Most commercial market research does not require IRB approval. If you are running a customer satisfaction survey, testing new packaging concepts, or segmenting your customer base to guide a business decision, the Common Rule (45 CFR 46) generally does not apply to you.

That verdict changes fast under a few specific conditions:

  • Your project receives federal funding or is conducted under a federal agency’s oversight.
  • You are testing an FDA-regulated product (a drug, device, or diagnostic) where results factor into safety or effectiveness claims.
  • You are collecting identifiable private information tied to a design intended to produce generalizable knowledge.
  • Your subjects include minors, prisoners, or other vulnerable populations.
  • You are working under contract with a university, hospital, or other institution that requires IRB sign off regardless of your own status.

If any of those apply, or you are simply not sure, the fix is straightforward: submit a Human Subjects Research Determination (HSRD) request to an IRB or institutional research office before you collect a single data point. Get it in writing. A verbal opinion from a colleague is not a determination, and neither is your own best guess. The two regulatory frameworks that govern this entire question are the Common Rule and FDA regulations under 21 CFR parts 50 and 56. Everything below walks through how those rules actually apply to the kind of research Veridata Insights and firms like it run every week.

Key Takeaways

Most commercial market research skips IRB review because it isn’t designed to produce generalizable knowledge, but funding, FDA involvement, identifiable data, or institutional partnerships change that fast.

Point Details
Default verdict Standard commercial surveys and segmentation studies usually don’t require IRB review under the Common Rule.
Watch for five triggers Federal funding, FDA-regulated products, identifiable data, vulnerable populations, and institutional partnerships all force review.
Exempt still means submit Exempt status is a determination the IRB makes, not a self-declared skip; you still need it documented in writing.
HIPAA adds a layer Protected health information from a covered entity can require privacy board review on top of any IRB determination.
No retroactive approval Submit an HSRD or full application before fieldwork starts; IRBs cannot approve a study already underway.

Table of Contents

What counts as “research” and “human subjects” under IRB rules

The entire IRB question hinges on two definitions, and both come straight out of federal regulation rather than industry custom.

Under 45 CFR 46.102(l), “research” means a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge. That last phrase does the heavy lifting. A brand tracking study designed purely to inform your client’s next ad spend decision is not trying to generalize findings to a broader scientific or public understanding. It is trying to answer one company’s question. That distinction is why so much day-to-day market research falls outside the regulatory definition entirely.

“Human subjects” gets its own test. Under the Common Rule, a human subject is a living individual about whom an investigator conducting research obtains data through intervention or interaction, or obtains identifiable private information. FDA regulations use a parallel definition tailored to clinical investigations of regulated products. Notice both definitions require identifiability or direct interaction. Anonymous survey responses with no way to trace an answer back to a person usually sit outside this definition, even when the topic feels sensitive.

Put the two together and you get a simple two-step test that UC Davis IRB and most university research offices teach every new investigator: Is this project research? Does it involve human subjects? A “yes” to both means IRB submission is required, even if you expect the answer to be an exemption. A “no” to either one generally means you can proceed without IRB review.

Pro Tip: Publishing your findings, whether in a trade journal, a white paper, or a conference talk, does not by itself convert a business project into “research” requiring IRB oversight. The design intent at the start of the project is what matters, not what you do with the results later.

What counts as "research" and "human subjects" under IRB rules — overview diagram

Which market research projects actually need IRB review?

Most researchers want a fast gut check before they dig into the regulatory language. Here is how the common project types tend to sort out in practice.

Projects that typically skip IRB review include internal customer satisfaction tracking, routine A/B testing of marketing messages, standard concept and pricing studies, and segmentation work meant to shape one company’s strategy. WCG Clinical’s guidance on customer surveys makes the same point: feedback gathered to inform business decisions typically does not meet the Common Rule’s generalizable knowledge threshold, so it usually falls outside IRB jurisdiction.

Projects that often do need a look include anything manipulating a participant’s experience in ways that carry risk, surveys collecting identifiable health or financial data, research involving minors or cognitively impaired adults, and any study connected to an FDA submission for a drug, device, or diagnostic claim.

Doesn’t usually require IRB review May require IRB review
Anonymous customer satisfaction survey for internal use Survey collecting names, emails, or other identifiers tied to health status
Concept or packaging preference testing with no manipulation of risk Behavioral experiment that manipulates a participant’s experience or environment
Segmentation study for one company’s marketing strategy Any study supporting an FDA drug, device, or diagnostic claim
Pricing sensitivity research with de-identified respondents Research recruiting minors, prisoners, or cognitively impaired adults
Secondary analysis of a fully anonymized dataset Secondary analysis of a dataset with re-identifiable links or codes

The gray zones deserve their own mention. A pilot study that starts as a small internal test but is designed from day one to feed into a larger, generalizable academic partnership can trip the “research” definition even before you have real results. Similarly, secondary analysis of an existing dataset seems harmless until you learn the file still carries a code key back to individual respondents. Florida International University’s IRB guidance draws this line clearly: analysis of identifiable or coded private information usually requires review, while analysis of fully de-identified, anonymous data typically does not.

