{"slug":"qualitative-data-sharing-gdpr-2026","title":"Qualitative Data Sharing: GDPR & Archiving Guide 2026","description":"How to share and archive qualitative interview data under GDPR in 2026: reuse consent, pseudonymization, the EDPB's new anonymisation tests and a DMP matrix.","keywords":"qualitative data sharing, archiving interview data, GDPR qualitative research, anonymising interview transcripts, pseudonymisation, data management plan qualitative, EDPB anonymisation guidelines 2026, broad consent research","date":"2026-10-12","author":"Qualitati Research Team","category":"Research Operations","readTime":"10 min read","content":"<div class=\"short-answer\"><p><strong>Short answer:</strong> You can share qualitative interview data, but rarely as an open download. Plan it before the first interview. Get consent for reuse as well as for participation, pseudonymize as you transcribe, test whether a transcript could still single someone out, and deposit it under controlled access. If the data cannot be shared safely, share the interview guide, codebook and metadata instead.</p></div>\n\n<p>Funders and journals increasingly expect qualitative data sharing, but interview transcripts are among the hardest research data to release safely. Each one is a long, detailed account of one person's life. 2026 has also changed the European rules. The European Data Protection Board (EDPB) released draft guidelines on scientific research in April and draft guidelines on anonymisation in July. This guide explains what those documents mean in practice for PhD students, research labs and research firms planning to archive or share interview data, and gives you a decision matrix to use in your data management plan.</p>\n\n<p><em>This article is methodological guidance, not legal advice. Confirm decisions with your data protection officer, ethics committee and target repository.</em></p>\n\n<h2>Key takeaways</h2>\n<ul>\n<li><strong>Sharing is decided at consent, not at deposit.</strong> If participants were not told their data might be reused, you usually cannot add that permission afterward.</li>\n<li><strong>Pseudonymized transcripts are still personal data.</strong> Only data that passes an anonymity test falls outside the GDPR.</li>\n<li><strong>The EDPB's July 2026 draft anonymisation framework</strong> uses three criteria: no record isolation, no linkage and no inference. Rich, record-level text such as an interview transcript is hard to pass on all three.</li>\n<li><strong>Controlled access is the normal route</strong> for qualitative data. Open download is the exception.</li>\n<li><strong>When the data cannot travel, the materials still can.</strong> Interview guides, codebooks and de-identified metadata support transparency without exposing participants.</li>\n</ul>\n\n<h2>What changed in 2026?</h2>\n<p>Two EDPB documents now shape how European researchers should think about qualitative data sharing. Both were still drafts as of October 12, 2026.</p>\n\n<h3>Guidelines 1/2026 on scientific research (April 2026)</h3>\n<p>On April 16, 2026, the <a href=\"https://www.edpb.europa.eu/news/news/2026/edpb-brings-clarity-data-processing-scientific-research-speeds-finalisation_en\" target=\"_blank\" rel=\"noopener noreferrer\">EDPB announced</a> draft guidelines on processing personal data for scientific research. They list six indicative factors for what counts as scientific research, including a systematic approach, ethical standards, and verifiability and transparency. They also state that further processing for research is presumed compatible with the original purpose. They accept \"broad consent\" where research purposes cannot be fully specified at collection, provided safeguards compensate, and they also allow \"dynamic consent\", where participants agree to each project as its purpose becomes clear. The <a href=\"https://www.edpb.europa.eu/public-consultations/guidelines-12026-on-processing-of-personal-data-for-scientific-research_en\" target=\"_blank\" rel=\"noopener noreferrer\">public consultation</a> ran until June 25, 2026. We could not find a final version as of October 12, 2026.