Skip to ContentSkip to Navigation
Digital Competence Centre
your one-stop for reserach IT and data
Digital Competence Centre Privacy & Data Protection Data Protection

IT solutions for sensitive data

It's most common during research to handle digital data in one way or another, requiring collection, storage, analysis, transfer, and/or archiving. When conducting research with sensitive data, carefully design your research and implement extra data protection measures.

The University of Groningen offers an IT infrastructure to support these tasks. This page provides guidance on selecting appropriate IT solutions and using standard options for managing sensitive data. 

Collect and document

Collect and document

Data may need extra protection during collection, especially when involving human subjects or conducting research outside the lab without direct access to university servers.

Data Management rules of thumb:
  • Never KEEP your research data in collection systems, environments or devices. These are not intended or secure enough for (long-term) storage.

  • After concluding the collection phase of (personal) data. The data should always be copied to a trusted, secure and accessible location from where you can continue your analysis.

  • After securing your collected data. Remove it from the primary source (collection system, environment or device).

Data encryption

If you are conducting field research with sensitive sensitive data, it is important to transfer your data to the university servers (X- or Y-drive) as soon as possible. If immediate transfer isn't possible due to issues like poor internet connection, we advise you to encrypt the folder(s) where you will temporarily store your data.

Process, analyze and store

Process, analyze and store

In the research data life cycle, it is important to distinguish between mutable data, which is still being processed and analyzed; and immutable data, which has become static to its initially intended purpose. For ongoing data analysis, store and process your data in a suitable environment: 

  • For collaborations within the UG, and when handling data that is not necessarily sensitive, it is advised to use the Y drive on the University Workplace (UWP). 
  • For internal collaborations involving sensitive data, consult with a data steward before using the Y drive. 
  • For external collaborations and when sensitive data is involved, the Virtual Research Workspace (VRW) provides a safe and monitored environment to store and work on your data. External collaborators can be granted access to the VRW with a phone number and a valid institutional email, without needing a UG-affiliated account.

Data minimization

When you start processing your data, revisit the principle of data minimization in relation to the sensitivity of your data, especially when collecting sensitive or personal data. Collect those data that you need for the purpose of your research and remove data that you no longer need.

Share and transfer

Share and transfer

When transferring sensitive data, it is important to use appropriate IT solutions that provide extra protection to your data. This is especially important when researchers from different universities collaborate or share data they previously collected, which facilitates new research without the need for new data collection.

Keep in mind that in some cases it might be necessary to have contracts in place before you transfer any data (see agreements with external parties). In addition, you need to make sure that you have consent from your participants if you want to transfer personal data (see informed consent). 

Archive after research

Archive after research

Towards the end of your research project, your research data will become static to its initially intended purpose (immutable data). When data are part of a publication (scientific or otherwise), they need to be archived for verification purposes. Keep in mind that you only need to archive the data that is necessary for verification.

Make sure to adhere to the principles of data minimization by de-identifying your data. After research, consult the Research Data Policy of your faculty or institute for guidelines on how and where to archive your data and for how long (the retention period).

If your data is not part of a publication, or if you might want to use it for future research projects, archive and/or store your sensitive data in the UG Research Data Management System (RDMS).

Make sensitive data FAIR

Make sensitive data FAIR

The FAIR data-principles (Findability, Accessibility, Interoperability, and Reusability) help researchers make their data ‘as open as possible and as closed as necessary’. Although data can often be shared openly, sometimes access needs to be restricted. In case of sensitive or personal data, it is almost always necessary to restrict access to the data. Restricting access means that your data is only shared with interested parties under well-defined conditions. 

Use of commercial software

Using software or solutions provided by commercial companies to process your research data can be very attractive. Unfortunately, those solutions do not usually consider the interest of the researcher and/or the participants. Ensuring that your data is going to be used for research purposes only becomes a hard task without a clear and strict service agreement.

Some commercial software is essential for research conducted at the UG. For that reason, the UG has contract agreements with several companies, such as Qualtrics and ATLAS.ti. These software packages can be used by researchers under the terms and conditions that have been agreed upon in the licensing contracts. Use the UG software finder to have an overview of the software available to all UG researchers.

Research software request

If you need specific software for your research that is not (yet) available, you can request this software via IRIS. Keep in mind that the usefulness of the software is not the only factor in the decision to grant your request. Costs and available alternatives, as well as privacy and security concerns also factor into this decision. This means that the assessment process could take some time. Check the list of available software for similar solutions or consult with a data steward. 

Last modified:24 September 2024 12.26 p.m.