How can you conduct user research in a regulated industry?

In my experience, it's impractical to know all applicable regulations before starting your research as a product manager. In a regulated industry like automotive, those regulations change continuously and have geographic variances. You'd have to be on top of what different bodies (NHTSA, EPA, DOT, ...) have published and on what is being discussed on well-known associations like SAE. There are obviously regulations like GDPR/CCPA which directly impact how user research is conducted, but others like safety-related ones also influence the context in which this research is conducted so the list to monitor is massive. My recommendation is to involve local Legal and Compliance experts from the get-go (in-house/external) for tailored advice.

With my experience, even though conducting user research in a highly regulated industry is tough. However, if by following all the regulations and confidentiality ( often respondents ask not to be named), you are able to get some experts; they are more likely to be helpful and find SME (subject matter expert) when compared with other industries. Some firms resort to paying the interviewers, however it could be regarded as bribe in certain industries. In these industries, the experts are often more interested in some of the findings of your study so far. So have in depth understanding of the industry before you approach them !

3 key points here: Data Privacy and Protection: Compliance with regulations like HIPAA or GDPR safeguards participant privacy, avoiding legal repercussions and reputational damage. Informed Consent: Obtaining explicit, informed consent in regulated industries, where participants must fully understand the risks and benefits, aligns ethical research and avoiding penalties for non-compliance. Confidentiality and Non-Disclosure: When regulations governing confidential information and NDAs aren't adhered to, breaches can lead to legal actions, emphasizing the importance of maintaining trust and integrity in the research process. Regulatory compliance helps mitigate legal risks in user research within regulated industries.

Banking is a highly regulated industry. In banking , before beginning user research - familiarize yourself with some of the key terms that affect your project / work area. PII ( personally identifiable information) is a good example. Your ability to understand and acknowledge the regulations combined with your readiness to harness the SME knowledge of your focus group and with the right interview / research template - you are destined to a productive user research . This will ensure you come out with great insights to the product team.

The majority of regulations affecting user research have to do with data privacy and how you are processing and distributing the findings or how you are acting on them. It may not be practical for a product manager to be aware of all regulations for their industry, but it may be worth consulting with the in-house counsel or the DPO on any possible red flags before starting to source for your research.

One thing I've found useful is not being fixated on the methods we use for collecting user research data. Some times, where the user leaves a digital trail, you can use that information, with the user's explicit consent, to build your research. Then you could conduct closed user panel discussions, in order to validate your original hypothesis. Or you could select expert users, from the different target groups, to arrive at your research conclusion. But above all, what's important is to ensure that the means of collecting data, the communication around why the data is being collected, the end results are all transparent to the users, on whom you're basing the research.

Consider a scenario where a financial institution is conducting user research to improve its mobile banking app. Adapting research methods allows the organization to comply with financial regulations governing the handling of customer data. In this context, ensuring informed consent includes explicit explanations about data usage, encryption practices, and adherence to banking industry privacy standards. Failure to adapt methods could lead to regulatory breaches, legal consequences, and erosion of customer trust, highlighting the vital importance of aligning research practices with industry-specific regulations.

A useful thing to remember is that all heavily regulated industries will have the established best practices of enforcement of those regulations. Meaning that you may want to either avoid or purposefully ask specific questions that reveal to you how the users navigate those best practices and how your product may benefit them.

See diversity of things really bring things to shine and AI really really needs data so the more data we have the better. I would also suggest that we be very careful where and from whom we are getting the data. The data should be as correct as required for the situation. A person's view is a perspective from their lifestyle and circumstances. It is critical we get as much data as possible from the place where our product and service is going to be deployed. The other thing is the look and feel how we use that data to present out services and product matter a lot. It also depends on location and by the kind of people we are making the product for. I know certain industries like pop and glow as their target audience is that

Adaptar el método, es una herramienta tremendamente exitosa para sortear algunos obstáculos. Es por eso que una de las mejores recetas para realizar esta tarea, es armar un equipo de trabajo de múltiples experiencias. Esto nos pondrá en una especie de carrera, en la que partiremos con cierta ventaja, debido a que contando con personas con experiencias en la materia, sumado a personas dentro del equipo que traigan otras experiencias, hará que éstas últimas no tengan la limitante de las personas del sector en el que estamos investigando. Estas personas de otras industrias tendrán una tendencia natural a "pensar fuera de la caja", mientras que a las personas con experiencia en la industria que estemos investigando es resultará más difícil.

What comes after you collect the data is what is most crucial in my experience. Anonymizing your users data and then feeding it into your data models is of paramount importance, especially now with DPDP act india, and similar digital privacy acts around the world. Removing PII or personally identifiable information from the input stream, either by masking it, or hashing the values must be practiced. Some orgs practice limited access of such information. Though I'd recommend masking / encoding.

This is not a problem for one team or product. As a business you should have established rules on how you use and store data that teams can follow when doing research. Partner with your data and security teams to understand this ahead of starting research so you know what, how and why early so it doesn't block your team later. Also those partners will really love and appreciate you taking the time to get better educated to keep customers and the business safe

You have to train your product team- from PM to dev to QA - to have compliance by design. Its the same for other regulatory topics like accessibility. The difference is its easy forget when your processes don’t test for it.

Anonymise all data, strip it of any personal identifiers and aggregate only those pieces that are relevant for your research. If you cannot anonymise the data, make sure that you purge it after you're done with the research and make sure you inform your participants ahead of time on which of the two you intend to do.

Protecting things digital or physical is on every one's mind but digital can be very tricky. The problem is two things we want convenience and security, and they are the opposite of each. One of the ways to protect critical data so no personal identifiable detail is shown or leaked by mistake is to create a pipeline and when data is collected just injest it in that. It normally encrypts it or does some modification so that the personal identifiable things are hidden. The rest of the data can then be used to perform analytics or some other use case as required.

In regulated industries, conducting user research involves adapting methods to comply with specific laws. This includes legal compliance reviews, robust informed consent processes, and secure data handling. In healthcare, adherence to HIPAA regulations is essential. Communicating research findings ensures regulatory compliance, driving continuous improvement, and maintaining transparency and trust within the organization. A pharmaceutical company, sharing insights from user research on a patient portal helps align products with regulations and fosters trust among stakeholders.

When in doubt, go for aggregated and individual-agnostic data. Ultimately, this is what you want unless you're in product sales.

Today the world is a maze of data. The problem is a lot of it is personal identifiable ones. We cannot share it because of laws, plus if it becomes known it causes a lot of backlash. The most important thing to remember is a technique known as zero trust. It is of critical importance when dealing with financial, healthcare data and these two are the biggest industries which bring a lot of revenue plus benefits to society. The easiest way is to build a pipeline and standard format to modify the personal identifiable data using encryption and other techniques so the data can be used for analytics and other services without any legal and ethical concerns The process is a lot easier today due to the presence of cloud