Consent Requirements for Recording Research Interviews in the UK

If you’re recording a research interview in the UK, you have to meet two separate requirements that are easy to confuse.

First, you need a lawful basis under UK GDPR to process the personal data in the recording. For university research, that’s usually "public task" under Article 6(1)(e) rather than participant consent. Second, you need informed ethical consent from your participants, granted through your institution's ethics committee process.

Both are mandatory, and they do different jobs. One makes your data processing lawful, while the other respects participants' autonomy and satisfies your research ethics obligations.

That distinction is central to UK consent requirements for recording research interviews, and getting it wrong is one of the most common mistakes I see researchers make.

Throughout this guide, I'll keep the two ideas apart because UK recording law, UK GDPR, and your ethics committee each ask something different of you.

GDPR lawful basis and ethical consent are NOT the same thing

The ICO is direct about this. It states that consent to take part in a research study is distinct from consent as a UK GDPR lawful basis to process personal data, and that you shouldn't treat one as the other.

When your ethics committee asks for consent, it means ethical consent: a participant's informed permission to take part and be recorded. When UK GDPR talks about consent, it means a specific lawful ground under Article 6(1)(a) with strict conditions attached.

The difference has teeth. UK GDPR consent can be withdrawn at any time, and there's no research exemption from that rule. If a participant withdraws consent, you have to stop processing their data or anonymise it. For a study that depends on retaining and analysing recordings, you see how that can be a serious problem.

This is why UK universities, as public authorities, rely on "public task" under Article 6(1)(e). For example, the University of Bristol advises researchers that relying on consent under Article 6 is neither necessary nor advised, and confirms its research activity is covered by public task.

So, ethical consent governs whether you may record a person, while your lawful basis governs whether you may process the recording later. What the law lets you record in the first place is a separate question, and that's where UK recording law comes in.

What the UK recording law actually says

I’ve come across researchers who think the recording law is a hurdle. In the UK, it usually isn't. Three things set the boundaries, and none of them is the constraint you might expect:

• The Investigatory Powers Act 2016: This is the current framework for the interception of communications, having replaced the older RIPA 2000. It applies mainly to telecom providers and public authorities intercepting communications in transit, not to someone recording a conversation they're part of. The UK doesn't have a general "two-party consent" rule like some other countries
• The Lawful Business Practice Regulations 2000: Made under the older RIPA framework, these let businesses record calls for specific purposes such as quality assurance or training, provided they make reasonable efforts to notify the people involved
• The domestic-purposes exemption: It keeps purely personal recordings outside of UK GDPR, but it won't help you here. The moment you record an interview for a study and process it, you're acting as a researcher rather than a private individual, so data protection law applies in full

So that’s the takeaway: UK recording law is not your real constraint, but UK GDPR and your ethics committee are. Recording an interview being "legal" doesn't mean you can skip the data protection basis or the ethics approval, and treating the two as interchangeable is how researchers land in trouble.

UK GDPR requirements for recording research interviews

Once recording itself is lawful, UK GDPR is where the real work happens. In layman’s terms, here’s what applies when you record and process an interview for research:

Lawful basis (Article 6)

Every processing activity needs a lawful basis under Article 6, but there's no basis labelled "research." The ICO's position is that the right basis depends on what kind of organisation you are.

A university or NHS body, as a public authority, will most likely rely on public task under Article 6(1)(e), while a commercial or charity researcher is more likely to rely on legitimate interests under Article 6(1)(f).

Consent is a bit murky here, which is why most institutional researchers don't use it.

Special category data (Article 9)

Interviews often capture special category data: health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, and similar. If your interviews touch any of it, you need both an Article 6 basis and a separate Article 9 condition.

For research, that condition is Article 9(2)(j), with further requirements added by Schedule 1 of the DPA 2018.

Research safeguards (Chapter 8A)

The Data (Use and Access) Act 2025 replaced the old Article 89 safeguards with a new Chapter 8A (Articles 84A to 84D), which came into force on 5 February 2026.

The substance is unchanged: you need technical and organisational measures such as data minimisation, your processing mustn't be likely to cause substantial damage or distress, and it mustn't be used for decisions about the individual participants.

If you find guidance citing Article 89, it's describing the previous home of the same rules.

Research exemptions from certain participant rights

When your safeguards are in place, the DPA 2018 and UK GDPR provide research exemptions from most participant rights: being informed, access, rectification, erasure, restriction, portability, and objection.

The most relevant one for interview research is erasure. If a participant withdraws and asks you to delete their data, Article 17(3)(d) lets you refuse to the extent that erasing it would seriously impair the research. This is the practical payoff of relying on public task rather than consent. Had consent been your basis, withdrawing it would force you to stop regardless, so the exemption would do you no good.

