When the Case Study Is Your Employer: DBA Ethics, Data Protection and Confidentiality in 2026

For many UK executives, the obvious DBA case study is the organisation they already lead or work within. Access is easier, context is deep and the research problem is real. Yet insider access is not ethically or legally neutral. The researcher is also an employee, perhaps a manager, and potentially a board member. Colleagues may feel obliged to participate. Commercial information may be sensitive. In 2026, with greater scrutiny of data protection and research governance, a DBA based on one's own employer requires an explicit ethical architecture rather than improvised consent.

Step 1: Define the organisation as a participant, not a backdrop

Begin by clarifying what role the organisation will play. Is it simply a site for access, a source of documents, a case study subject, or a co-researcher in a practitioner inquiry? Identify the appropriate gatekeeper and the board sponsor. Distinguish consent to access the organisation from consent to participate as an individual. Map stakeholders, including those who may be affected by the research but not interviewed. A written organisational consent in principle is useful, but it should not replace university ethics approval or individual consent.

Step 2: Engage the university ethics committee early

Most UK universities require ethics approval before data collection. Submit early, and be candid about your dual role. The committee will want to see draft consent forms, a privacy notice, a data management plan and an explanation of how you will manage power differentials. If the research touches commercial sensitivity, explain how you will handle publication and confidentiality. Ethics committees may require safeguards such as an independent contact, a clear right to withdraw, or restrictions on interviewing direct reports. These requirements are not obstacles; they are part of the research design.

Step 3: Establish a UK GDPR lawful basis

Under the UK GDPR and the Data Protection Act 2018, research data must have a lawful basis and, where special category data are involved, an additional condition. Universities often rely on public task for research, while other lawful bases may be appropriate depending on the project. Consent is not always the best basis, particularly in an employment setting where power imbalances can compromise genuine choice. If the research involves health data, ethnicity, trade union membership or other special categories, identify the Article 9 condition and safeguards carefully.

A data protection impact assessment may be required for high-risk processing. Use university systems for storage and transfer rather than personal cloud accounts. Apply data minimisation, set retention periods and explain access rights. The organisation may be an independent or joint controller for employee data, so clarify roles with the university's data protection officer. A clear privacy notice should explain purpose, lawful basis, retention and rights.

Step 4: Secure board-level consent and manage commercial confidentiality

Board consent should cover access, data use, publication and the limits of anonymisation. Use confidentiality agreements where necessary, but avoid granting the organisation an unlimited veto over findings. Agree in advance how commercially sensitive material will be handled, who will review draft quotations and what timelines apply. Clarify intellectual property and the organisation's expectations regarding dissemination.

For listed companies, take advice on market abuse and inside information. Unpublished price-sensitive information should not be collected casually. Legal counsel and the university's research office should be involved early if the case study touches regulated disclosures or board-level strategy.

Step 5: Anonymise realistically

Anonymisation is more than replacing names with pseudonyms. Remove identifiers, aggregate roles, alter non-material details and separate the key from the dataset. In close-knit sectors, full anonymity may be impossible, and participants should be told this in the consent process. Consider whether the organisation itself needs to be disguised. If board members are identifiable by role, discuss that risk explicitly. Keep retention and destruction schedules and ensure that transcripts and recordings are stored securely.

Step 6: Manage insider-researcher bias and power

Keep a reflexive journal and declare your position in the thesis. Use supervision to test interpretations. Triangulate interviews with documents and, where possible, perspectives from outside your immediate team. Interview across levels rather than only among peers. Be alert to coercion: a written invitation from an independent source may be preferable to a request from a manager. Avoid interviewing direct reports unless robust safeguards are in place. Member checking can be useful, but it should not become organisational censorship. Seek out negative cases and disconfirming evidence.

Step 7: Plan publication and the aftermath

Agree dissemination with the organisation before fieldwork begins. Prepare for findings that challenge your employer. Ensure that your university supervision and ethics support continue through write-up. Keep records of decisions and approvals. Consider how the thesis will be published, whether an embargo is needed and how participants will be told about outcomes.

Conclusion

A DBA grounded in one's own organisation can be rigorous, valuable and deeply contextual. It is also a research project with legal and ethical obligations. In 2026, UK executives should treat ethics approval, UK GDPR compliance and commercial confidentiality as design features, not back-office compliance. When the case study is your employer, the quality of the ethical architecture is part of the quality of the research itself.