Each institution has an IRB that is responsible for reviewing and approving all research related to human subjects. The goal of the IRB is to protect both the study participants and the researchers. By reviewing and approving research prior to its conduct, the IRB provides protection for the researcher should someone later complain about the study.
It is important to note that any time a researcher wants to interact with humans as part of their study and/or gather any data from humans (including observations in a classroom, interviews, surveys, etc…) they must consult their IRB first. In some cases the IRB may rule that the activity is not human subjects research, but the IRB (not the researcher) must make that determination. It is always better to consult the IRB and find out that approval is not needed than to make an assumption and realize later that IRB approval should have been sought.
Each IRB has their own policies and procedures, which are often available on their website. For researchers who are going to be conducting a lot of human subjects research (which most CS Education research is) should take some time to talk with their IRB and find someone to whom they can ask questions.