The IRB may require you to put information in the consent form describing how subject data will be stored. If you are storing all data with only a code rather than direct identifiers, you should include consent language saying something like, “Your personal information will be identified only with a code and will not include anything that directly identifies you.”
However, if you’re keeping a key to the code, you need to let the subjects know that as well. So, in the above example, you’d need to add something like, “The study team will securely store a separate list that allows us to reidentify data using the code.”
Including this information in the language you initially submit to the IRB may spare you a contingency later on.