While some research studies pose very little risk to subjects, there’s no such thing as an entirely risk-free study. Even if a project involves nothing more complicated than looking at previously collected information to gather study data, there’s still a risk of loss of confidentiality of private information. This same risk applies to studies involving subject interaction or interventions. So all new submissions should address the risk of loss of confidentiality in the new submission form, protocol, and, if applicable, the consent form.
Steps to protect confidentiality of data should be mentioned in the “Risks” section of the new submission form. The protocol’s “Data handling and recordkeeping” section is the appropriate place to describe how the collected data will be protected. And the risk to confidentiality should be mentioned in the risks section of any consent form. Language appropriate for all of these sections would address how the data will be stored, whether it will have direct identifiers or be coded, and who will have access to it.