There’s no shortage of content out there about how to do better evaluation and community research. In fact, we’ve published a lot of it! You can find frameworks, toolkits, and checklists for days. And a lot of it is good, helpful, stuff.
But when it comes to nonprofit community research compliance, there’s one conversation that keeps getting skipped: the operational and ethical infrastructure that holds your research together. We’re talking about the stuff that protects your community, your organization, and the integrity of your data before, during, and after you collect it.
IRB considerations, human subjects training, data sharing agreements, and data communication plans aren’t glamorous. None of them show up in the highlight reel when you present your findings to a funder.
But when they’re missing or cobbled together at the last minute they create real problems. Trust erodes, data can’t be used as intended, community members might feel abandoned or misused.
If you’ve ever been in a meeting halfway through a community survey where someone asks, “Wait. What did we tell participants we’d do with this data?” — you know exactly what we mean.
You Might Be Doing Human Subjects Research And Not Realize It
Many nonprofits and community-based organizations are doing legitimate human subjects research without realizing it. Community needs assessments, program evaluations with focus groups, surveys of service recipients — a lot of this work meets the definition of human subjects research and may require IRB oversight or, at minimum, documented ethical protocols that hold up to scrutiny.
A 2024 article in the American Journal of Public Health pointed to a persistent challenge: informed consent processes in community-engaged research are often designed to protect institutions rather than participants.
Forms are written at reading levels that don’t match the communities being studied, generated without community input, and longer than anyone is willing to actually read. This means participants end up signing things they don’t fully understand and eventually stop trusting these organizations that are meant to help them.
The same research highlighted that IRB delays disproportionately impact small nonprofit and community-based organizations, the very organizations doing some of the most important frontline research. When IRB processes aren’t planned for early, they become a bottleneck that damages relationships with community partners and delays the work.
IRB review and ethical protocols exist because community members deserve to know what they’re agreeing to, how their information will be used, and what recourse they have. Informed consent is a process and treating it like paperwork is one of the fastest ways to undermine the trust your research depends on.
Human Subjects Training: Who Needs It and When Does It Get Tracked?
Here’s a scenario we’ve seen play out many a time: a nonprofit hires a new evaluation coordinator mid-project. That person starts conducting interviews. Nobody checks whether they’ve completed human subjects research training because nobody thought to ask.
Most IRB protocols require that everyone with a significant role in the conduct of a study — including people who interact with participants, oversee data collection, or analyze data with identifying information — complete human subjects research training before the work begins.
According to NORC’s community-engaged research toolkit, this requirement extends to community partners, not just lead researchers. This can create a real coordination challenge for organizations working with multiple stakeholders across a project.
The problem compounds when you factor in staff turnover, volunteers, contracted evaluators, and partner organizations. Without a tracking system — even a simple one! — nonprofit community research compliance can easily become messy and overwhelming.
Some things worth building into your process:
- A training log that documents who completed training, which program they used, and when their certification expires
- A protocol for onboarding any new staff, volunteers, or partners mid-project
- Clarity on which training programs are appropriate — standard CITI training is designed for academic researchers and may not fully address the nuances of community-based work. Our PPRE training is designed specifically for community researchers.
This is one of those areas where a little infrastructure up front saves a lot of scrambling later.
Data Sharing Agreements
Data sharing agreements often become urgent at the exact wrong moment … usually when a funder, a board member, or a partner organization asks for access to raw data and you realize you never clearly defined who owns it or what “access” means.
A data sharing or data use agreement is a core piece of nonprofit community research compliance.
It answers questions like:
- Who owns the data collected?
- Who can access it, and at what level (raw, de-identified, aggregated)?
- How will data be stored, secured, and eventually destroyed?
- What happens in the event of a data breach?
- What are the limits on how partner organizations can use the data?
Research published in Social Science Medicine found that data sharing in community-engaged research creates distinctive ethical challenges around ownership, re-identification risk, and benefit-sharing that differ meaningfully from traditional academic research.
When community members are research partners, not just subjects, they have a reasonable expectation that their data won’t be repurposed or passed along in ways they didn’t anticipate or agree to.
For a community health survey, this might look like an agreement between your organization, the health department you’re partnering with, and any subcontractors, specifying that aggregate results can be used in public reporting, but individual-level data stays with your organization and is destroyed after two years. Having that conversation before the survey launches is dramatically easier than having it after a partner has already made requests that conflict with what you told participants.
We went deeper on this in our Data Collection Prep 101 post
Data Communication Plans
This is the piece that gets skipped most often in community research compliance and it might be the most important one for your long-term relationships.
A data communication plan answers a simple but often unasked question: How will findings get back to the people and communities who helped generate them?
Researchers have an ethical obligation to return results to participants. Sharing those results builds trust, helps community members make informed decisions, and can strengthen future research engagement. But most evaluation projects plan extensively for how findings will be reported up — to funders, boards, and policymakers — without planning for how findings will be shared back with the community.
What does a data communication plan include?
- Audience mapping: Who are the different audiences for findings — participants, community members, partner organizations, funders — and what does each group need from the results?
- Format decisions: A dense PDF report may be the right deliverable for your funder; it is almost certainly not the right format for the residents who participated in your needs assessment. Think plain-language summaries, community presentations, visual dashboards, or short videos.
- Timeline: When will findings be shared, and in what sequence? Participants and community members generally shouldn’t be the last to know.
- Feedback loops: Will community members have a chance to respond to findings before they’re finalized and widely distributed? Some organizations build in a review period for community partners, which strengthens both accuracy and trust.
Research published in PMC found that participants who received personalized findings — rather than only aggregate results — were more motivated to engage with the implications of the research and advocate for community protections. The format and timing of how you share back matters as much as the content itself.
Why Nonprofit Community Research Compliance Requires All Four
IRB review, human subjects training, data sharing agreements, and data communication plans – these four elements are often treated as separate compliance checkboxes. But they’re actually a coherent system, and treating them that way is the heart of sound nonprofit community research compliance.
Your IRB protocol informs your consent language. Your consent language needs to accurately reflect your data sharing agreement. Your data sharing agreement shapes what you can promise in your data communication plan. And your data communication plan closes the loop by returning value to the community that made the research possible in the first place.
When any one piece is missing or misaligned, it creates problems that ripple through the rest. And when they work together — planned intentionally and documented clearly — your research becomes more defensible, more trustworthy, and more useful.
This is what we think of as the infrastructure of ethical community research. It’s not the most exciting part of evaluation work, but it’s what makes everything else stand up.
Not Sure Where Your Compliance Infrastructure Stands?
If you’re reading this and thinking we’ve never actually mapped all of this out a) you’re not alone b) we’d love to help! Many organizations are doing genuinely good community research while running on informal practices, institutional memory, and good intentions.
We offer a free Research Roadmap Call for nonprofits and community organizations who want an honest assessment of where their research and evaluation infrastructure is strong and where it has gaps. We’ll look at your current practices around IRB compliance, human subjects training, data sharing, and data communication and give you a clear picture of where to focus.
And we promise, this is a conversation, not a sales pitch. If you’re preparing for a major evaluation, launching a community needs assessment, or simply trying to get ahead of the nonprofit community research compliance questions you know are coming, let’s talk.
Strong community research starts before the first question is asked and it doesn’t end when the data is collected. We’d love to help you build something that holds together from start to finish.