ESOMAR Code of Conduct

The ESOMAR Code of Conduct is the ICC/ESOMAR International Code, a set of self-regulation rules for market, opinion and social research and data analytics. It applies to everyone involved, qualitative or quantitative, including those using self-service platforms.

It rests on five principles:

• research must be legal, honest, transparent and truthful;
• it must be conducted with due care;
• people must be told how their personal data is used, and it must be protected;
• researchers must behave ethically;
• researchers keep overall responsibility, whatever method or technology they use.

The 13 articles fall into four groups: duties to data subjects (Articles 1 to 6), to clients (7 to 8), to the public (9) and to the profession (10 to 13). A data subject is any person whose data is used in research, so in a focus group, a participant. The Code is mandatory for ESOMAR members and for members of associations that adopt it.

It reaches India through MRSI. MRSI says it wholly adopted the ICC/ESOMAR code in 2023. Its members approved the 2025 edition on 2 December 2025, effective 1 April 2026, so as of October 2026 it is in force. Observance is mandatory for MRSI members, and its Professional Standards Committee can discipline up to terminating membership. Trade press reported the adoption the same day.

How the Code reaches research in India

ESOMAR's complaints process accepts complaints from anyone but mainly covers its members. Sanctions run from a private warning to expulsion and publication.

Contracts carry the Code further. Article 12(a) requires researchers to make sure clients and subcontractors agree to comply, and encourages a contract clause. Adding one is advisable.

Of the 85 uses of the word "must" in Articles 1 to 13 of the July 2025 Code, 45 fall in the six articles about data subjects. This is a rough guide to emphasis, not a count of separate duties. The table splits the count by group.

Article 4 (primary data collection) and Article 6 (data protection and privacy) hold 27 of the 85 between them. Article 7 (fit for purpose) adds 12. When you vet a supplier, spend most of your time on how people are approached, consented, kept and anonymised.

A compliant qualitative study tells participants, before they agree, who may watch and record, how long data is kept and whether they will be contacted again. It gets client agreement to confidentiality, pays incentives as stated, and reports quotes so nobody can be identified.

The ESOMAR/GRBN Guideline for Researchers and Clients Involved in Primary Data Collection (published 2019, which predates the 2025 Code), section 9.3, says participants must be told that clients may watch, in what form, and how personal information is protected. Clients must agree to collect only what participants agreed to share and to keep it confidential. Article 6(a) bars passing personal data to the client without consent for that purpose.

Use this table with any recruiter or agency. A starter clause: "The supplier will carry out this study in accordance with the ICC/ESOMAR International Code (2025) and the MRSI Code of Conduct, and will bind its subcontractors to the same." This is a suggestion, not legal advice. For the consent wording itself, see informed consent in research; for the questions that screen people in, the research screener template.

Five misreadings are worth correcting before you sign a contract:

• Myth: "It is ESOMAR's code alone." Fact: It is joint with the ICC.
• Myth: "It is law." Fact: It is self-regulation. Article 11(a) also requires compliance with applicable law, and where the Code sets a higher standard, that standard applies.
• Myth: "It binds only suppliers." Fact: Clients carry duties too, including making sure contractors they hire know and follow the Code.
• Myth: "It is for surveys." Fact: It covers qualitative research, and the guidance names focus groups and in-depth interviews.
• Myth: "The Code's definition of a child settles the age." Fact: The Code defines a child as 12 or under and a young person as 13 to 17, and says applicable law may define them differently. In India, the Digital Personal Data Protection (DPDP) Act, 2023 treats anyone under 18 as a child and requires verifiable parental consent (section 9). The DPDP Act 2023 Rules were notified on 13 November 2025, and most duties apply from 13 May 2027.

• Deductive disclosure: identifying a person from combined details, even with the name removed (Article 6(c)).
• Data minimisation: collecting only what is reasonable and directly relevant (Article 3).
• Synthetic persona: a digital stand-in for real people, which must be disclosed to the data subject at the start (Article 4(a)(ii)).
• MRSI: the Market Research Society of India, the body that carries the Code to Indian members.

Qualfacto recruits people for, and runs, qualitative studies in India: in-depth interviews, focus groups, diary studies, ethnography, online bulletin boards, in-home product tests, shop-alongs, usability sessions and opt-in behavioural tracking. Its approach is guided by the professional standards of MRSI and ESOMAR, alongside India's Digital Personal Data Protection Act, 2023.

Rows of the table that its current practice covers:

• Participant identity checks run before invitation, and only adults register.
• Reward amount, payment method and timing are communicated before participation, and rewards are earned once the stated requirements are completed and validated.
• Panel profiles are not used to sell or market products.
• Behavioural tracking is opt-in, with explicit permission.
• Participants can request access, correction or deletion of their data, and personal information is not sold.
• Data goes to research clients only when a study requires it and the participant has been told.
• Deliverables are agreed before a study begins.

A formal data retention and deletion policy is being established, and compliance under the DPDP Act, 2023 is under review.

For what a panel should show you, see our panel quality checklist and our guide to participant incentives.

To test this on a real study, email your research brief to support@qualfacto.io or message Qualfacto on WhatsApp. It aims to reply within one business day, Monday to Friday, 10:00 AM to 6:00 PM India Standard Time (IST), and offers a free pilot.