Twenty minutes into a churn interview, a participant starts talking about a chronic illness. A diary study is in its third week when another participant messages the team: "I'd like to stop and I don't want you using my stuff." A third participant is quoted without a name on a sales deck slide, and within a day a former colleague at the company it was shown to knows who said it.
All three had signed the form.
The short answer: No. In GDPR user research, every quote, note and clip is personal data for as long as it can lead back to the person it came from, so each use needs its own legal ground. The EU AI Act adds rules for AI in the session itself.
I have worked in user research for twenty years. At Reos, the research platform we build, we published a 38-page white paper on both laws, What participants tell you (opens in a new tab), current to 4 November 2026.
The white paper is free: download What participants tell you (opens in a new tab).
Is what participants say in an interview personal data?
Yes, opinions included. In EDPS v SRB (opens in a new tab), in September 2025, the EU's Court of Justice held that a person's opinions are personal data about them.
One card in a quote bank reads "I'd cancel tomorrow if the export broke again." It came from P07, so it is personal data about P07.
When the churn participant mentions a chronic illness, the mention is health data, a special category under Article 9, as long as the participant can be identified. Using it needs one of the exceptions in Article 9(2), in research usually explicit consent. In the session, let it pass without probing.
Article 9's biometric rules can apply once software is used to recognise a specific person by voice or face.
Which lawful basis does a research study need?
One for each purpose, chosen before the first session. For customer research, that means consent or legitimate interest (a documented balancing test). Recording; transcription and AI analysis; sharing clips and quotes; and contacting someone again are four purposes, and one tick box for all of them is not valid consent.
The incentive is paid whatever someone ticks, and pulling out has to be as easy as agreeing was.
One form, four purposes. Figure 1 from What participants tell you.
Staff studies are harder. When a manager invites 15 engineers from their own team to an internal tooling study, saying no is rarely free, so an employer can seldom rely on its staff's consent.
In 2019 Greece's data protection authority fined PwC Business Solutions EUR 150,000 for processing its staff's data on their consent.
What happens when a participant withdraws, or asks you to delete what you hold?
Withdrawal and erasure are different requests. Erasure is a right to removal of what you hold: the reply is due in a month, and a GDPR exception can let you keep some of it. Processing has to stop the moment someone withdraws, and what you did before stays lawful; with consent as your only basis, the withdrawal ends in that removal, and legitimate interest can't take consent's place.
The diary study participant's entries are already transcribed and coded into a dozen observations; two insights quote them, and the readout has a clip. "I'd like to stop" withdraws consent, and "I don't want you using my stuff" asks for erasure.
Erasure takes the recording, the transcript, the observations, the clips and every quote that points to the person. A finding pooled across participants, which points to nobody, can stay.
What a withdrawal and an erasure request each do to one participant's material. Figure 2 from What participants tell you.
Is a quote anonymous once the name is removed?
Usually it is not. Taking out the name leaves pseudonymised data: while your team holds the list that matches codes to names, or while the details left in point to someone, the GDPR applies.
The sales deck slide gave its quote, "We cut onboarding from three weeks to four days", only a job title: the procurement head of a mid-sized Austrian logistics company. The slide had another problem: the participant had agreed to research use only.
In September 2024 France's CNIL fined Cegedim Santé EUR 800,000 for treating pseudonymised health data, sold for studies, as anonymous.
Removing names is necessary but not sufficient. Figure 3 from What participants tell you.
What do AI tools in your research stack mean for the GDPR?
One interview may pass through a research platform, a transcription service and a language model provider, and each receives personal data.
At each stop, ask for the contract, the vendors each one passes data to, the region, a no-training promise, and how long the data is kept. A product manager who pastes five transcripts into a chatbot on their own account has none of them.
A vendor sending transcripts to a US model provider makes a transfer under the GDPR. The EU-US Data Privacy Framework covers certified US companies; standard contractual clauses, with a transfer assessment (a written check of the destination's law), are the fallback. The Dutch authority fined Uber EUR 290 million in 2024 for US transfers with neither.
