Privacy requirements belong at the start of a market research checklist, not the end

What to take away

• Assign an owner and evidence threshold to every material assumption.
• Save source dates, instruments, participant context, exclusions, and contradiction records.
• Complete privacy, quality, reproducibility, and stopping checks before releasing the memo.

A startup market research checklist should connect every research task with a decision. Assign owners, save source dates, document participants and methods, and preserve evidence that contradicts the founding idea.

Set privacy requirements before selecting tools

NIST's guide to using the Privacy Framework 1.1 describes using current and target profiles, gaps, priorities, implementation plans, and progress measures. Adapt it with privacy specialists to research purpose, collection, access, retention, vendors, and deletion.

Decision and scope

• Write the decision, alternatives, owner, deadline, and cost of error
• Define buyer, user, payer, geography, industry, use case, and exclusions
• List assumptions and the evidence that would weaken each one
• Set success, guardrails, stop conditions, and the next review trigger

Secondary evidence

• Select official population, business, employment, and regulatory sources
• Record dataset, field, code, units, geography, measured period, and release date
• Map direct products, workarounds, outsourcing, delay, and doing nothing
• Separate documented facts, observed facts, third-party claims, and unknowns

Primary research

• Recruit recent users, buyers, non-adopters, and negative cases
• Document screening, source, incentives, consent, recording, and missing groups
• Ask about the last event, behavior, cost, alternative, authority, and outcome
• Observe workflows and artifacts with permission rather than relying on opinions

Survey and digital signals

• Define the population and sample source before writing a questionnaire
• Pilot neutral questions, complete options, recall periods, and eligibility
• Report instrument, recruitment, mode, dates, sample, weighting, and limitations
• Save search query, topic, category, geography, period, and normalization limits

Market size and behavior

• Use eligible units, problem incidence, frequency, price, reach, and capacity
• Build low, base, and high cases with a source for every assumption
• Test a truthful commitment such as a pilot, deposit, introduction, or repeated use
• Record refusals and diagnose segment, channel, trust, timing, offer, and price

Synthesis and release

• Tag evidence by source, segment, method, date, and confidence
• Preserve contradictions, exceptions, study limits, and unresolved questions
• Write the conclusion, rejected alternatives, next action, and review trigger
• Restrict personal data, set retention, and keep research separate from marketing

Final quality check

Confirm each material conclusion has a traceable source or coded research record and no quote is stripped of context; check that participants understood the purpose and that follow-up matches their expectations. Have a second person reproduce the market-size calculation and challenge the strongest claim.

Record unresolved uncertainty rather than replacing it with confident language. Release the memo only after the decision owner accepts the stated limits and next review trigger.

Quick comparison

Gate	Required record	Block release when
Decision	Owner, alternatives, threshold	No action can change
Method	Population, source, instrument	Inference exceeds design
Protection	Notice, access, retention	Use is unexpected
Release	Sources, limits, review	Claim is not traceable

Keep online research distinct from promotion

The ESOMAR and GRBN online research guideline addresses transparency, participant identity, data use, passive collection, researchers' responsibilities, and separation from non-research activity. Apply current local requirements and professional advice.

Record the gate result

The W3C Privacy Principles statement gives web-system designers shared privacy concepts and warns against shifting privacy work to individuals. Apply it to startup market research checklist, then review the governing law and configuration.

The CISA software acquisition fact sheet covers development practice, supply-chain exposure, deployment, and vulnerability management. Add those government-acquisition questions to a startup market research checklist review without treating them as local approval.

Common questions

Who should own the checklist?

The decision owner should accept the scope and limits, while named research, privacy, legal, security, and operational reviewers own their applicable checks.

Must every startup use every method?

No. Use the smallest combination that can answer the decision credibly and proportionately.

What should block publication?

Block release when a material claim lacks traceable evidence, the method is misrepresented, a quote loses context, or participant use violates the approved plan.