5.3 Research integrity, data protection and research permit

Avoid causing harm and risks to people, activities, the organization, nature, the environment, and animals.

• Be especially careful when studying children under 15 years of age, people with disabilities (small children, the elderly, people with intellectual disabilities) or other vulnerable subjects (including animals, depending on the setting).
• Avoid designs that interfere with physical integrity (e.g., measurements) → see ethical review.
• Harm can be physical, psychological, financial, etc., including disclosure of confidential information, breaches of privacy, or undue burden. Harm may be direct or indirect.

Avoid conflicts of interest:

• Do not, as a rule, study your close relations: never family, and only with strong justification friends, fellow students, a small work community, or other close community. Ensure that closeness does not bias the research.
• Close relationships may weaken data reliability and participants’ freedom to refuse.
• Your work role (manager, developer, employee, trustee, etc.) may also influence interpretations.

Examples of problematic settings:

• Interviewing your fellow students or colleagues about wellbeing (may reveal sensitive health data)
• Studying leadership in your small work community without accounting for your role and prior knowledge
• Studying a family member’s experiences of a service, support, or treatment
• Possible if you use a genuinely anonymous survey, the target group is large enough, you avoid personal data and sensitive themes, and you study the phenomenon at a general level.

Remember: work role / community member / student / close relation ≠ researcher role.

• Access to data in another role does not entitle you to use it for research.
• All research use requires permissions, consents, and data protection practices, even if you do not need them in your other role.
• Research on leadership, organizations, and technology often involves human participants → follow ethical principles of research with human participants (TENK).
• Could any information reveal identity directly or indirectly? Do my background and assumptions affect interpretation?

• According to TENK guidance, ethical review must be requested for certain demanding research designs from Jamk’s ethics committee. Check the relevant designs: Ethics committee and ethical review.
• At the thesis level, the research design must not be one that requires ethical review (research involving humans, or nature and the environment) because these are ethically more challenging than usual. Otherwise, the design must be changed.
• Only a Master’s thesis may be part of research/projects that require ethical review. In such cases, the responsible researcher or project manager primarily applies for the statement, and the thesis supervisor is always aware of the application.
• If required, an approved ethical review statement must have been issued before starting; otherwise, the thesis must be suspended and redesigned.

• Confirm with the target organization whether a research permit (or equivalent) is required and how to apply. Apply to the organization the research concerns. Some organizations do not require a separate permit.
• If the thesis is part of a project or other research, first discuss permits with those responsible: is a separate permit needed or do existing permits cover the thesis activities? A research permit may be required if the organization itself is studied or register/archive data are needed.
• Public organizations (e.g., wellbeing services counties) are often strict about permits and application quality.
• If a research permit is required, it must be approved before data collection.

Note: Applying for and receiving permits/statements takes time and must be scheduled. For example, Jamk’s research permit takes about two weeks, considering holiday periods.

• Processing personal data is governed by legislation and cannot be bypassed.
• Have all personal data been identified? Any information that can identify a person directly or indirectly is personal data, including voice, images, or combinations of data. Open-ended survey/interview answers may constitute personal data, especially with small sample sizes or background variables.
• Whenever you process personal data, you must prepare a privacy notice, request consent, store data appropriately, and delete it when the legal basis ends.
• As a student, you must not collect personal data that (directly or indirectly) include special categories of personal data. Doing so would require storage outside Jamk systems (e.g., CSC SD-services) and particularly careful information and data management.
  • Sensitive health data may arise when asking about wellbeing/work ability or when the topic relates to diagnosis, via open-ended answers (+ background data) or interviews.
• Confidential information includes trade secrets.
  Note: A sensitive topic can be a thesis theme if the thesis does not process special categories of personal data or trade secrets; choose data collection and design so that (special categories of) personal data are not formed.
  Be especially careful when AI is involved: as a rule, thesis‑related personal data must not be disclosed to AI tools.

• Jamk’s thesis data management plan template is highly guiding and based on ready-made answer options.
• The template includes many other ethical considerations and steers you toward appropriate practices.
• As a rule, store data only using the options listed in Jamk guidance to ensure information security and long-term preservation. Do not use personal storage during the thesis process (e.g., a personal cloud account or your own computer storage).
• Ensure that data – including personal data – are stored or disposed of appropriately at the end.
• The privacy notice, participant information sheets, and data management plan must not contradict each other.
• Read the instructions: 5.2 Data management plan and processing

• Before consent, inform participants clearly and in language suitable for the target group: how and why the study will be conducted, the roles of participant and researcher, possible risks, and how risks are avoided.
• Always request consent from participants to take part in the study/thesis.
• Consent must be obtained before interviews, at the start of an online survey, before observation, or before collecting samples. A thesis should not involve research where consent cannot be requested.
• It is not enough to have permission from the background organization (research permit or other consent); you need the participant’s active consent.
• Consent to participate and consent to process personal data are different, but they can be collected in the same document as separate sections.
• Written consent is recommended (paper or electronic form).
• If you as the thesis author have too close a relationship with the participant, it may affect the participant’s freedom to refuse.
• Jamk’s research subject consent form template, including the option to ask for consent to the processing of personal data, is available for download from this page. Modify it as needed, taking into account the target group and the method of implementation of your thesis.