Run AI over interviews on sensitive topics such as health, or with your own staff, and you will usually owe a data protection impact assessment (DPIA) first.
Where one interview goes, and what to ask at each stop. Figure 4 from What participants tell you.
Where does the EU AI Act touch user research?
The Act (opens in a new tab) reaches into the session in two places: the AI moderator and emotion recognition.
Since 2 August 2026, under its Article 50, participants must be told while the session runs that they are talking to an AI; if your vendor built the moderator, check that it tells them. And since 2 February 2025, the Act has banned AI that infers how people feel from their voice or face in workplaces and education institutions. Job applicants are covered too.
An AI voice moderates 40 usability sessions, and the consent page says "this study uses AI". The page meets the GDPR's notice duty for the AI. But Article 50 asks for more: have the moderator open by saying it is an AI, and label it in the interface.
The ban covers signals from a voice or a face, so emotion tags on a written transcript are outside it; the GDPR still applies to them. With customers, emotion recognition from voice or face comes under the high-risk rules from 2027, and since August 2026 the people you analyse with it must be told.
Emotion AI under the AI Act, by signal and by participant. Figure 6 from What participants tell you.
Neither the February 2025 ban nor the August 2026 disclosure duty moved in July, when the Digital Omnibus on AI pushed the high-risk rules for uses like these back to 2 December 2027.
Has the GDPR changed in 2026?
No. The GDPR amendments the European Commission proposed on 19 November 2025 are not law yet: EU governments agreed their position on 21 October 2026, and the final talks have not started. Still open: an appeal against the EU-US Data Privacy Framework, and the European Data Protection Board's draft guidelines on anonymisation and on research.
Which parts can a research platform take off your hands?
The records. The judgement stays with you.
When you attach a consent form, Reos records which form version each participant saw, and when. Data at rest stays in the region you choose, EU (Frankfurt) or US, and the models Reos calls run under zero data retention terms, unless you bring your own model provider keys.
Model calls, speech synthesis and error monitoring can still run outside that region, including in the US, so your notice and transfer assessment need to cover them.
Emotion inference is an Enterprise feature, and Reos runs it only in a project that switches it on, with each person's separate yes and its own notice, and only once the team declares no participant is an employee, job candidate, student or applicant. Choosing a lawful basis, writing the notice, running a DPIA, setting retention and judging whether a quote can safely leave research are still yours.
What belongs on a GDPR user research checklist for your next study?
| When | Check |
|---|---|
| Before | Every purpose's legal ground written down |
| Before | A separate yes or no for each optional use |
| Before | With staff as participants: can they really refuse? |
| Before | A notice naming who receives the data, where it goes and how long you keep it |
| Before | For every vendor: a contract, who they pass data to, where it is stored and processed, no training, how long it is kept |
| Before | A DPIA first, usually needed for AI on sensitive or staff interviews |
| Before | Emotion recognition from voice or face left out for staff, applicants and students; for anyone else, a notice now and the high-risk rules from December 2027 |
| During | An opening line from the AI moderator saying what it is |
| During | No follow-up questions from moderators on a sensitive disclosure |
| During | Which version of the consent text each participant agreed to, and when |
| After | Names, job titles and other details that point to someone taken out, and the result still handled as personal data |
| After | Health details and other sensitive moments cut from reels and slide decks |
| After | Every quote reviewed by research before anyone else uses it, and new consent before it goes into marketing |
| After | A reply to every request within a month, with withdrawal and erasure kept apart |
| After | A link from each clip, quote and note back to its participant, so a request finds them all |
| After | Data deleted when you said it would be |
Summary
A quote, a clip or a note stays personal data while it can lead back to a participant, and the AI Act covers AI in the session. The signature is one check; the table above has the rest, from before the first session to the deletion date.
Our free white paper has every case, date and source behind this summary. It says of itself: "This is general information, not legal advice."
