Last updated: 2026-10-06

U
Undergraduate level

Ethics, Security, Sustainability, and Professional Conduct

A project carries obligations beyond its assessment. It may involve people who take part in it, data about people, systems that others will depend on, and resources that have costs. These obligations are easy to overlook while the work is focused on the question, and they are usually easier to meet when they are planned from the start than when they are discovered at the end.plan early to avoid late-stage panic

This page sets out the four areas a project should check: ethics, security, sustainability, and professional conduct. For the detailed material, it links to the pages that already cover each one, and it adds guidance on applying them to a project.

Ethics

Any project involving people needs an ethical review before data is collected, and most universities require one. The review is not a formality. It asks what participants will be told, what they consent to, what data is collected and how long it is kept, and what risks they face. A project that changes any of these after approval needs to seek approval again.informed consent is the core of human research

The general principles are in Professional Ethics, and the particular concerns of studies involving people are in Research Ethics. For a project that uses AI systems or generates AI-related outputs, AI Ethics covers the questions that are specific to those systems. Studying Ethically: Beyond the Rulebook is a useful companion to the formal requirements, because it addresses the cases the rules do not anticipate.

Note well. Ethical approval covers the study as described. A change in what you collect, who you collect it from, or what you do with it needs to go back to the approving body before you act on it.

Security

Projects that handle data, run services, or connect to other systems have security responsibilities, and student projects are a common source of accidental exposure. Typical problems include credentials committed to a public repository, test servers left open to the internet, and personal data copied into a development environment with weaker controls than the original.env files are not a security boundary

The principles that prevent most of these problems are in Security Design Principles. For access control at the level of files and accounts, Unix Permissions gives a concrete example. Where the project handles personal data, Data Protection Law and Ethics sets out the obligations that apply in the UK and what they require in practice.

Add a security item to the risk register if the project handles any data that is not public. The risk analysis in Risk Analysis for a Project shows how to record it.

Sustainability

Sustainability is less often checked in student projects, but it is a legitimate part of professional practice. The questions are practical. How much computing does the approach need, and does the extra cost buy something proportionate? Does the artefact depend on a service that may be withdrawn or priced out of reach? Will the data stored by the project still be usable, and will it be deleted when it is no longer needed?

These questions do not have fixed answers, and a project does not need to solve sustainability to be sound. It does need to state its choices and their costs. A project that runs a large model for a small task should say so and justify it, and a project that deletes its data after assessment should say when that happens. The aim is that the reader can see the trade-off, not that it is resolved in one direction.

The question of who controls the infrastructure a project depends on is developed in Renting or Owning: Cloud Dependence, Retention, and Capability, which applies directly to the choice of tools and services.infrastructure choices shape the project

Professional Conduct

Professional conduct covers how you treat the people you work with and the claims you make about the work. Three expectations are common across most fields:

  • Report results as they are. Where a result is weaker than hoped, say so, and report the test that produced it. Selecting only the favourable runs is a form of misconduct, however it is justified.
  • Keep commitments. If you agree to a date, a deliverable, or a meeting, meet it or tell the other party in advance that you cannot. The working relationship with a client or supervisor depends on this, as described in Stakeholders and Working With Clients.
  • Attribute the work of others. Code, data, and ideas taken from elsewhere must be credited. The principles are in Academic Integrity.

Academic integrity also covers the use of generative AI. The guidance in Scaffolding, the ZPD, and Using GenAI Well sets out how to use these tools in a way that supports learning rather than replacing it, and most courses now state their own rules, which take precedence.

Applying the Four Areas to a Project

A short check at the start of the project and at each milestone is enough. Ask whether anything in the project involves people, personal data, shared systems, significant computing, or claims that others will rely on. For each yes, identify the requirement, the person responsible for it, and the point at which it will be checked. Put the answers in the project initiation document, or in the risk register where they represent a risk.