</p>\n\n<h3>Guidelines 02/2026 on anonymisation (July 2026)</h3>\n<p>The EDPB adopted <a href=\"https://www.edpb.europa.eu/system/files/2026-09/edpb_guidelines_202602_anonymisation_v1_en_0.pdf\" target=\"_blank\" rel=\"noopener noreferrer\">draft Guidelines 02/2026 on Anonymisation</a> on July 7, 2026, for public consultation. According to a <a href=\"https://datamatters.sidley.com/2026/07/27/edpb-publishes-draft-guidelines-on-anonymisation/\" target=\"_blank\" rel=\"noopener noreferrer\">Sidley Austin summary</a>, the consultation closes on October 30, 2026, and the draft is intended to replace the 2014 Article 29 Working Party opinion on anonymisation techniques. The draft says anonymity must be assessed from the perspective of each party that will receive the data, using \"means reasonably likely to be used\". It proposes three tests:</p>\n<ul>\n<li><strong>No record isolation:</strong> nobody can pick out one person's record.</li>\n<li><strong>No linkage:</strong> the record cannot be connected to other data about that person.</li>\n<li><strong>No inference:</strong> nobody can deduce new facts about an identifiable person.</li>\n</ul>\n<p>The draft notes that re-identification is generally more likely to succeed against record-level data with high dimensionality and high resolution. That is our reading of why interview transcripts are hard to anonymize. A single transcript can contain a job title, a town, a family situation and a rare event, and together they may point to one person even after the names are gone.</p>\n\n<h2>Is a pseudonymized transcript anonymous?</h2>\n<p>No. Replacing names with codes while you keep a key file is pseudonymization, and pseudonymized data remains personal data under the GDPR. <a href=\"https://gdpr-info.eu/art-89-gdpr/\" target=\"_blank\" rel=\"noopener noreferrer\">Article 89 GDPR</a> names pseudonymization as one of the safeguards for research processing. It is a safeguard, not an exit from the regulation. A transcript leaves the GDPR's scope only if it passes an anonymity assessment from the perspective of the people who will receive it.</p>\n<p>Many qualitative studies cannot pass that test without stripping out the context that made the data worth collecting. That is the core tension in qualitative data sharing, and it is why the usual answer is controlled access rather than open release.</p>\n\n<h2>How to plan qualitative data sharing: a five-step workflow</h2>\n<p>The <a href=\"https://ukdataservice.ac.uk/learning-hub/research-data-management/anonymisation/anonymising-qualitative-data/\" target=\"_blank\" rel=\"noopener noreferrer\">UK Data Service</a> warns that anonymisation should not be a single step left to the end of a project. It recommends combining three elements: transparency with participants, technical protection such as pseudonymization, and governance through access controls. One element does not replace another. The workflow below puts that advice in order.</p>\n<ol>\n<li><strong>At design:</strong> pick the target repository and its access tiers, and write the sharing plan into your data management plan. Horizon Europe projects work under the principle \"as open as possible, as closed as necessary\".</li>\n<li><strong>At consent:</strong> offer separate choices for participating, being quoted, archiving the anonymized transcript and archiving the audio. Record which option each person chose. See our guide to <a href=\"/blog/what-is-informed-consent-ai-moderated-research-2026\">informed consent in AI-moderated research</a>.</li>\n<li><strong>At transcription:</strong> apply a written pseudonymization scheme as transcripts are created, for example [City A] or [Employer 2]. Store the key file separately. Our <a href=\"/blog/anonymize-interview-transcripts-local-llm-2026\">guide to anonymizing transcripts with local LLMs</a> covers tool-assisted options.</li>\n<li><strong>Before deposit:</strong> run the three EDPB tests on a sample of transcripts, from the point of view of a realistic secondary user. Generalize or remove details that fail. Read <a href=\"/blog/can-ai-reidentify-anonymized-interview-data-2026\">whether AI can re-identify anonymized interview data</a> before you assume the risk is small.</li>\n<li><strong>At deposit:</strong> choose the access tier, attach documentation (interview guide, codebook, consent wording, data dictionary), and publish a de-identified metadata record so the dataset is findable even when access is restricted.</li>\n</ol>\n\n<h2>The Qualitative Data Sharing Readiness Matrix</h2>\n<p>This matrix is an original Qualitati planning tool. Use it in your data management plan to match each data type to a realistic sharing route. It is a starting point for a discussion with your repository and data protection officer, not a compliance ruling.