03 · What You Need to Know
How to Establish Whether Research Information May Be Shared With AI
Why Research Access and AI Processing Permission Are Different
Researchers may receive access to information for a particular scientific purpose under defined conditions.
These conditions may restrict who can access the information, where it can be stored, and whether it may be transferred to another organization.
For example, a university may authorize a researcher to analyze student records using institutional systems without permitting the same records to be uploaded to an external chatbot.
The researcher's legitimate access does not automatically extend to every possible processing arrangement.
Before using AI, researchers should establish whether the proposed operation is covered by the permissions governing the information.
What Does It Mean to Give Information to an AI System?
Information may enter an AI system through several mechanisms.
Researchers may paste text into a conversation, upload a file, submit data through an application programming interface, or connect the system to an institutional repository.
These activities may create different data flows and processing arrangements.
For example, connecting AI to a research database may permit access to information beyond the individual records explicitly requested by the researcher.
The assessment should therefore address the complete processing arrangement rather than only the visible prompt.
What Types of Research Information Require Particular Attention?
| Information category |
Potential restriction |
What researchers should verify |
| Identifiable participant records |
Consent, confidentiality, and data protection obligations |
Authorized purpose, processing environment, and safeguards |
| Interview recordings |
Identifiable voices and sensitive disclosures |
Approved transcription or analytical processing arrangements |
| Student academic records |
Institutional access and privacy restrictions |
Permission for the specific research and external processing |
| Confidential peer review manuscripts |
Editorial confidentiality |
Publisher or journal authorization |
| Proprietary research datasets |
Data-use agreements and intellectual property obligations |
Contractual permission for the proposed service |
| Publicly accessible materials |
Possible licensing, privacy, or ethical restrictions |
Permitted collection and processing |
| Synthetic research examples |
Potential resemblance to protected records |
Whether the examples genuinely avoid restricted information |
The categories identify issues for assessment. They do not establish that all information within a category is universally prohibited from AI processing.
Does Participant Consent Authorize AI Processing?
Participant consent may be relevant to determining whether AI processing is permitted, but its effect depends on the consent arrangement and applicable law.
For example, participants may have agreed that their interview recordings would be accessed only by authorized research personnel.
Uploading those recordings to an external AI provider may introduce processing not contemplated by the original agreement.
Researchers should examine the scope of the consent and any additional obligations governing the information.
They should not assume that general consent to participate in research authorizes every subsequent technology or provider.
Conversely, additional consent is not universally required for every change in processing when another lawful and authorized arrangement applies.
What if Consent Materials Did Not Mention AI?
The absence of the term artificial intelligence does not automatically prohibit every AI-assisted activity.
The relevant question is whether the proposed processing falls within the purposes, disclosures, safeguards, and permissions established for the study.
For example, generating code from synthetic data may not involve participant information at all.
Using an external AI provider to process identifiable interview recordings presents a different question.
Researchers should seek the appropriate institutional determination when the proposed activity may exceed the approved arrangements.
Where a protocol amendment or additional authorization is required, it should be obtained before implementation.
What Role Does Research Ethics Approval Play?
Research ethics approval may establish conditions governing participant recruitment, consent, information collection, confidentiality, and analytical procedures.
Introducing AI may require review when it materially changes those approved arrangements.
For example, an approved protocol may specify that confidential transcripts remain within institutional storage.
Transferring them to an external service could constitute a material change requiring institutional assessment.
Researchers should consult the responsible ethics authority rather than assume that approval of the original study automatically covers the new processing.
Ethics approval and data protection authorization may also involve different institutional responsibilities.
How Do Data Protection Laws Affect AI Sharing?
Data protection laws may regulate the collection, use, disclosure, storage, and transfer of personal information.
The applicable requirements depend on jurisdiction, the information involved, and the processing arrangement.
In the Philippines, Republic Act No. 10173, the Data Privacy Act of 2012, provides the principal legal framework for personal information processing.
Researchers should consider relevant lawful processing conditions, transparency, legitimate purpose, proportionality, and security obligations.
In contexts governed by the European Union General Data Protection Regulation, relevant obligations may include lawful basis, purpose limitation, data minimization, and processor arrangements.
Neither framework should be reduced to a universal rule that every research use of AI requires individual consent.
What if the AI Provider Acts as a Data Processor?
Some AI services may process information on behalf of an organization under a contractual arrangement.
The legal roles and obligations depend on the applicable law and actual relationship between the parties.
For example, a research institution may use a contracted service that processes data according to specified instructions and security requirements.
Researchers should establish whether an appropriate agreement exists and whether the intended research use falls within its scope.
A provider's general description of enterprise security does not independently establish the legal status or authorization of a particular processing arrangement.
Why Provider Terms Matter
AI services differ in how they process, retain, access, and use submitted information.
Researchers should examine the terms applying to the exact service and account configuration.
Relevant questions include whether submitted information may be retained, used for model improvement, accessed by authorized personnel, or processed through subprocessors.
