Research governance and ethics 

Research governance and ethics 

Good research governance and ethics approval enable high-quality research while protecting participants and data. This guide outlines best practice and key resources.

Published: 16 November 2022

Updated: 11 January 2023


This was published when the organisation was the Royal Pharmaceutical Society.

Key points covered in this guide

  • The differences between research ethics and governance.
  • An overview of ethics approval, where it is required and the process of obtaining it.
  • The ethics relating to recruiting research participants.
  • How to effectively shield study participants and protect the confidential data gathered throughout the research process.

Research governance 

What is research governance?


Research governance can be defined as a broad range of regulations, principles and standards of good practice that exist to uphold and, where necessary, improve the quality of research across all healthcare sectors. 

The UK Policy Framework for Health and Social Care Research outlines the principles of good governance for all research within the remit of the secretary of state for health. 

This includes clinical and non-clinical research that is: 

  • Concerned with the protection and promotion of public health.
  • Undertaken by, or taking place within, the Department of Health and Social Care, its non-departmental public bodies, and the NHS.
  • Undertaken by, or taking place within, social care agencies. 

If you are involved in research in this area, you must be aware of, and comply with, this framework.  

What are the differences between research ethics and governance?


Research governance and research ethics are often confused. The table outlines the main differences between the two:

Research governanceResearch ethics
• Ensures high research standards, including scientific quality, ethical acceptability, and safety.

• Includes policies, laws and regulations, processes, and checks that need to be made before the research can begin, including:
○ Ethics.
○ Relevance of the research.
○ Finance, funding, and resources.
○ Research management.
○ Timescales, including time commitment required.
○ Appropriateness of the research methods.
○ Plans for dissemination.
• Ensures the protection of rights, dignity, safety, and wellbeing of those involved in research.

• Must be considered throughout the whole research process, and includes:
○ Confidentiality.
○ Participants’ consent.
○ The right to withdraw from research participation at any time.
○ Details of the complaints procedure.
○ An explanation of the disclosure process, (i.e. if a participant discloses information which the researcher thinks others may be at risk of harm).
○ Avoiding harm to participants, the research team, or anyone involved in research.
Why is research governance needed?


In many countries, such as the UK, research has become increasingly more formalised and regulated in an attempt to:  

  • Safeguard participants in research – measures need to be taken to ensure research participants are protected and that no harm (e.g. abuse, exploitation and stigma) results from involvement in research. Safeguarding applies not only to vulnerable individuals or groups but to all research participants and their communities. 
  • Protect researchers/investigators by providing a clear framework to work within – the framework is relevant to everyone involved in research, and a clear allocation of responsibilities promotes transparent decision-making.  
  • Enhance ethical and scientific quality (setting the standards) – research governance is about ensuring high standards in research. As well as encouraging research excellence, frameworks aim to identify and mitigate poor performance and other adverse incidents, such as research misconduct and fraud.  
  • Minimise risk – research activities may involve an element of risk, for example, the potential psychological/physical well-being and safety of participants and researchers. Research governance considers these risks against the likely benefits and ensures no harm results from being involved in research. Any potential risks should be assessed, mitigated or managed.  
  • Monitor practice and performance – research governance provides a framework for organisations (e.g. local authorities, research organisations, etc.) to assess and monitor research activity. This can help minimise duplication of research, provide accountability for investment in research, and ensure that the appropriate methods and dissemination processes are followed. 
  • Promote good practice and ensure lessons are learned – the broad range of regulations, principles and standards of good practice uphold and continuously improve research quality, thereby promoting good practice and ensuring lessons are learned. 

Research ethics

Do I need ethics approval?

Establishing if your project is considered research is one of the first steps required to determine what approvals you will require.  

How do I know if my project is considered research? 

Have a look at the resources provided by the Health Research Authority (HRA), one of a number of bodies with responsibilities for UK research regulation and governance; for example, the: 

You should also engage appropriate colleagues within your organisation to help you through the process; for example, you might have a research department/lead. For NHS employees, this would usually involve your local research and development department at your trust or health board. 

Obtaining ethics approval 

An NHS Research Ethics Committee (REC) is a committee made up of experts and lay members who will analyse the risks and benefits of your research, while balancing the interests of the research subject or participant. 

No matter what type of project you decide to carry out, you should follow good practice recommendations in terms of ethics and governance; for example, informing participants and obtaining consent where appropriate. It is always wise to seek guidance as to whether formal REC approval is required, as the generic guidelines do not always apply, particularly if patient data is involved. 

