IT solutions for sensitive data

Collect and document

Data may need extra protection during collection, especially when involving human subjects or conducting research outside the lab without direct access to university servers.

Data Management rules of thumb:

• Never KEEP your research data in collection systems, environments or devices. These are not intended or secure enough for (long-term) storage.

• After concluding the collection phase of (personal) data. The data should always be copied to a trusted, secure and accessible location from where you can continue your analysis.

• After securing your collected data. Remove it from the primary source (collection system, environment or device).

Data encryption

If you are conducting field research with sensitive sensitive data, it is important to transfer your data to the university servers (X- or Y-drive) as soon as possible. If immediate transfer isn't possible due to issues like poor internet connection, we advise you to encrypt the folder(s) where you will temporarily store your data.

Process, analyze and store

In the research data life cycle, it is important to distinguish between mutable data, which is still being processed and analyzed; and immutable data, which has become static to its initially intended purpose. For ongoing data analysis, store and process your data in a suitable environment: 

• For collaborations within the UG, and when handling data that is not necessarily sensitive, it is advised to use the Y drive on the University Workplace (UWP). 
• For internal collaborations involving sensitive data, consult with a data steward before using the Y drive. 
• For external collaborations and when sensitive data is involved, the Virtual Research Workspace (VRW) provides a safe and monitored environment to store and work on your data. External collaborators can be granted access to the VRW with a phone number and a valid institutional email, without needing a UG-affiliated account.
  • Keep in mind that in some cases it might be necessary to have contracts in place before you start an external collaboration (see agreements with external parties)

Data minimization

When you start processing your data, revisit the principle of data minimization in relation to the sensitivity of your data, especially when collecting sensitive or personal data. Collect those data that you need for the purpose of your research and remove data that you no longer need.

Share and transfer

When transferring sensitive data, it is important to use appropriate IT solutions that provide extra protection to your data. This is especially important when researchers from different universities collaborate or share data they previously collected, which facilitates new research without the need for new data collection.

Keep in mind that in some cases it might be necessary to have contracts in place before you transfer any data (see agreements with external parties). In addition, you need to make sure that you have consent from your participants if you want to transfer personal data (see informed consent). 

Archive after research

Towards the end of your research project, your research data will become static to its initially intended purpose (immutable data). When data are part of a publication (scientific or otherwise), they need to be archived for verification purposes. Keep in mind that you only need to archive the data that is necessary for verification.

Make sure to adhere to the principles of data minimization by de-identifying your data. After research, consult the Research Data Policy of your faculty or institute for guidelines on how and where to archive your data and for how long (the retention period).

If your data is not part of a publication, or if you might want to use it for future research projects, archive and/or store your sensitive data in the UG Research Data Management System (RDMS).

Make sensitive data FAIR

The FAIR data-principles (Findability, Accessibility, Interoperability, and Reusability) help researchers make their data ‘as open as possible and as closed as necessary’. Although data can often be shared openly, sometimes access needs to be restricted. In case of sensitive or personal data, it is almost always necessary to restrict access to the data. Restricting access means that your data is only shared with interested parties under well-defined conditions.