Institutional Review Board (IRB)

What is the Institutional Review Board?

The Institutional Review Board (IRB) is primarily a faculty committee charged with reviewing all human subjects research to ensure the protection of human subjects. Any and all research that uses human subjects must be submitted to the IRB for review.

The IRB must ensure:

  • risk to the subjects is minimized and anticipated benefits are sufficient to justify the risk
  • existence of sufficient informed-consent/assent processes and documentation that protect subject autonomy and voluntary participation
  • equitable selection of subjects
  • subjects' privacy and that the confidentiality of data are protected
  • that researchers abide by the EU's General Data Protection Regulation (GDPR) guidelines when EU residents are involved.

The IRB has the authority and the responsibility to disapprove any research project that does not meet all of these requirements.

See the list of current IRB members.

What is considered human subjects research?

Research is any systematic investigation that contributes to generalizable knowledge.  For an investigation to be considered research, its goals must include dissemination of some sort. Investigations that are meant simply to describe what is being investigated are not considered research, nor is any investigation in which a goal is not to disseminate the information at all.  The following are no longer considered to be research and therefore do not need to be reviewed by the IRB: oral histories, journalism, legal research, most public health surveillance activities, collection and analysis of biospecimens or criminal justice records with no identifiable information, and unidentifiable information relating to homeland security, intelligence, and security activities.

Human subjects research includes any research that uses individuals and/or identifiable information about them. Any investigation that includes data collected from or about humans is considered human-subjects research, even if the investigator has no direct contact with individuals, and must be submitted to the IRB for review.  Further, obtaining, storing, using, studying, analyzing, or generating private information or identifiable biospecimens falls within the definition of human subject research and therefore requires IRB review and approval.

Will your research include human subjects in the European Union?

If you plan to conduct research that gathers personal information from individuals residing in the European Union (EU), either online or in person, or personal data gathered in the United States will be transmitted to the EU, there are additional regulations and requirements involved that you must attend to.

The General Data Protection Regulations (GDPR) were adopted by the European Commission and became effective on May 25, 2018.  The intent was to strengthen and unify data protection for all individuals within the EU. The GDPR requires that any researcher gathering personal information on individuals with the EU must acquire consent from each subject.  These regulations extend to colleges and universities in the United States, including SUNY institutions.  As SUNY Empire State College has students, alumni and employees across various locations in the EU, these regulations are of particular relevance.

To learn more about SUNY's guidance on the EU's General Data Protection Regulations - SUNY's GDPR Guidance (PDF 65kB)

Please provide the following documents to human subjects participating in your study who reside in the EU:

  1. Consent Form for Human Subjects Residing in the EU (coming soon)
  2. SUNY's GDPR Privacy Notice (PDF 255kB)

If you have further questions relating to your research project and GDPR, please contact Sadie Ross, Director of Compliance, at

Personal Data Breaches

If you are an individual participant in a reserch study that falls under the GDPR guidelines and you feel that your rights as outlined by the GDPR have been breached, plase contact Todd Myles, SUNY Empire State College's Data Protection Officer at

What is the process of applying for IRB approval?

  1. Fill out the IRB application (protocol).
  2. Complete and pass either the initial or refresher CITI Program training.
  3. Submit the IRB application (protocol) and all supporting documents to
  4. Your application submission will be reviewed in accordance with the three levels of IRB review.
  5. Work with the IRB to answer any questions or revise your application, as needed.
  6. Receive formal approval (good for 1 year).
  7. To continue a project past the 1 year approval, complete and submit an IRB Continuation Form.
  8. To modify a project, complete and submit an IRB Modification Form.
  9. At the end of the project, you must close it down.

How long does an IRB review take?

The IRB reviews applications on a rolling basis, meaning we review them whenever they are submitted.  For most exempt and expedited applications, our goal is to complete the review within three weeks.  Applications that require additional feedback (as determiend by the Board) from the principal investigator (PI), or those that require a full Board review may take longer.

More Information

Frequently Asked Questions

Policies, Procedures and Other Links