But none of this is automatic. Each exemption applies only where complying would seriously impair your research, and it’s judged on a case-by-case basis. You also have to tell the person why you're refusing.

Data Protection Impact Assessment (DPIA)

A DPIA is required when processing is likely to be high-risk, and recording sensitive interviews makes a high-risk finding more likely. Most university ethics and data protection teams expect one for interview research, and your institution will have a template. Complete it before you start recording.

Participant information sheet

The participant information sheet (PIS) is all about your transparency obligations. It tells participants who you are, what you're recording, your lawful basis, how long you'll keep the data, who can access it, and what happens to the recording if they withdraw. The PIS informs, and the consent form records agreement.

Ethics committee requirements for recording and transcription

Your ethics committee approves the recording before it happens, so the detail you give them is what they assess. If you send them a vague application, it gets sent back.

Here's what a recording-related ethics application normally needs to cover:

• Why you're recording: A short justification for why audio or video capture is necessary, rather than notes
• What you'll capture: Audio, video, or both, and the platform or device you'll use, whether that's institutional Zoom or Teams, a personal mobile or Android device, or a dedicated recorder
• Whether it's optional: State if participants can take part without being recorded, or if recording is a condition of participation
• The consent process: Your consent form and participant information sheet, including a separate point of consent for recording
• Your data management plan: The storage, access, retention, and destruction details the committee expects to see written down, similar to GDPR safeguards
• De-identification: At what stage you pseudonymise or anonymise, and who holds the key
• Transcription method: How recordings become text, and whether anyone outside the research team is involved

Disclosing a third-party transcription service

If you use an external transcription tool for research, your ethics application and PIS need to mention that with specifics.

Name the service, say where the data is processed and stored, confirm whether a data processing agreement is in place, and state the service's retention and deletion terms. If the tool uses AI, declare whether your audio is used to train its models.

What the consent form needs

The consent form is where recording consent becomes explicit. It should include a separate checkbox or signature line for recording, so agreeing to take part and agreeing to be recorded are distinct choices.

The form should also state the right to take part without being recorded, the right to withdraw, and how recordings are handled afterward.

Recording and transcribing research interviews with HappyScribe

Everything we discussed so far becomes easier to declare when your transcription provider gives you the documentation to back it up. This is where you’d find HappyScribe useful. It’s built with the kind of compliance an ethics committee wants to see described.

You still have to disclose who processes the data, where, and on what terms. But a provider that publishes its security credentials and lets you control how your data is used, turns that disclosure into concrete paragraphs in your application.

ISO 27001-compliant EU data centre

HappyScribe processes and stores data in a Tier IV, PCI DSS, and ISO 27001 compliant EU data centre, which helps with the data-residency questions UK and EU ethics reviewers tend to ask.

Worth noting for full accuracy: its privacy policy allows for trusted subprocessors that may sit outside the EEA, under the appropriate GDPR transfer safeguards. Name the provider and its location in your application, and you've covered the question.

SOC 2 Type II-certified platform

HappyScribe is SOC 2 Type II-certified, with data encrypted in transit and at rest. For an ethics reviewer, these are the recognised credentials that confirm that a platform’s everyday services are indeed secure. The details sit on the security page that you can cite.

You control whether your data trains AI models

This is the point most reviewers care about. With HappyScribe, using your data to train AI models is optional and switched on only if you choose it. You can opt out at any time without affecting transcription accuracy, and Enterprise organisations are opted out by default.

That lets you state plainly in your PIS that participant recordings won't be used for model training.

Acts as your data processor

For the files you upload, HappyScribe acts as a data processor under UK GDPR, with the processing terms set out in its privacy policy. If your institution needs a separate data processing agreement (DPA) for the ethics file, you can request one through HappyScribe's data protection contact.

Accuracy built for the research workflow

Transcript quality is a research-integrity issue because errors in a transcript become errors in your analysis. HappyScribe's AI reaches up to 95% accuracy on typical interview audio and higher on clear single-speaker recordings. The human-verified transcription service, on the other hand, reaches 99% in 65+ languages, proofread by professional linguists and returned within 24 hours.

For multi-market research studies, it covers 150+ languages with a project manager coordinating turnaround, and transcripts come formatted for qualitative coding with an AI Chat feature to search themes across your whole interview library.

Record research interviews in the UK without the compliance headache

Recording a research interview in the UK comes down to keeping two things straight: your GDPR lawful basis, usually public task, and the ethical consent you obtain through your committee. Recording law rarely stands in your way.

Get the basis right, document your safeguards, and disclose your transcription setup honestly, and the rest of the process becomes far less daunting. A provider that lets you state plainly where data sits, who processes it, and whether it trains AI models turns a tricky section of your ethics application into a short, factual paragraph.

That's where HappyScribe fits. You can talk to the team about the research and security setup your committee needs to see.