REC approval is usually required when an NHS organisation has a duty of care to participants (e.g. patients, service users, NHS staff or volunteers), including any of their personal information that may be used in the research. This includes, but is not limited to: 

  • Use of personal data (e.g. patients’ medical notes).
  • Observations.
  • Conducting surveys. 
  • Interviews with participants.  
  • Using non-invasive imaging. 
  • Using human blood or other tissue samples. 
  • Inclusion in trials of drugs, devices, surgical procedures or other treatments. 

Check out HRA resources, such as this ethics decision tool, to help you work out whether your study needs formal REC approval. 

If you intend to publish your work, you will be asked for details of formal ethical approval or an independent review confirming that you were exempt from REC approval.

What do you need to consider when applying for ethics approval? 

When designing your research, you need to carefully consider the ethical implications of your study. Consider the following questions: 

  • Who are your study participants? Are the inclusion/exclusion criteria clear and appropriate? 
  • What are the benefits, disadvantages or risks for those participating in your study? 
  • How will research participants be recruited for your study? What is your recruitment strategy and is it practical and appropriate?  
  • Have you considered obtaining consent from participants? Is everyone able to provide consent? How do you intend to assess participants’ capacity to provide their consent? 
  • Is it clear to participants what taking part in your research will involve? What type of data will be collected?
  • What are the time commitments, and will travel be required?  
  • How will you protect and maintain the anonymity and confidentiality of participants? Where will the collected data be stored and for how long? Who will have access to the data? Will reported data be anonymised?  
  • What procedures are in place to protect the researchers (lone policy) and participants? 
The ethics application process 

Let’s have a look at some frequently asked questions when applying for ethics approval:  

How long does it take? 

The process for obtaining ethical approval for research in the UK has been streamlined over the last few years. With a protocol in place, documentation for approvals can be completed within a month; however, stakeholder review can elongate this timeline. Paperwork and approvals for more complex projects (e.g. clinical trials of medicines) can take significantly longer. It is important to ensure that you give yourself plenty of time to navigate the process. 

What documents need to be submitted to the REC? 

Depending on the type of study, you may be required to submit different documentation for an ethics or REC approval; these are likely to include the following: 

  • Application form. 
  • Participant information sheet, including details about the study, why participants have been selected, what taking part in the study involves, how confidentiality will be ensured, how data will be stored, accessed, managed and disseminated (etc.).
  • Invitation letters and recruitment flyers, data collection booklets including interview guide, survey questions (etc.).
  • Consent forms. 
  • Study protocol, including a detailed plan for data management.

Once all the documentation has been reviewed, you will be notified of the outcome. You may be required to submit further information or revised documentation before a final decision is made. 

What if I need to make amendments to my research protocol? 

If the research team wishes to make a substantial amendment to the original application or the supporting documents, or if there is a need to deviate from the protocol, an amendment should be submitted to the HRA for REC approval. You need to wait for the first ethics approval to be granted before you can make any changes to the study procedure. 

Research participants 

Considering the ethics relating to research participants and their selection is an essential first step in research planning. 

Is it ethical to undertake research that is expected to have a negative impact on individuals? 

It is possible that a research study may have a negative impact on research participants, individuals, specific groups or communities and organisations; however, this will be weighed against the expected benefits of the research. Researchers should always consider potential risks (short and long-term) and mitigating actions. These should be described in detail to a REC to allow for a comprehensive assessment of risk versus benefit of the research. 

What if my research involves potentially vulnerable participants? 

All human participants in research may be vulnerable. Vulnerability may be defined in different ways: it could be due to age (e.g. children or older people), or it may arise because of a disability, an abusive relationship, potential marginalisation, disadvantageous power relationships within personal and professional roles, etc. For example, participants in a dependent relationship may feel coerced or pressured into taking part in a research study, so you need to take extra care to ensure that their participation is truly voluntary. In these cases, you will need to consider additional ethical concerns or issues arising from working with vulnerable or potentially vulnerable, people and in particular their vulnerability to: 

  • Physical harm.
  • Psychological and emotional distress. 
  • Damage to social standing or reputation.
  • Different combinations of the above.
Stigmatising research

Research can be challenging when undertaken with individuals or communities who may be at risk of being stigmatised or discriminated against. Stigma may be inherent in the research design (e.g. the formation of a research question based on prejudicial biases) or a byproduct of the research findings (e.g. the interpretation of findings in a way that promotes negative stereotypes) and may be intentional or unintentional. It is important to consider the risk of stigmatising research participants before recruitment; ideally, when forming the research question and designing the methodology.

