Doing a Business Administration Thesis Inside a Company: Access Agreements, Confidentiality and What Goes in Chapter 3 (Philippines, 2026)

Your BSBA thesis needs real data from a real company, and the company’s owner or HR head just asked for something you were not expecting: a signed access agreement before anyone lets you near their employees, their sales figures or their customer records. You have a title already approved. You do not have a document the company will sign, and every week that passes without one is a week your data-collection timeline does not get back.

Start your Chapter 3 with Tesify

Why a company asks for this at all

A company that lets a group of students survey its employees, examine its sales records or shadow its operations is taking on a real, if small, risk: personal information about its staff or customers leaving the building, a competitor learning something from a published thesis, or a disgruntled employee treating the survey as a channel for a complaint the company never agreed to receive. Republic Act 10173, the Data Privacy Act of 2012, is the reason a company’s own legal or HR office increasingly insists on a written agreement rather than a handshake. Section 3(g) defines personal information broadly, as “any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained” — which covers an employee survey with names, employee numbers or even a combination of department and tenure specific enough to identify one person.

Section 3(b) requires that consent be “freely given, specific, informed” — meaning a company cannot simply hand over employee contact details on your behalf; each employee has to actually agree to participate, in terms that make clear what the study is for. Section 19 does carve out a narrower path for research: the immediately preceding sections on data subject rights do not apply “if the processed personal information are used only for the needs of scientific and statistical research” and no activities are carried out and no decisions are taken regarding the data subject on that basis, provided the information is held under strict confidentiality and used only for the declared purpose. That is the clause your access agreement should actually invoke, and it is also the clause that limits what you can promise to do with the data afterward.

What a delay here actually costs you

Data collection is the one part of a thesis timeline that does not compress. A questionnaire distributed in week 6 instead of week 3 still needs the same time to be answered, encoded, analyzed and written up — the three weeks lost to negotiating access do not come out of the company’s schedule, they come out of yours, usually from the analysis and revision time you were counting on before the final defense. Groups that wait for a company to bring up the agreement themselves lose more time than groups that arrive with a draft already prepared, because the company’s own legal review of an unfamiliar document from scratch takes longer than reviewing one you handed them ready to mark up.

What the access agreement itself should contain

A workable agreement for an undergraduate business thesis is short — one to two pages — and covers six things:

1. What data or access is being granted — an employee survey, a review of specific records, observation of a specific process — named precisely, not “company data” generally.
2. The declared research purpose — the study’s title or research question, matching Section 19’s requirement that use be limited to the declared purpose.
3. How identity will be protected — anonymized or coded responses, aggregated reporting, no individual named or identifiable in the thesis text, tables or appendices.
4. Who sees the raw data — naming the student researchers only, not a wider group, and stating how long raw data is retained before disposal.
5. What the company receives in return — commonly a copy of the findings relevant to them, sometimes nothing beyond an acknowledgment; state it either way so there is no ambiguity later.
6. Signatures and date — the company’s authorized representative, the student group, and the thesis adviser where your school requires adviser sign-off on external data-collection agreements.

Bring two copies so the company keeps one and you keep one, and route the draft past your adviser before you present it to the company — a school that already has its own template for this saves you the drafting entirely, so ask before assuming you need to write one from nothing.

Keep the language plain rather than borrowing formal legal phrasing you do not fully understand yourself; a company’s HR contact reads dozens of vendor and partner agreements and can tell the difference between a document written to actually be understood and one copied from a template online. A one-sentence description of the study, in the same plain language, at the top of the agreement also helps a reviewer who was not in the room when you first pitched the idea — the document should stand on its own if it gets forwarded to someone else for sign-off.

How to actually approach the company for the agreement

Go in with the draft already written, not with a request to “discuss data access.” A company’s HR or legal contact reviews a document far faster than they draft one from a verbal description, and arriving with something to mark up rather than something to compose shifts the whole meeting from negotiation to revision. Three steps make this concrete:

1. Draft the agreement using the six elements above before you ask for a meeting, filling in what you already know (your research purpose, your timeline) and leaving the company’s own details as blanks they complete.
2. Send it ahead of the meeting, even a day ahead, so their legal or HR reviewer has read it before you are in the room — a document reviewed cold, in front of you, invites more caution than one reviewed with time to think.
3. Bring your adviser’s contact details, since a company will sometimes want to confirm independently that the study is a legitimate academic requirement and not, say, a marketing exercise dressed up as research.