</p>\n<table>\n<thead>\n<tr><th>Data and context</th><th>Typical re-identification risk</th><th>Suggested route</th><th>What to share at minimum</th></tr>\n</thead>\n<tbody>\n<tr><td>Short, low-detail transcripts on a non-sensitive topic, consent for reuse obtained</td><td>Low to moderate</td><td>Safeguarded access (registered users, end-user licence)</td><td>Pseudonymized transcripts, codebook, interview guide</td></tr>\n<tr><td>In-depth interviews with rich life-history detail</td><td>High</td><td>Controlled access with an application and approval</td><td>Generalized transcripts, data dictionary, metadata</td></tr>\n<tr><td>Small or easily recognizable population (one organization, rare condition, elite interviewees)</td><td>Very high</td><td>Controlled access or secure environment, often embargoed</td><td>Metadata, interview guide, codebook, aggregate theme tables</td></tr>\n<tr><td>Raw audio or video recordings</td><td>Very high (voice and face are identifiers)</td><td>Share only with explicit consent, under controlled access</td><td>Transcripts instead of recordings</td></tr>\n<tr><td>No consent for reuse, or sensitive data from vulnerable participants</td><td>Not shareable</td><td>Do not deposit the data</td><td>Metadata, interview guide, codebook, analysis audit trail</td></tr>\n</tbody>\n</table>\n\n<h3>Consent clause checklist</h3>\n<ul>\n<li>States that anonymized or pseudonymized data may be archived and reused by other researchers.</li>\n<li>Names the type of repository and the access conditions, such as registered researchers only.</li>\n<li>Separates quotation, transcript archiving and audio archiving into distinct options.</li>\n<li>Explains how long a participant can withdraw, and that removal from an archived dataset may not be possible after a stated point.</li>\n<li>Says whether broad consent for future research is requested, with the safeguards that apply.</li>\n</ul>\n\n<h2>Who this is for, and when not to share</h2>\n<p><strong>Who this is for:</strong> doctoral researchers writing a data management plan, principal investigators on EU-funded or UK-funded projects, and research firms whose clients ask about data retention and reuse.</p>\n<p><strong>When not to share:</strong> skip data deposit when consent did not cover reuse, when participants are few enough to recognize one another, or when anonymization would remove the meaning the data was collected for. Commercial studies under client confidentiality usually fall into this group too. In those cases, share the research materials and the <a href=\"/blog/audit-trail-ai-qualitative-analysis-2026\">analysis audit trail</a> instead.</p>\n\n<h2>Where Qualitati fits</h2>\n<p>Qualitati is a European qualitative research platform for universities and research firms. It runs AI-moderated interviews, focus groups and conversational surveys, and it codes the results with ThemeLens and the QDA Workspace. Several of its features are relevant to qualitative data sharing:</p>\n<ul>\n<li><strong>Transcripts exist from the first minute.</strong> Text and voice interviews produce transcripts during collection, so your pseudonymization scheme can be applied before analysis starts, as the UK Data Service recommends.</li>\n<li><strong>EU data storage.</strong> Research data is stored in the EU, and an optional EU data-region setting keeps AI processing on EU-resident inference.</li>\n<li><strong>Shareable analysis materials.</strong> Codebooks and themes from the QDA Workspace and ThemeLens can go into a repository even when the transcripts cannot. See our <a href=\"/blog/qualitative-codebook-template-2026\">qualitative codebook template</a>.</li>\n<li><strong>Participant IDs in exports.</strong> CSV exports include a participant ID column, so each transcript can be linked to a pseudonym key that you keep yourself.</li>\n</ul>\n<p>Qualitati does not decide whether your data is anonymous or whether your consent covers reuse. Those remain the researcher's judgment, made with the ethics committee and the data protection officer.</p>\n\n<h2>Limitations and trade-offs</h2>\n<ul>\n<li><strong>Both EDPB documents are drafts.</strong> Their wording may change after consultation. Recheck before you finalize a plan that depends on them.</li>\n<li><strong>National rules differ.</strong> Member states may set additional research exemptions and safeguards, and the UK applies UK GDPR with its own regulator's guidance.</li>\n<li><strong>Anonymization costs analytical value.</strong> Each generalized detail removes context that a secondary analyst might need. Document what you changed.</li>\n<li><strong>Reuse has epistemological limits.