Once research study participants have been selected, you must consider whether consent is required and in what form it should be obtained. 

All individuals invited to take part in health and care research must give their informed consent before being recruited (i.e. they should be clearly informed about the research project, including the purpose of the study and intended outcomes, any potential risks of participating, how data will be stored, maintained and reported, and any other relevant information that will help them to decide whether they wish to participate or not). Although sometimes consent may be implied (e.g. by responding to an online survey), you should always ensure that you have evidence that consent has been given by all participants. 

For consent to be considered both legal and ethical, it must be: 

  • Given by a person with capacity.
  • Voluntarily given, with no undue influence.
  • Given by someone who has been adequately informed.
  • A fair choice.
  • Retractable at any point, even when consent was initially given.

It is expected that any research that is funded or supported by the National Institute for Health and Care Research (NIHR) always follows best practice in consent and the preparation of information for participants, as set out by the HRA’s guidance

Data protection and confidentiality 

Ensuring data privacy and safety is essential at all stages of your research project. Researchers who obtain data from their participants are expected to comply with the relevant legislation, such as data protection legislation, so it is important to check the latest guidance before you start. 

You should think about the following:  

  • How will data be stored and managed? 
  • Who will access the data and how? 
  • Will you collect anonymised data? If not, how will it be anonymised? 
  • How will you present and/or report your data? 

It is important that you consider strategies for confidentiality, anonymisation and data protection. 

Confidentiality and data protection 

All research data should be treated as confidential (i.e. only the researcher(s) have access and no information can be published without the participants’ permission). Data storage and security arrangements should be planned well in advance to prevent unauthorised access, unwanted changes or destruction. You also have an ethical obligation to protect the confidentiality of personal information provided to you by research participants. 

Researchers and study coordinators must comply with the General Data Protection Regulation (GDPR), with respect to processing personal data. See the operational guidance on the implications of the GDPR for the delivery of research in the UK, published by the HRA.  

Strategies to ensure confidentiality and protection of research participants’ data 

No matter what type of study you are undertaking, you should always consider what data you are collecting from participants, whether this data is really needed, how long it will be stored for, and how it can be protected. For example: 

  • Using identification numbers for each participant.
  • Removing any names, locations or any identifiable information from transcripts, data sheets (etc.).
  • Asking for participants’ age (or age range) instead of their date of birth.
  • Considering if you need participants’ contact details (email address, postal address, telephone, etc.) and why (e.g. for follow-up visits, to communicate research findings, etc.). 
  • Considering how you will store identifiable data and for how long.
Confidentiality and anonymity 

Most data collected from research participants can be anonymised before reporting by changing identifiers (e.g. name, age, address, workplace, etc.). A change in an identifier could include data being removed, substituted, generalised or aggregated. In some cases, it is possible to collect anonymised data from the outset; for example, through an anonymised questionnaire. 

Anonymisation allows data to be shared, whilst preserving the privacy of participants. Anonymisation should also be considered alongside obtaining informed consent for data sharing. Personal data should never be disclosed unless participant consent has been given. 

General tips for preparing for research governance and ethics approval 

  • Read all the guidance carefully – it is surprising how many applications are returned or rejected because applicants do not adhere to the guidance when completing the application.  
  • Use resources available from trusted sources – the HRA offers guidance and examples of relevant documents, such as protocol templates, consent and participant information guidance. Other organisations also offer free resources and training. Check with your organisation or have a look at our resources section, where some of these are listed. 
  • Access support – getting support from an experienced colleague, a supervisor, or someone who has gone through the ethics approval process can be extremely helpful in helping you navigate the process. You can also contact relevant organisations such as the HRA, NIHR Research Design Service, your local research department (etc.), for more support and advice.  
  • Attention to detail is key – make sure all documents and files are saved and named in accordance with the relevant guidance (e.g. dated, version number included, etc.). 
  • Give yourself plenty of time – preparing all the documentation and gathering feedback from stakeholders will take time, so make sure you plan ahead and are realistic with your time.  
  • Have a positive attitude – applying for ethical approval can be daunting for those who are unfamiliar with the process. Remember that the ethical approval process is standard practice in the NHS and has been significantly streamlined over the last few years.

One-to-one support

Monday-Friday, 9am to 5pm
We’ll answer your questions, provide reliable professional advice, and point you towards the most up-to-date pharmaceutical information.

Did this learning help your CPD?

Don’t forget to record it in your MyCPD Revalidation
e-Portfolio.

Share your suggestions

Submit an idea for learning content, events, guidance or resources.