# Research Ethics and Data-Protection Protocol

**Study:** Virality Without an Industry?  
**Version:** 1.0  
**Date:** 23 August 2026

## 1. Ethical posture

The study is expected to be minimal physical risk but can create material reputational, financial, legal, political, gendered, and employment risks. Musicians and intermediaries often work through small networks in which an "anonymous producer from Karachi" may be obvious to everyone involved. Anonymity must therefore be designed, not merely promised.

## 2. Participation and consent

- Participation is voluntary and may be withdrawn until the participant's material is irreversibly aggregated or published.
- Consent to interview, record, identify, quote, archive, and receive follow-up contact are separate choices.
- Participants may skip questions without explanation.
- Do not recruit anyone younger than 18 without a separate minor-participant protocol and ethics approval.
- Organizational representatives must distinguish personal experience from authorized organizational statements.
- Where compensation is offered, use a uniform modest honorarium that does not depend on answers or the provision of documents.

## 3. Identification levels

Offer three levels and record the choice:

1. **Named:** name and public role may be used.
2. **Role-described:** quotation may use a broad role and region after deductive-disclosure review.
3. **Anonymous:** no direct quotation without a separate quote check; combine or generalize details that could identify the participant.

The research team may apply stronger anonymization than requested when publication would expose the participant or a third party to foreseeable harm.

## 4. Sensitive financial and contractual information

- Ask for income as bands before requesting exact amounts.
- Never infer exact income from a band.
- Do not publish a contract, royalty statement, invoice, or platform dashboard without specific permission.
- Remove account identifiers, addresses, signatures, tax numbers, bank details, and platform login information at ingestion.
- Report payment disputes as allegations unless supported by documents, multiple independent accounts, or adjudicated records.
- Give organizations a fair opportunity to respond to material claims about their conduct without disclosing a participant's identity.

## 5. Harassment, discrimination, and political risk

- Warn participants before modules on harassment, censorship, family conflict, and political pressure.
- Do not ask for names of alleged perpetrators unless necessary and ethically justified.
- Store identifying allegations separately from the analytic transcript.
- Do not promise legal confidentiality beyond what the research team can actually provide.
- Prepare referral information for legal aid, mental-health support, or professional associations where the research institution can verify suitable services.
- Researchers must not intervene in an active dispute as advocates while also presenting themselves as neutral interviewers.

## 6. Community and regional research

- Avoid treating neighbourhoods, ethnic groups, or regional traditions as aesthetic raw material.
- Consult community participants about how places and identities are described.
- Credit translators, local researchers, and cultural advisers with consent and fair compensation.
- Do not publish precise locations for participants facing family, sectarian, political, or gender-based risk.
- Separate an artist's visibility from claims about material benefit to their community.

## 7. Public platform data

- Collect only data needed for the research question.
- Follow platform terms, rate limits, and public-access boundaries.
- Do not bypass privacy settings, access private groups, purchase leaked data, or attempt re-identification.
- For comments, store platform identifiers only when needed for de-duplication and replace them with research IDs before analysis.
- Paraphrase ordinary users in publication unless direct quotation is essential and ethically defensible.
- Do not reproduce full lyrics, videos, or copyrighted recordings in the research archive without permission.

## 8. Data classification

| Class | Examples | Storage and access |
|---|---|---|
| Public | Published articles, public platform counts, official credits | Project repository; source URL and capture date required |
| Internal | Coding notes, sampling decisions, non-sensitive analytic extracts | Encrypted project storage; research-team access |
| Confidential | Contact details, consent forms, named transcripts, income bands | Encrypted restricted folder; role-based access |
| Highly sensitive | Allegations, contracts, account statements, security or family-risk details | Separate encrypted location; principal investigator and designated analyst only |

Never place confidential or highly sensitive material in the public research package.

## 9. Security and retention

- Use encrypted institutional storage with multifactor authentication.
- Keep the participant key separate from transcripts.
- Do not send unredacted transcripts or contracts through ordinary messaging apps.
- Delete raw audio after transcript verification unless a participant explicitly consents to longer archival retention.
- Delete contact keys 24 months after publication or earlier when follow-up is complete.
- Retain de-identified analytic data for up to five years when permitted by consent and institutional policy.
- Log exports, external sharing, and deletion.

## 10. Quote verification and right of reply

Return sensitive quotations with enough context for participants to verify accuracy. Quote checking is not editorial veto over the study's analysis, but participants may withdraw their own quotation before the agreed deadline. For consequential claims about an organization, record the response, refusal, or non-response and assess whether publication could reveal the original source.

## 11. Researcher safety and reflexivity

- Conduct interviews in safe, mutually agreed settings.
- Use two-person protocols for unfamiliar locations or politically sensitive fieldwork.
- Record the researcher's institutional position, language, class, gender, diaspora status, and network relationship where these affect access or interpretation.
- Maintain a reflexive memo after interviews and case-study visits.
- Disclose sponsorship, brand relationships, platform access agreements, and conflicts of interest in every publication.

## 12. Publication safeguards

Before publication, complete a harm review covering:

1. Deductive disclosure.
2. Defamation and unverified allegations.
3. Copyright and quotation length.
4. Security and political exposure.
5. Community stereotyping.
6. Commercial confidentiality.
7. Whether charts reveal a participant through a very small cell.
8. Whether an apparently neutral ranking could materially damage a career.

Suppress, combine, or narratively summarize cells with fewer than five sensitive observations unless there is a compelling public-interest justification and ethics approval.

## 13. Incident response

Any accidental disclosure, lost device, unauthorized access, or mistaken publication must be reported immediately to the principal investigator and institutional data-protection contact. Pause affected analysis, preserve an incident log, notify participants when required, revoke access, and document remediation before work resumes.