The existence of a no-training commitment addresses one concern but does not necessarily eliminate other processing obligations.
Researchers should also examine available deletion controls and relevant contractual restrictions.
Where provider terms are unclear, submitting restricted research information may be inappropriate until clarification is obtained.
Does Removing Names Make Sharing Permissible?
Removing direct identifiers may reduce some privacy risks, but it does not automatically establish anonymization.
Interview narratives may contain distinctive experiences, locations, or other details that permit identification.
Researchers should assess whether the remaining information can reasonably be linked to individuals in the intended processing context.
They should also examine whether contractual or institutional restrictions continue to apply after de-identification.
Data minimization and de-identification can support responsible processing, but neither automatically overrides an existing prohibition.
Can Researchers Share Aggregated Information?
Aggregated data may sometimes be suitable for AI processing when individual information is not disclosed.
For example, a researcher may provide summary statistics rather than complete student records when asking AI to suggest visualization code.
However, small cell sizes or unusual combinations of characteristics may still create disclosure risks.
Researchers should determine whether the aggregate information is sufficiently protected and whether the intended processing is permitted.
Aggregation is a useful safeguard in some circumstances, not a universal guarantee of anonymity.
Can Synthetic Data Replace Actual Research Information?
Synthetic examples can allow researchers to obtain programming or methodological assistance without exposing original participant records.
For example, a researcher may provide fictional variable names and sample observations when requesting code for data cleaning.
The generated script can subsequently be evaluated and executed within an authorized environment containing the actual dataset.
However, synthetic examples should not inadvertently reproduce identifiable or restricted information.
They may also fail to represent unusual structures in the real data.
Researchers should verify both the information protection benefits and the technical suitability of the alternative.
Does an Institutionally Approved AI Platform Permit All Research Data?
No. Institutional approval may apply to specific services, configurations, information classifications, or purposes.
A university may approve an AI platform for administrative drafting while restricting its use with confidential research records.
Researchers should determine whether the approval covers the actual dataset and intended task.
Where necessary, the institution's data protection officer, information-security personnel, or research governance office should provide clarification.
Approval of the technology and authorization of the information processing are related but separate decisions.
What About Locally Deployed AI?
Local AI deployment may reduce external data transfers, but it does not automatically establish that the processing is permitted or secure.
Researchers should evaluate access controls, storage arrangements, maintenance, logging, and institutional authorization.
For example, a locally hosted model accessible to unauthorized users may still expose confidential information.
The appropriate decision depends on the complete system configuration and the obligations governing the data.
Local processing can be a useful alternative when properly implemented, but its location alone does not establish compliance.
When Should Researchers Obtain Privacy or Information-Security Review?
Privacy or security review may be required when AI introduces new providers, transfers, access arrangements, retention practices, or processing purposes involving protected information.
The requirement depends on the institution, jurisdiction, and specific data.
Researchers should identify the responsible institutional authority and provide sufficient information about the proposed processing.
This may include the provider, service, data categories, access controls, retention terms, and relevant safeguards.
Where formal review is required, authorization should be obtained before submitting the information.
What if the Necessary Information Cannot Be Shared?
The inability to share a dataset with a particular AI system does not necessarily prohibit every form of AI assistance.
Researchers may redesign the task using synthetic examples, appropriately aggregated information, or an approved institutional environment.
They may also use conventional analytical software or another validated procedure that does not require external disclosure.
The alternative should still satisfy the study's methodological requirements.
Researchers should not weaken confidentiality protections merely because an AI system requires access to the original records to perform the requested task.
What if Restricted Data Have Already Been Uploaded?
If researchers discover that protected information was submitted to an unauthorized AI service, they should follow applicable institutional incident procedures promptly.
Depending on the circumstances, this may involve containing the exposure, preserving relevant evidence, notifying authorized privacy or security personnel, and assessing whether further reporting is required.
Deleting the conversation does not necessarily establish that all copies or logs have been removed.
Researchers should avoid assuming that the absence of visible harm means no incident occurred.
The appropriate response depends on the information, provider arrangement, and governing obligations.
How Should Researchers Document the Authorization Decision?
For consequential AI processing, researchers should preserve evidence of the relevant authorization and safeguards.
The record may identify the data categories, intended purpose, approved system, institutional determination, and relevant restrictions.
It should also explain any modifications made to reduce information exposure.
Documentation helps demonstrate that the processing arrangement was evaluated before implementation.
However, the documentation itself should not unnecessarily reproduce confidential information.
The objective is traceability without creating additional disclosure risks.
When Should Researchers Decide Not to Share Information With AI?
Researchers should withhold information when the proposed processing is unauthorized, conflicts with confidentiality commitments, or lacks essential protections.
They should also delay sharing when important provider terms or institutional requirements remain unresolved.
The appropriate response may involve obtaining permission, changing the processing environment, reducing the information supplied, or using another method.
Scientific convenience does not independently justify transferring information that researchers are obligated to protect.