• The same ethical principles and responsible conduct of research (RCR) apply to AI use as to other activities.
• Describe AI use in its different forms transparently; identify its impact on data (collection, classification, etc.) and analysis. Understand how tools work (where data are stored, whether used for model training, personal data processing) and inform participants insofar as it is relevant.
• As a student, you should primarily use Jamk’s approved AI tools while signed in.
• Do not input unfinished thesis content into open language models (e.g., for summarizing or commenting), as this may leak work online.
• Binding guidance: The use of AI in research: RCR and ethical principles (TENK 2026).
• Jamk guidance: Ethical use of AI – Responsible AI use at Jamk.

• Jamk Ethical Principles describe forms of misconduct and disregard and how they are handled.
• Typical forms: plagiarism (presenting others’ content as your own), self-plagiarism, presenting AI-generated content as your own, falsification of observations/results, fabrication or distortion of data (including generating data with AI).
• If serious misconduct/disregard is suspected, a report is made. If confirmed, the student may receive a rector’s warning and the thesis must be redone partly or entirely. In particularly serious, repeated cases, a student may be dismissed for a fixed period. The duration of the suspension is always at least one semester, but no more than one year. This may affect, for example, student financial aid and residence permit.

• Read the instructions: 3 Commissioner and thesis topic

• A thesis is a work whose copyright belongs to you as a student.
• Authorship requires a substantial contribution to ideation and planning, data collection, or analysis and interpretation (including separate publications based on the thesis).
• Authorship of the thesis must always remain with the student. Excessive or inappropriate use of AI may mean that authorship is no longer created, which is unacceptable and may lead to suspicion of misconduct or disregard.
• Agree on the partner organization’s usage rights in the thesis agreement. When publishing thesis results, the partner should state that they were produced in a thesis project and credit the student and supervisors as good practice requires.
• If thesis results are published in another format (e.g., an article), agree on authorship/writing credits in advance (based on TENK guidance on authorship in scholarly publications).

• All of the thesis cannot be confidential. However, a thesis may contain some confidential information (e.g., the commissioner’s trade secrets). Typically, the results (or part of the results) are confidential. The confidential sections are placed in the appendices of the thesis. There must be a legal basis for the confidentiality of the appendices; inform partners as needed.
• Instructions: 1.5 Publicity and copyrights of the thesis

• Relevant conflicts of interests include employment with the organization under study, funding (e.g., project funding) or grants with an interest in the topic, shareholdings/ownership in a company, close relationships (family/friends) with people involved in the work, positions of trust (e.g., board membership, expert group membership), and other interests that may influence perspectives.
• You do not need to separately report a customary fee received from the thesis commissioner.

Please note the following if your thesis collects material via social media or, for example, a survey or interview invitation is forwarded on social media:

Summary of key risks and how to avoid them

• Terms of service violations and information security → legal consequences, data leakage → Review platform terms. If sharing invitations on an organization’s social media, request permission, provide sufficient information, and do not target children or vulnerable groups. Data must be stored in Jamk‑approved systems; do not use platform survey tools.
• Processing personal data without a legal basis/consent when data originate from social media → privacy breaches → Identify direct and indirect personal data; as a rule, avoid collecting personal data from social media. If collecting personal data, ensure consent can be requested and prepare a privacy notice. Avoid direct quotations from social media discussions.
• Using minors’ content → high ethical risk. For commenters/content creators under 15, inform guardians and ensure guardian consent → Avoid using minors’ social media content in a thesis.
• Copyright infringement → restricts publishing → Recognize that uploaded images/text/videos may be copyrighted → Respect copyright, cite original sources, and quote copyrighted material appropriately. Do not quote or use content from private individuals’ accounts.
• Causing harm to participants or to the thesis author → e.g., sensitive topics, privacy breaches, online hate speech exposure → Identify realistic risks and mitigation; define how to act if risks materialize. Narrow the topic and implementation to reduce risk.
• Lack of ethical review when the approved topic would require it → thesis not accepted/published → Choose a design that does not require ethical review according to Jamk’s guidelines.
• Based on University of Jyväskylä guidance: Ethical challenges of studying closed social media groups are likely too extensive for UAS or Master’s thesis data.

Eilo, H., Falin, P., Harju, A., Huuskonen, S., Kohonen, I., Laine, K., & Satama, M. (2026). Näkökulmia sosiaalisen median eettiseen ja vastuulliseen tutkimukseen. Zenodo. https://doi.org/10.5281/zenodo.18386110