ORIGINAL RESEARCH & NEWSWORTHY CAMPAIGNS
SITETRAIL CERTIFIED
Your learning path: 12 lessons.
Module 01 / Lesson 04 · Read, apply, check
Create a practical permission and data-handling plan that supports a useful public report without exposing confidential material.
Describe what information the agency needs, why it is needed, who will work with it and what the public will eventually see. Separate permission to analyze a client’s records from permission to identify customers, quote employees or distribute source files. A client may approve an internal analysis while a public case example still requires additional review. Ask the appropriate data owner to confirm the available authority and restrictions. Keep the request proportionate: if the question needs response timing, the analyst may not need names, email addresses or message bodies. A smaller approved extract can reduce both handling effort and avoidable disclosure risks.
Give the research team the approved information needed for analysis, the editor a checked aggregate table and the public a clear report with sufficient methodological detail. These layers do not have to contain identical material. Maintain the original authorized source in its appropriate controlled location, with a versioned working copy and an access record. Use the client’s approved tools and storage arrangements. Do not upload confidential records into a convenient AI service merely because it can summarize spreadsheets. Where AI assists with non-sensitive drafting or analysis code, review its output and keep data access within the agreed process and purpose.
Removing names does not automatically make a record safe to release. A combination of location, exact date, unusual transaction and business role may identify a person or organization. ICO guidance distinguishes anonymisation from pseudonymisation and emphasizes identifiability assessment. Apply that distinction through the appropriate privacy or data specialist rather than declaring a dataset anonymous because names were replaced with codes. Consider aggregation, broader categories, omitted details or a synthetic illustration where these preserve the teaching or reporting purpose. There is no universal small-cell threshold that guarantees safety in every context; the surrounding information and likely audience knowledge matter.
Keep an approval register covering the report, charts, quotations, case examples, journalist files and any later adaptations. Identify the person who can authorize each item and record the approved version. Check for hidden spreadsheet tabs, comments, metadata and embedded information before sharing files. Agree how long working material is retained and how accidental disclosure or a later correction will be handled under the organization’s process. These steps should produce a usable release package, not an indefinite approval queue. When raw data cannot be shared, explain the restriction accurately and provide the strongest permitted aggregate evidence and method detail instead of pretending unrestricted access exists.
Define analysis and public-release uses separately.
Provide only the approved material each role needs.
Check identifiability and hidden file content.
Record release versions and a correction route.
RouteDesk’s approved extract contains request identifiers, timing fields and broad categories, but excludes buyer names and message text. The analyst uses a controlled working copy, while the editor receives aggregate tables and a documented calculation trail. One proposed case identifies a small supplier through an unusual date and location even after its name is removed. The team replaces it with a clearly labelled synthetic illustration and asks the appropriate owner to review the remaining categories. A journalist evidence pack includes the method, counts and a safe aggregate table, not the confidential source export. The approval register records which spokesperson quotation and chart version may be released. The campaign remains useful because readers can understand the finding and its limits without being given information that was never approved for public distribution.
Another agency removes the name column and emails the entire workbook to a wide press list. Hidden tabs contain contact details, and a distinctive transaction makes a supplier recognizable. The account manager assumed that client approval of the project covered every later disclosure. The failure came from treating analysis permission, anonymisation and public release as one decision. A defined extract, layered access and file review would have identified the problem before distribution.
Transparency does not require exposing every underlying personal or commercially sensitive record. It requires an honest account of what was done and what evidence can appropriately be inspected. Equally, confidentiality should not be used as a vague excuse to conceal a weak calculation. Provide clear aggregate results, definitions and permitted verification materials, while stating genuine access limits rather than promising data the agency cannot share.
This lesson is a workflow guide, not a determination of legal compliance. The client’s qualified privacy, security and legal owners should resolve applicable obligations and permissions. Do not collect unnecessary personal information, promise anonymity without assessment or disclose restricted source material to journalists or external tools merely to make the campaign easier to produce.
Do this today · 30 minutes
Create RouteDesk’s permission and release register.
Use a document or spreadsheet and the fictional RouteDesk case. All course figures are synthetic teaching data. No purchase, confidential data, real survey recruitment or contact with journalists is required.
Before: A desired headline with an unclear evidence base, audience and release process.
After: A bounded, reproducible finding connected to a useful audience question and an accountable campaign plan.
Notes stay in this browser. Download a copy to keep them.
Ask a colleague to challenge the claim, denominator, permissions and audience fit. Record the revision, owner and review date before using the approach with a real client.
Before you move on
The client approved analysis of its records, but a workbook contains hidden contact details and a small case can identify a supplier despite name removal. A journalist asks for the evidence. What should the agency provide while resolving the release permissions and identification risk?
Next lesson →ICO: anonymisation and identifiability guidance
PRSA: professional ethics and disclosure
Lesson edition 1.0 · References reviewed 17 October 2026 · Practical exercise reviewed 17 October 2026. Examples are illustrative teaching scenarios.
Sitetrail service · NewsPass
Put your SEO, PR and generative engine optimization strategy into practice. NewsPass supports search visibility, media presence, brand credibility and discoverability in AI answers.
Compare the delivery costs for your campaign using the same calculator as the Sitetrail homepage. Choose a target authority range, your typical placement cost and expected monthly volume.
Illustrative cost comparison using October 2026 plan prices; check current terms before purchase. Assumes one eligible placement per credit and comparable selected opportunities, not a prediction of rankings, revenue, coverage or AI citations. Actual suitability depends on audience fit, editorial requirements and the current plan terms. DA/DR are third-party metrics, not Google scores.
Choose publications available on your plan, prepare useful content for the audience and submit it for editorial review. Track accepted placements in your dashboard and evaluate them against your campaign goals.
Useful questions. Defensible findings. Relevant stories.
Use the worksheets to turn each lesson into a real decision. Build a research-led campaign from a useful question, checked evidence, clear limits and relevant audience needs.
Course outline · Free assessment · Privacy
No account is required. Progress, first-attempt lesson answers, worksheets and assessment results are stored in this browser when storage is available. They do not sync across devices. Download copies to retain them; clearing browser data removes local records.