</strong> Qualitative data is co-produced in a specific interview relationship. Secondary analysts lose that context, so documentation matters as much as access.</li>\n</ul>\n\n<h2>FAQ</h2>\n<h3>Can I share interview transcripts under the GDPR?</h3>\n<p>Yes, if you have a lawful basis, participants were informed about reuse, and you apply safeguards such as pseudonymization and controlled access. Transcripts that pass an anonymity assessment fall outside the GDPR, but many detailed qualitative transcripts cannot pass one.</p>\n<h3>Is pseudonymized interview data still personal data?</h3>\n<p>Yes. While anyone can link the codes back to people, for example through a key file, the data remains personal data. Pseudonymization reduces risk and is listed as a research safeguard in Article 89 GDPR.</p>\n<h3>What are the EDPB's three anonymisation criteria?</h3>\n<p>The July 2026 draft Guidelines 02/2026 propose no record isolation, no linkage and no inference, assessed from the perspective of each party that will receive the data, using means reasonably likely to be used.</p>\n<h3>Can I archive data if consent did not mention reuse?</h3>\n<p>Usually not. Seek advice from your data protection officer and ethics committee. The safer option is to share metadata, the interview guide and the codebook rather than the data itself.</p>\n<h3>What is broad consent in qualitative research?</h3>\n<p>Broad consent covers future research whose exact purposes are unknown at collection. The EDPB's 2026 draft research guidelines accept it when ethical standards and additional safeguards compensate for the less specific purpose.</p>\n\n<h2>Bottom line</h2>\n<p>Qualitative data sharing works when it is designed in from the start: granular consent, pseudonymization during transcription, an honest anonymity test against the EDPB's three criteria, and controlled access by default. If the data cannot be shared safely, sharing the materials still makes your study more transparent. <a href=\"/register\">Start free with 30 monthly credits</a> to run your next interview study on an EU-based platform, or <a href=\"/pricing\">view transparent pricing</a>. For broader planning, see <a href=\"/blog/how-to-write-user-research-plan-2026\">how to write a research plan</a>.</p>\n\n<p><strong>Sources:</strong> <a href=\"https://www.edpb.europa.eu/news/news/2026/edpb-brings-clarity-data-processing-scientific-research-speeds-finalisation_en\" target=\"_blank\" rel=\"noopener noreferrer\">EDPB press release, April 16, 2026</a>; <a href=\"https://www.edpb.europa.eu/system/files/2026-09/edpb_guidelines_202602_anonymisation_v1_en_0.pdf\" target=\"_blank\" rel=\"noopener noreferrer\">EDPB Guidelines 02/2026 on Anonymisation (draft)</a>; <a href=\"https://gdpr-info.eu/art-89-gdpr/\" target=\"_blank\" rel=\"noopener noreferrer\">Article 89 GDPR</a>; <a href=\"https://ukdataservice.ac.uk/learning-hub/research-data-management/anonymisation/anonymising-qualitative-data/\" target=\"_blank\" rel=\"noopener noreferrer\">UK Data Service</a>; <a href=\"https://dmeg.cessda.eu/Data-Management-Expert-Guide\" target=\"_blank\" rel=\"noopener noreferrer\">CESSDA Data Management Expert Guide</a>.</p>\n\n<p><em>Last updated: October 12, 2026. This article is general methodological guidance, not legal advice. A human editor should review jurisdiction-specific claims before reuse.</em></p>\n","related":[{"slug":"how-to-write-research-readout-2026","title":"How to Write a Research Readout Stakeholders Act On","description":"A 2026 guide to research readouts: the evidence chain from finding to decision ask, a readiness checklist, format-by-decision matrix, and where AI helps.","category":"Research Operations","date":"2026-09-20","readTime":"10 min read","author":"Qualitati Research Team"},{"slug":"ux-research-capacity-gap-2026","title":"The 2026 UX Research Capacity Gap","description":"Research demand hit 66% in 2026 while support stayed flat. A triage matrix for routing requests between AI, self-serve studies, and researcher-led work.","category":"Research Operations","date":"2026-09-06","readTime":"9 min read","author":"Qualitati Research Team"},{"slug":"screening-fraudulent-participants-ai-interviews-2026","title":"Fraud Detection in AI-Moderated Interviews (2026)","description":"Can AI-moderated interviews detect fraudulent participants? The tools, quality signals and consent rules that apply in 2026, plus a three-layer fraud screen.","category":"Research Operations","date":"2026-09-05","readTime":"8 min read","author":"Qualitati Research Team"}]}