Exemption means the study is a type of research that may not require full IRB review because it fits one of the federally defined exempt categories. The exemption categories are the specific kinds of activities that can qualify for this status, such as educational tests, surveys or interviews, or observation of public behavior, or the use of existing non-identifiable data. A study is deemed exempt only if it falls into one of these categories and appropriate protections are in place. An example of exempt research is administering an anonymous survey or using existing data that have been de-identified so individual participants cannot be identified.

Protecting privacy in online surveys means building protections into every step of data collection and handling. The best approach combines secure data transmission, minimal data collection, de-identification, secure storage, and clear communication to participants about how their information will be protected. Using HTTPS keeps data encrypted as it travels between participants and the research system, reducing the risk of interception. Collecting only what is necessary minimizes the amount of sensitive information exposed. Assigning codes or pseudonyms helps separate identifying details from the survey responses, making it harder to link data back to a person. Storing data with proper access controls and security measures prevents unauthorized access. Finally, informing participants about the specific privacy protections gives them transparency and helps ensure informed consent. Choosing to ignore privacy to speed up collection, gathering identifiable information such as full names and emails, or posting raw data publicly would undermine confidentiality and increase the risk of harm to participants, which is why those options are not appropriate.

In this area of study, unanticipated problems are events that are not expected, are related to the research, and indicate greater risk to participants than was known. If an adverse event is clearly unrelated to the research and is anticipated, it does not fit the criteria for an unanticipated problem. However, that does not mean it can be ignored entirely. Safety oversight normally requires that all adverse events be documented and reported through the appropriate channels (such as to the sponsor or safety office), even if they are not reported as unanticipated problems. So the statement is false: while the event wouldn’t be categorized as an unanticipated problem, it may still require reporting in another safety/reporting pathway.

A Certificate of Confidentiality provides protection against compelled disclosure for research participants. This legal protection helps researchers resist requests to turn over identifiable, sensitive information obtained in the study, even in court proceedings or under subpoenas. In a longitudinal study where data about illegal activities are collected, having this certificate means participants can be more forthcoming, knowing their information won’t be easily disclosed to authorities. It strengthens the privacy safeguards beyond standard data handling, consent forms, or de-identification alone. It’s not a blanket guarantee of anonymity in every situation and doesn’t override all legal reporting requirements, but it offers stronger protection against compelled disclosure than simply anonymizing data after the study or avoiding sensitive topics. Storing data on a public server would undermine confidentiality entirely.

Data minimization means collecting only data that are truly necessary to achieve the research aims, and then keeping and using only that limited set of data. This approach reduces privacy risks by limiting exposure of participants’ information and makes data management easier and more compliant with ethical and legal requirements. The option described matches this idea by emphasizing gathering only data essential for the research and noting that this reduces risk and simplifies handling. Other options describe practices like deleting data after a certain time, collecting as much data as possible, or storing data in multiple formats—these are SAMPLEabout retention, data quantity, or storage, not about limiting what is collected in the first place.