How Do You Protect Confidentiality When Participants Know Each Other?

What changes when participants already know one another?

Imagine interviewing employees from one department, teachers from the same school, students from the same class, members of a small community, or relatives from the same family.

You remove their names. You use participant codes. You generalize some demographic details. Yet one participant describes a recent promotion, another mentions a recognizable disagreement, and someone else refers to "the only person in our office who..."

To an outside reader, the data may appear anonymous. To the other participants, the identities may be obvious. When people already know one another, confidentiality depends not only on removing direct identifiers but also on managing what insiders can infer from information they already possess.

Protect against recognition by insiders, not just identification by strangers

Insiders begin with information the researcher cannot remove

Confidentiality and anonymity are not the same thing

Confidentiality concerns how information known or collected in the research is protected from inappropriate disclosure. Anonymity concerns whether a person's identity is known or can be connected to the information.

These concepts become especially important when participants already know one another. A researcher may faithfully protect names, recordings, transcripts, and linkage files while participants remain identifiable to insiders from their roles, experiences, or relationships.

OHRP guidance emphasizes that research plans should make appropriate provisions for protecting participants' privacy and maintaining data confidentiality. It also cautions against promising absolute confidentiality and recommends explaining relevant limits during consent.

Insiders already possess pieces of the identification puzzle

An outside reader may see "Participant 4, senior employee" and learn very little. A coworker may know there are only two senior employees in the unit and that only one recently experienced the event described in the quotation.

This is why confidentiality cannot be evaluated solely from the perspective of someone unfamiliar with the research setting.

Research involving small or unusual samples, identifiable locations, or prominent participants has long been recognized as particularly challenging because local knowledge can make participants easier to identify. Qualitative research adds further difficulty because detailed accounts often contain precisely the contextual information insiders need to recognize someone.

Relationships themselves can identify participants

Suppose a study includes a supervisor and several employees. A quotation says, "My supervisor rejected my request to transfer after I returned from maternity leave."

The researcher may remove the employee's name and the supervisor's name. Yet coworkers may know who recently returned from maternity leave and who requested a transfer. The relationship and event together may reveal both people.

Family research creates similar problems. "My older sister who lives overseas" may effectively name a person within a family even though no conventional identifier appears.

Confidentiality reviews should therefore consider relational information such as reporting lines, family roles, friendships, conflicts, partnerships, and other connections among participants.

A small population magnifies otherwise ordinary details

Age, occupation, seniority, educational background, location, or family structure may seem harmless in a large population. In a small organization or community, the same details can dramatically narrow who the participant could be.

This is the broader problem in which several individually harmless details become identifying when combined.

When participants already know one another, the threshold for recognition can be even lower because they do not need to search public databases or reconstruct the entire profile. They may already know the relevant ages, jobs, events, relationships, and histories.

Quotations can be recognizable even after demographic details are removed

People can recognize stories as well as characteristics.

A participant may recount a meeting everyone attended, a workplace conflict, a family incident, a controversial decision, or an unusual event. Removing age, gender, and job title does little if the story itself identifies who was involved.

Likewise, distinctive expressions, habitual phrases, or recognizable ways of describing events may contribute to recognition in tightly connected groups.

This is why an apparently anonymous quotation may still reveal who said it, particularly to readers who already know the speaker or setting.

Repeated participant codes can build recognizable profiles

Researchers sometimes use consistent labels such as P01 throughout a publication so readers can follow one participant's perspective.

That can improve analytical coherence, but it also allows information to accumulate. One quotation reveals the participant's department. Another reveals a family circumstance. A third describes a recent dispute. By the fourth quotation, coworkers may have little difficulty recognizing P01.

Consider whether readers genuinely need to connect every quotation from the same participant. When continuity is not analytically important, reducing unnecessary linkability may help protect confidentiality.

Participants may reveal information about one another

When participants are socially connected, one person's interview can contain information about another participant.

An employee may describe a colleague's disciplinary issue. A family member may discuss another relative's health. A student may identify another participant's behavior. These disclosures create third-party confidentiality concerns even if the person being discussed never raised the information in their own interview.

Researchers should therefore review data not only for information that identifies the speaker but also for information that identifies other people mentioned in the account.

Separate interviews do not eliminate insider identification

Individual interviews can prevent participants from directly hearing what others say during data collection, which may make them preferable to group discussion for highly sensitive topics.

They do not, however, guarantee that participants will remain unrecognizable in the final report. If quotations or case descriptions contain distinctive experiences, coworkers or community members may still infer who contributed them.

The choice between individual interviews and group methods should therefore consider both immediate disclosure during data collection and later deductive disclosure in dissemination.

Focus groups create an additional confidentiality problem

In a focus group, participants directly hear what other participants say. The researcher can control how recordings, transcripts, and publications are handled, but cannot exercise equivalent control over what group members remember and repeat afterward.

HHS informed-consent models for sensitive focus-group research explicitly acknowledge a risk of unwanted or accidental disclosure and recommend telling participants that researchers will ask all group members to keep the discussion confidential. AHRQ focus-group materials similarly tell participants that, although everyone is asked to maintain confidentiality, the researchers cannot guarantee that another group member will not reveal a participant's name or comments.

This specific limitation deserves its own treatment because the question is not simply how the research team protects data but whether researchers can guarantee confidentiality in a focus group.

Recruitment can itself reveal participation

Confidentiality problems can arise before anyone answers a research question.

If a researcher sends a group email exposing all recipients, recruits employees through a supervisor, gathers participants visibly in a workplace conference room, or publicly identifies members of a small study, people may learn who participated.

This can matter when participation itself is sensitive. For example, being recruited into a study of workplace harassment, stigmatized health conditions, or controversial organizational practices may reveal information participants would prefer others not to infer.

Recruitment procedures should therefore consider privacy among participants as well as confidentiality of the eventual data.

Be careful with demographic tables in small samples

A participant table can unintentionally become an identification key.

Imagine a study of eight employees. The table reports each participant's age, gender, exact job title, years of service, and department. The results then attribute quotations using matching participant codes.

Even if the table contains no names, coworkers may recognize most rows immediately. Combining the table with quotations can make disclosure still easier.

Consider whether readers need participant-level demographic profiles or whether aggregated sample characteristics provide sufficient methodological transparency.

Consent should describe realistic limits rather than promise perfect secrecy

OHRP-related guidance recommends describing the extent to which confidentiality will be maintained and cautions that absolute confidentiality should not be guaranteed. Relevant limits should be explained when they may affect a participant's decision to participate.

For interconnected populations, this means being candid that the research team will take steps to protect identity but that people familiar with the participant or circumstances may sometimes recognize them from contextual information.

This is more informative than simply promising that "all information will be anonymous" when the study design cannot realistically support that promise.

A workplace study where everyone knows everyone

The challenge is not that the researcher failed to remove names. The challenge is that coworkers already know the stories behind the data.

Common confidentiality mistakes in interconnected participant groups

Design confidentiality for the people who know the setting best

When participants are socially connected, build insider recognition into the confidentiality assessment from the beginning.

The confidentiality standard should therefore reflect the actual social environment of the research. A quotation that looks beautifully anonymised to the research team may be practically signed and dated to the five people who know what happened.

Before reporting data from participants who know one another

Questions about confidentiality among participants who know each other

Confidentiality is harder when readers already know half the story

How to Cite This Guide

This guide is intended to be read, shared, and used in research, teaching, and academic work. If you draw on its ideas, explanations, or other content, please acknowledge the source by citing the guide. Doing so gives appropriate credit and helps your readers locate the original resource.