek institutional gatekeeper permission.
- Obtain ethics approval where required.
- Approve administrative-data access separately where needed.
- Define identifiers and de-identification strategy.
- Define linkage roles and keys.
- Set the secure analysis environment.
- Authorise named researchers.
- Log data receipt and access.
- Recruit participants.
- Collect ongoing consent or assent as appropriate.
- Apply safeguarding escalation if triggered.
- Version source data and transformations.
- Conduct analysis under the approved scope.
- Document deviations from the original plan.
- Review outputs for disclosure risk.
- Publish methods, limitations and conflicts transparently.
- Share safe outputs, code or metadata where appropriate.
- Return findings to participating institutions in an appropriate form.
- Revoke access at project end.
- Destroy, de-identify or archive data according to approval and consent.
- Record closure and continuing obligations.
A Research Governance Dashboard
- protocol version;
- ethics approval status;
- site permissions;
- data-access agreements;
- approved researchers;
- consent and assent model;
- safeguarding route tested;
- fields requested versus approved;
- identifiers retained;
- linkage owner;
- secure environment status;
- access-log exceptions;
- project deviations;
- withdrawals;
- adverse events;
- disclosure checks completed;
- outputs published;
- school or participant dissemination completed;
- data destruction or archive confirmed;
- access revoked;
- project closure date.
Canonical Owner Boundaries
- Educational Research owns research methods, designs, inference and evidence quality broadly.
- Education Data Privacy & Student Records Governance owns operational privacy, record access and student-data governance.
- Education Records Retention, Disposition & Archival Continuity owns the institutional record lifecycle.
- Education Statistics Quality Assurance & Data Validation owns the quality controls on official education statistics.
This node owns governance of research access: ethics review, participant authority, school gatekeeping, secondary-data access, linkage controls, secure research environments, disclosure review, responsible dissemination and project closure.
The Return Path
Return to a researcher standing outside a classroom with an excellent question.
The question may genuinely improve education. The school may want the answer. The dataset may already exist. None of those facts make the route automatic.
The legitimacy of education research comes partly from what it discovers and partly from how it treats the people whose lives made discovery possible.
A mature system does not choose between useful evidence and participant protection. It designs the research architecture so that the search for knowledge is itself worthy of trust.
Education becomes more researchable when access is governed well, because trust is an input to evidence, not an obstacle to it.
Return to the How Education Works hub.