When does IRB review become mandatory?

A handful of specific triggers convert an ordinary commercial study into regulated human-subjects research. Run your project against this list before you build a fielding timeline.

Federal funding or agency oversight. Grants or contracts from NIH, NSF, or similar federal bodies bring Common Rule obligations with them, no matter how commercial the underlying question feels.

FDA-regulated product testing. Studies supporting a drug, device, or diagnostic’s safety or effectiveness claims fall under FDA jurisdiction. FDA’s stance is notably stricter than the Common Rule in some areas, including how it treats specimens and data, so don’t assume Common Rule exemptions carry over automatically.

Interaction with identifiable individuals. Direct interviews, focus groups where responses are recorded and linked to names, or datasets carrying re-identifiable codes all clear the “human subjects” bar.

Institutional partnership requirements. When a private company collaborates with a university or hospital, that partner institution’s IRB usually requires oversight of the entire project, even the portions your company would otherwise be free to run without review. This catches researchers off guard more than any other trigger, because the requirement comes from the partner’s policy rather than from federal law governing your company directly.

Publisher or sponsor mandates. A journal, conference, or client may require a written IRB determination before accepting your findings, independent of whether the law technically demands one. Solutions IRB notes that private companies increasingly seek this kind of voluntary review to satisfy exactly these outside requirements.

Exempt, expedited, and full-board review, explained

“Exempt” is one of the most misunderstood words in this entire field. It does not mean you skip the IRB. It means the IRB (or a designated official) reviews your project and determines it fits a category the Common Rule has decided carries minimal risk. You still have to ask. You still get a written determination.

Three review levels exist, and each fits a different risk profile:

  • Exempt review covers low-risk categories like anonymous surveys of adults, educational testing, and certain benign behavioral interventions, but the exemption determination still has to come from the IRB, not from the investigator’s own judgment.
  • Expedited review applies to minimal-risk studies that don’t fit a clean exemption category, often reviewed by one or two IRB members rather than the full board, which usually shortens the timeline.
  • Full-board review is reserved for research carrying more than minimal risk, involving vulnerable populations, or requiring careful ethical scrutiny; it means a convened committee meeting and a longer turnaround.

Most standard market research, when it needs review at all, lands in the exempt category. A good example: an anonymous survey of adults about product preferences where no names, emails, or other identifiers are ever collected typically qualifies for exemption. A study recruiting participants under 18 to test a new food product almost never does, and needs full-board attention regardless of how simple the questions seem.

FDA rules complicate this picture further. The FDA does not recognize all the same exemption categories the Common Rule allows, particularly for research involving regulated products. If your project touches a drug, device, or diagnostic claim, don’t assume a Common Rule exemption template applies. Confirm directly against 21 CFR parts 50 and 56.

How HIPAA and identifiable health data change the equation

Health-related market research adds a second layer of obligation that sits alongside, not instead of, IRB requirements. If your data source is a HIPAA covered entity (a hospital, health plan, or clearinghouse) and the information qualifies as protected health information, you may need a privacy board review or a formal HIPAA authorization in addition to any IRB determination.

The identifiability spectrum matters enormously here, and IRBs apply real distinctions across it. Fully de-identified data, stripped of the 18 HIPAA identifiers, generally carries the lightest review burden. Coded data, where a key exists somewhere linking responses back to individuals even if you never see that key yourself, gets treated much closer to fully identifiable data for review purposes. FIU’s IRB office draws this distinction plainly: identifiable or coded private information usually requires review, while fully anonymous, de-identified data usually does not.

One trap catches researchers who work with “restricted use” or “limited use” datasets licensed from health systems or research consortiums. Those labels sound protective, but if the underlying file still contains identifiers or linkage codes, IRB requirements can still apply even though the data provider has already added contractual restrictions. Contractual limits on data use and regulatory review requirements are two separate things, and satisfying one does not satisfy the other. If your projects regularly touch health data across state lines or international respondents, it’s worth reviewing how privacy compliance standards intersect with market research more broadly.

Getting a written determination: HSRD, timelines, and cost

Once you suspect your project might need IRB attention, the process itself is not complicated. It just needs to happen before fieldwork starts.

