Safety Norms: Design Thinking and Creative Strategy

1Purpose, Scope, and Safety Principles

This document sets out norms for Design Thinking and Creative Strategy, a practice that combines user research, problem framing, ideation, rapid prototyping, testing, and strategic recommendations. Its purpose is to prevent harm to the people involved in creative work and to keep that work truthful, lawful, and consistent with platform and organizational rules. These norms are a starting point for locally approved procedures. They do not replace those procedures, supervision, or professional advice.

The scope covers classroom projects, client engagements, research sprints, prototype testing, creative briefs, campaign concepts, and public showcases. Four principles guide every decision: people come before ideas, consent is informed and can be withdrawn, claims are truthful and substantiated, and rights in data and creative material are respected. Items labeled Mandatory must be followed. Items labeled Recommended are good practice that a team may adapt with a documented reason. Items described as jurisdiction-dependent must be checked against local law, contracts, or institutional policy.

2Roles, Competence, and Accountability

Each project names a responsible lead who approves the plan, a research lead who controls participant contact and data, and a communications lead who checks public claims. Small student teams may combine these roles, but the person holding a combined role must still record decisions in the project file. Sponsors, collaborators, and participants also have responsibilities, and they should be told what those are before work starts.

• Mandatory: every project has a named responsible lead recorded before any recruitment begins.
• Mandatory: only people who have completed the required ethics, privacy, and research briefing may conduct interviews or observe vulnerable groups.
• Mandatory: facilitators must be able to pause or end any activity, and they must do so without penalty to themselves or participants.
• Recommended: pair a novice facilitator with an experienced observer for the first three sessions.
• Recommended: sponsors sign a short statement confirming they will not use participant data outside the agreed scope.
• Competence note: questions on medical, legal, financial, or safety-critical topics require a subject specialist or qualified professional on the team. Creative staff must not give improvised advice on those matters.

3Realistic Hazards and Risk Levels

Design thinking work rarely causes physical injury, but it creates real risks to people, data, legal rights, and reputation. Hazards arise from interviews on sensitive topics, testing prototypes with real users, handling personal information, using third-party tools and images, and publishing concepts in public. Before starting, rate each hazard as low, medium, or high based on likelihood and severity. A high rating requires a written control plan approved by the responsible lead before work proceeds.

Ratings should be revisited whenever the audience, data type, tool, or publication channel changes. A project that begins as an anonymous survey can become high risk once a team adds video recording or links responses to customer accounts.

• Low: anonymous preference surveys with no identifiers collected. Controls: standard consent notice and data minimization.
• Medium: interviews about workplace stress, money, or family life. Controls: opt-out at any time, private interview space, and a list of local support services to offer when a participant becomes distressed.
• High: research with minors, people in crisis, patients, people who may be pressured because of employment or immigration status, or other groups with heightened vulnerability. Controls: institutional or ethics approval where required, guardian consent where applicable, and an expert advisor on the team.
• High: prototype testing that involves cutting, heating, soldering, or electrical components. Controls: trained supervision and approved tools only, with no unsupervised use of powered equipment.
• Medium: concepts that imply health, safety, financial, or environmental benefits. Controls: a substantiation file and review by a qualified professional before release.
• High: uploading personal or confidential data to cloud tools or AI services. Controls: prohibited unless the organization has approved that tool for that data class.

4Preventive Controls and Safe Work Practices

Consent must be informed, specific, voluntary, and revocable. Participants should know who is running the activity, why it is happening, what will be recorded, how long data will be kept, whether their words may be quoted, and how to withdraw. Consent given under pressure from a manager or instructor is weak consent. Where possible, recruit through people who do not supervise or assess the participants.

Creative output also carries obligations. Prototypes, personas, and campaign ideas can reproduce stereotypes, exclude groups, or mislead audiences. Test concepts for foreseeable misuse and unintended harm before any public exposure. Creator safety matters too. Students and practitioners who publish work may receive harassment or threats, so use team accounts, avoid posting personal contact details, and report abuse early.

• Mandatory: obtain documented consent before any recording, photograph, or quotation. Record verbal consent in the research log with the date handled by the project file system and the name of the person who obtained it.
• Mandatory: keep consent for research participation, recording, and public use separate. A participant may agree to one and decline the others.
• Mandatory: do not deceive participants about the purpose of a study or the identity of a sponsor, unless an approved research design and oversight explicitly allow it.
• Mandatory: when a session touches distressing topics, offer a break and provide local support resource information. Do not give clinical, legal, or financial advice.
• Mandatory: stop an activity immediately if a participant shows distress, asks to stop, or appears unable to give consent.
• Mandatory: credit and license all third-party images, fonts, music, code, and text. Keep a license register listing each asset used in public material.
• Mandatory: do not use competitor trademarks, celebrity likenesses, or copyrighted slogans in public material without written permission or a verified license.
• Mandatory: truthful communication. Label prototypes as concepts, do not present simulated results as measured results, and disclose sponsorship or paid placement.
• Mandatory: follow platform advertising, political, health, and age rules for any test ad or social post. Platform policies change often, so verify the current version before publishing.
• Recommended: build personas from real research rather than invented stereotypes, and label any synthetic persona clearly.
• Recommended: review AI-generated content for accuracy, bias, and copied material before use, and record which tool produced it.