This sequence is the direct analogue of what already works for a rejected thesis title — arriving with a prepared document changes the conversation from a verdict to a review, the same logic covered in how to get a rejected thesis title approved. If your access negotiation stalls entirely and the semester clock keeps running, the triage habits in what to do when your research timeline collapses apply just as much to a stalled company as to a missing adviser: the fix is always the same order — assess what is actually blocking you, communicate the real situation to your adviser, and keep drafting the sections that do not depend on the blocked step.

What this looks like in Chapter 3

The access agreement itself does not usually appear as a Chapter 3 section heading; it appears as an appendix, cited in the data-gathering procedure. A workable pattern:

Data-gathering procedure. Prior to data collection, a letter requesting permission to conduct the study was submitted to the management of [Company], accompanied by a data access and confidentiality agreement specifying the scope of data requested, the research purpose, and the confidentiality measures to be observed. Upon approval, signed by [Company]’s authorized representative on [date], the researchers distributed the survey questionnaire to [respondent group] between [dates]. All responses were coded and no individually identifiable information was included in the analysis or the final manuscript. The signed agreement is attached as Appendix [letter].

Name the agreement, name who signed it and when, and state the anonymization method in the same paragraph as the rest of your data-gathering procedure — a panel reading Chapter 3 should not have to guess whether access was formally granted or simply assumed. Where the rest of your Chapter 3 sections still need drafting — the sample-size computation, the sampling technique, the instrument and reliability sections — the full section-by-section pattern for a Philippine methodology chapter is worked through in how to write Chapter 3, and forty scoped BSBA and HRM title-and-population pairings that already assume a company or institution as the respondent source are in thesis title examples for BSBA and HRM students.

Frequently asked questions

Is a verbal agreement with the company owner enough?

It is not defensible at a defense. A panel that asks how you obtained access and hears “the owner said it was fine” will ask for the document; put the same understanding in writing before data collection starts, even if the company was informal about agreeing to it.

Does a small business or sari-sari store need the same formal agreement as a large corporation?

The formality can scale down — a one-page letter of agreement signed by the owner is enough for a small enterprise — but the same six elements (scope, purpose, confidentiality, access, return, signatures) still belong in it, however brief.

What if the company refuses to sign anything?

Ask what specifically concerns them and address it in the document rather than abandoning the site; a company that hesitates at “company data” broadly often agrees once the scope is narrowed to exactly what you need and the confidentiality terms are spelled out.

Does this replace our school’s own research ethics clearance?

No. The company’s access agreement and your school’s ethics review are separate requirements, and most Philippine business programs expect both: the ethics clearance covers your treatment of human respondents generally, the access agreement covers this specific company’s consent to be studied.

Can we name the company in our thesis?

Only if the company agrees to it in writing, ideally in the same agreement; many companies prefer a masked name (“a mid-sized retail firm in [city]”) specifically to keep their identity, and their employees’ data, out of a published document. Default to anonymizing the company unless it explicitly consents otherwise.

What happens to the data after the thesis is submitted?

State a disposal or retention plan in the agreement itself — commonly, raw data is kept only until the final grade is released and then deleted, with only the aggregated, anonymized findings retained in the bound manuscript.

Who is the National Privacy Commission, and do we need to contact them directly?

The National Privacy Commission is the government body the Data Privacy Act established to implement and enforce it. An undergraduate thesis operating under the research exemption in Section 19, with a proper access agreement and anonymized reporting, does not typically need to file anything with the Commission directly — but check with your adviser or research office, since requirements can differ for studies involving larger datasets, sensitive personal information such as health records, or a formal data-sharing arrangement between institutions.

Does the company get to review our findings before we submit the thesis?

State this in the agreement rather than leaving it implied. A common middle ground is that the company receives a copy of the findings section relevant to them, for factual accuracy only, without a right to block publication or demand changes to your analysis or conclusions — put whichever arrangement you actually agree to in writing.