F3. Customer Data Privacy and Consent When Validating a New Idea
After this lesson you can
- Describe the eight OECD privacy principles in plain terms
- Apply data minimization by mapping every data point to a hypothesis
- Write specific consent and purpose statements with a deletion date
- Separate contact details from notes and limit access on a small team
- Distinguish privacy duties from research ethics review
- Identify questions for a privacy or data protection professional
Video coming soon
Videos are planned to publish from December 2026.
An introduction to the eight OECD privacy principles and how they apply to the interviews, surveys and sign-up forms founders use to test ideas. It also separates privacy duties from research ethics review and lists questions to bring to the right professionals.
Questions and answers
Questions a learner would ask about this lesson. Think through your own answer before you open each one.
- Is a spreadsheet of interview contacts really "personal data"?
Show answer
Yes. The OECD Privacy Guidelines define personal data as any information relating to an identified or identifiable individual. An email address or phone number identifies a person, and interview notes can identify someone through details like a job title, workplace and neighborhood even without a name. When you test an idea, you almost always collect personal data.
- What are the eight OECD privacy principles?
Show answer
Collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability. They were first adopted in 1980, and the 2013 revision left the eight basic principles intact while adding privacy management programmes and security breach notification.
- What is data minimization?
Show answer
The lesson defines it as collecting only the personal data needed for a stated purpose, and no more. In practice you start from the hypothesis: list each piece of data a test would collect, name the hypothesis it helps test, and cut anything with no hypothesis beside it.
- If someone gives consent, can I use their data for anything later?
Show answer
No. Under the OECD principles, purposes are specified at collection, and later uses should stay compatible with them. A new purpose is specified and asked about again, not added quietly. Specific consent names the purpose and asks a separate yes for things like recording or follow-up.
- Are privacy duties the same thing as research ethics review?
Show answer
No. Privacy duties apply to the personal data you handle, whatever the purpose. Whether research ethics review applies depends on the purpose of the activity. The lesson's checkpoint question is whether the work could appear in a thesis, paper or talk; if yes, talk to the ethics office before collecting.
Practice quiz
- Question 1Which of these is one of the OECD privacy principles?
- Question 2Founder A wants every landing-page visitor's full name, phone, employer and birth date to test interest. Which principle is most at stake?
- Question 3Founder C's notes mention families' immigration concerns. What is the best practice described in the lesson?
- Question 4What did the 2013 revision of the OECD Guidelines change?
- Question 5Which approach to storing interview data does the lesson recommend?
- Question 6Under the accountability principle, what happens when an outside tool holds your data?
- Question 7Which sign-up form is the "strong form" in the lesson?
- Question 8When Founder C redesigned the workshop sign-up form, what did they keep?
- Question 9Why does the lesson say "no data type is sensitive everywhere"?
- Question 10Founder C wants feedback on whether workshops help, and that feedback might appear in a practicum report. What should they do before collecting it?
Saved in your browser only: no account, no server.
Entrepreneurship for Graduate Students is education, not legal, tax, financial, or immigration advice. Bring questions about your own situation to your university technology transfer office, a licensed professional, or the right campus office.