5Equipment, Environment, Information, and Protective Safeguards

Workspace safety covers the rooms, tools, and materials used in workshops and prototyping. Keep exits and walkways clear, ensure adequate lighting and ventilation, and keep a first aid kit in any room where sharp tools or heat sources are used. Protective equipment such as cut-resistant gloves and safety glasses is mandatory where cutting, drilling, or soldering occurs. Manufacturer instructions and local workplace regulations apply and must be checked for each device.

Information safeguards protect participants and the organization. Research files often contain names, faces, voices, health details, and confidential business figures. Store them only in approved systems, limit access to named team members, and set a deletion date at the start of the project. Removing direct identifiers during analysis reduces harm if a file is exposed. Privacy and data protection duties are jurisdiction-dependent, so confirm them with the privacy office.

• Mandatory: operate guarded equipment, such as a craft knife, hot glue gun, laser cutter, 3D printer, or soldering iron, only after training and only with the manufacturer guard in place.
• Mandatory: ventilate the space when using resins, spray adhesives, or printer materials, and check the safety data sheet for each substance before use.
• Mandatory: keep food and drink away from areas where adhesives, solvents, or chemicals are stored or used.
• Recommended: wipe shared touch prototypes, pens, and sticky notes between user sessions, and avoid sharing items that contact faces or mouths.
• Mandatory: store research records in access-controlled systems with encryption where available and multifactor authentication for all accounts.
• Mandatory: collect only the data needed for the research question, and remove direct identifiers from transcripts before sharing them with the wider team.
• Recommended: avoid personal accounts and unapproved AI tools for interview transcripts or client confidential material.
• Mandatory: check whiteboard and digital board photographs for names, faces, and confidential numbers before sharing them outside the team.

6Incident Reporting, Emergency Response, and Escalation

Any incident, including a near miss, must be reported to the responsible lead without delay and within any deadline set by the institution or employer. Near misses matter because they show where controls are weak before someone is hurt. Reports should describe what happened, who was affected, what action was taken, and what will change. Do not blame individuals in the first report; focus on the control that failed.

Escalate to the responsible lead and the appropriate office when an incident involves a minor, a regulated sector, a public claim, a data exposure, or more than one person. Notification duties after a data breach vary by jurisdiction, so verify current obligations with qualified counsel or the privacy office. This guidance does not replace emergency services or qualified responders.

• Mandatory: for injury or immediate danger, stop the activity, give only first aid within your training, and call local emergency services.
• Mandatory: for participant distress, pause the session, offer a break, provide support resource information, and inform the research lead the same day.
• Mandatory: for a suspected data breach, such as a misdirected file or leaked transcript, restrict access where possible, notify the privacy contact, and preserve evidence rather than deleting it.
• Mandatory: for a copyright or trademark complaint, remove the disputed material from public channels pending review and notify the communications lead.
• Mandatory: for harassment or threats against team members, document the content, use platform reporting tools, and inform the institution or employer. Contact law enforcement where a threat appears credible.
• Mandatory: for a reputational incident, such as a misleading campaign or offensive concept, withdraw the material, issue only an approved factual statement, and review the root cause before any relaunch.
• Recommended: maintain a contact list that includes the privacy office, legal counsel, campus or site safety staff, and the trust and safety team of each platform used.

7Records, Training, Inspection, and Review

Records show that work was done safely and lawfully. Keep consent forms, research logs, risk ratings, license registers, claim substantiation files, incident reports, and data deletion records for the period required by institutional, contractual, or legal rules. Where those rules are unclear, keep records for the longest period the responsible lead considers reasonable and document that decision.

Monitoring is continuous. Revisit risk ratings when scope changes, and close every project with a review that asks what harmed, excluded, or misled anyone and what should change next time. Share lessons with future teams so the same weakness does not repeat. Training and recertification requirements depend on the employer or institution, so confirm them locally.

• Mandatory: maintain a project file containing the risk ratings, consent templates, approval record, and named roles.
• Mandatory: complete ethics, privacy, and workplace safety training before handling participant data or operating powered equipment.
• Mandatory: audit deletion of participant data at project close and record the action and the person responsible.
• Recommended: hold a mid-project check of risk ratings, especially when a new tool, audience, or channel is added.
• Recommended: hold a closing review and store its findings in the project file for future teams.

Implementation checklist

• Name a responsible lead and a research lead before any recruitment begins.
• Rate each hazard as low, medium, or high and file the controls in the project record.
• Obtain separate, documented consent for participation, recording, and public use.
• Stop any activity immediately when a participant shows distress or asks to stop.
• Confirm a license or written permission for every image, font, music clip, and quotation.
• Label prototypes as concepts and substantiate every public claim before release.
• Check current platform, advertising, and AI tool rules before publishing or uploading data.
• Store research files in approved, access-controlled systems with a set deletion date.
• Use guards, protective equipment, and trained supervision for any cutting, heating, or powered tools.
• Report incidents and near misses to the responsible lead and privacy contact without delay.
• Verify jurisdiction-dependent laws and policies with qualified professionals before finalizing procedures.