  1. Draft a project summary. Describe your purpose, target audience, data elements, and whether you intend the findings to generalize beyond your own business decision.
  2. Submit an HSRD or NHSR request. Most institutions and many commercial IRBs offer an abbreviated Human Subjects Research Determination form specifically for this question rather than a full application.
  3. Wait for a written determination. An institutional office or IRB reviews your summary and issues a formal memo, either a Not Human Subjects Research (NHSR) letter or a directive to submit a full application.
  4. If review is required, choose the right track. Based on the determination, your project routes to exempt, expedited, or full-board review.
  5. Hold data collection until approval or NHSR is in hand. No exceptions. IRBs cannot grant retroactive approval once fielding has already started, as multiple institutional FAQs make explicit.

Timelines vary by institution and complexity, but initial HSRD determinations often turn around faster than full applications, sometimes within a couple of weeks when the project is straightforward. Full-board review, by contrast, requires a convened committee meeting and can take considerably longer, particularly if your submission needs revisions. Fee structures vary across commercial IRBs depending on project complexity, review type, and amendments required.

Institutional researchers frequently submit through portals like IRBNet, while some universities run their own systems such as HawkIRB or TOPAZ. Commercial options exist too. WCG Clinical operates as one of the larger industry IRBs handling FDA-regulated studies, and smaller firms like Solutions IRB serve private companies that need a determination without an academic affiliation. A written NHSR memo is worth requesting even when you’re fairly confident review isn’t required, because sponsors, journals, and institutional partners will often ask to see it before they’ll accept your data.

A practical checklist to keep IRB risk under control

You don’t need a compliance department to run IRB-conscious market research. You need a documentation habit, and it’s a lot less painful than it sounds.

Build a short document pack before fieldwork begins on any study that touches sensitive topics, health information, or vulnerable populations:

  • A one-paragraph purpose statement describing why you’re running the study and who will use the results.
  • A note on whether findings are intended to generalize beyond your own client’s decision.
  • A list of every data element you’ll collect, flagged for identifiability.
  • Recruitment scripts and screener language, reviewed for anything that implies coercion or misrepresents the study’s purpose.
  • A data retention and destruction plan, including who has access to raw files.

Consent language for low-risk commercial surveys doesn’t need to read like a clinical trial waiver. A short, plain-English statement describing the purpose, voluntary nature, and anonymity of the survey usually covers it. Implied consent, where starting the survey counts as agreement, works fine for low-risk anonymous studies; explicit signed consent belongs in higher-risk work involving identifiable data or vulnerable groups. If you’re working with any subcontractor or data vendor, confirm in writing that they’ll maintain de-identification standards and sign a proper data-use agreement before they touch a single respondent record. Our own experience managing recruitment for hard-to-reach audiences has shown that vendor due diligence up front saves weeks of cleanup later.

Pro Tip: If you’re seeking voluntary IRB review purely for reputational reasons, or because a client insists on it, submit before you touch the field and specifically request a Not Human Subjects Research memo. That single document does more to satisfy skeptical stakeholders than any internal compliance statement you could write yourself.

Veridata Insights builds this kind of documentation into project scoping as a matter of course. Whether you need a straightforward HSRD packet prepared or full support running a study that’s already cleared IRB review, our team designs the methodology and recruitment so your ethics paperwork and your fielding timeline move together instead of fighting each other. We work with B2B, B2C, healthcare, and hard-to-reach audiences seven days a week, with no project minimums, so whether your study needs a five-minute exemption check or a full sensitive-population design, we can scope it without slowing you down. Reach out to Veridata Insights before your next fielding date, not after.

Frequently Asked Questions

Does every market research survey need IRB approval?
No. Standard customer satisfaction and preference surveys designed to inform one company’s business decisions generally fall outside the Common Rule’s definition of research, so they typically don’t require IRB review.

What’s the difference between IRB requirements for market research and academic research?
Academic and federally funded research almost always falls under Common Rule oversight because it’s designed to produce generalizable knowledge. Commercial market research usually isn’t designed that way, which is the main reason IRB requirements diverge between the two.

When is IRB approval required for a private company’s study?
IRB approval becomes necessary when a project receives federal funding, involves an FDA-regulated product, collects identifiable private information as part of a generalizable design, includes vulnerable populations, or runs under contract with an institution that mandates review.

How do I get a Not Human Subjects Research determination?
Submit a project summary through an HSRD form to an IRB or institutional research office describing your purpose, data elements, and identifiability. The office issues a written memo confirming whether the project qualifies as NHSR.

Can an IRB approve my study after I’ve already started collecting data?
No. IRBs cannot grant retroactive approval. Submission and approval, or an NHSR determination, must happen before fieldwork begins.

Does an exempt determination mean I can skip the IRB entirely?
No. Exempt status is a category the IRB assigns after reviewing your project. You still need to submit for that determination and keep the written documentation on file.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

Frequently Asked Questions — overview diagram

Sources

For legal and regulatory claims, go straight to the federal source rather than a summary article. For practical, day-to-day decision guidance, university IRB FAQ pages and industry-facing explainers tend to translate the regulation into plain language faster.