Research Data Management Plans: Storage, Access, Retention and Sharing

Make the plan a working document

A data management plan explains how research material will be created or obtained, organised, protected, preserved and, where appropriate, shared. Its value lies in decisions the team can implement. A paragraph promising that data will be stored securely is insufficient if nobody has identified the storage service, access rules or responsible person.

Begin during project design and review the plan when methods, partners or data sources change. Funders and institutions may prescribe particular formats or conditions. NIH, for example, provides its own data management and sharing guidance for applicable awards. ^[1] Follow the requirements relevant to the project rather than assuming one template satisfies every funder.

Inventory the data and its sensitivity

List expected data types, formats, approximate volume and sources. Include recordings, transcripts, survey responses, administrative extracts, images, code and derived datasets where relevant. Identify which material contains direct identifiers, sensitive information, third-party content or contractual restrictions.

Describe the relationship between files. A transcript may depend on an audio recording and a separate consent record, while an analysis dataset may depend on several transformations. Record which version is authoritative. An inventory helps the team anticipate storage, documentation and permissions instead of discovering these needs when the project is ending.

Specify storage, access and recovery

Name approved storage locations and define who can access which material. Use role-based access where practical and review it when staff join or leave. Separate identifying keys from research data, protect devices and avoid uncontrolled personal copies. Consider whether partners in different institutions have compatible security arrangements.

Plan backups and test recovery. A backup is useful only if it is current, protected and restorable. Explain how accidental deletion or a lost device will be reported and managed. Do not place passwords, private keys or identifiable participant records in a public repository simply because the project intends to support open research.

Document meaning and transformations

Create a data dictionary explaining variables, units, codes, missing-value conventions and relevant collection conditions. Maintain a README that describes the file structure, versions and instructions for use. Record transformations in scripts or a clear log so derived results can be traced to their inputs.

Documentation should be written for a future authorised user who was not present during collection. A column called score_final is ambiguous without the scale, calculation and version. Good documentation also helps the current team detect inconsistent coding or misunderstandings before analysis. Allocate time for this work rather than treating it as optional administration.

Illustrative example: a study of student transitions

Suppose a project combines student interviews with enrolment records. The plan identifies a restricted folder for identifiers, a separate analysis folder and named staff responsible for linking records. Consent materials explain the intended linkage and any future sharing.

At project completion, the team considers whether transcripts can be shared safely. Distinctive experiences may reveal identities despite removal of names. It decides to deposit a public description and documentation while providing controlled access to suitably prepared material where permitted. Guidance on sensitive-data sharing illustrates why access conditions must reflect confidentiality and rights. ^[2]

Plan retention and sharing realistically

Identify applicable retention requirements and distinguish them from a desire to retain everything indefinitely. State what will be preserved, where, for how long and who will decide about disposal. Consider the continuing value of data alongside privacy, consent and resource implications.

Select an appropriate repository or preservation service early. Examine supported formats, access controls, identifiers, costs and long-term responsibilities. Explain any justified restrictions, embargoes or licensing conditions. An available download is not necessarily reusable if its meaning, rights or provenance are unclear. Budget for preparation, review and deposit as part of the research activity.

Check accountability before approval

• Expected data and sensitivities are inventoried.
• Storage and backup services are named.
• Access, linkage and security responsibilities are assigned.
• Documentation and versioning procedures are defined.
• Consent and rights support the intended use and sharing.
• Retention and disposal arrangements are justified.
• Preservation costs and post-project ownership are addressed.

Revisit the plan at collection, analysis and closure. Record departures and the reasons for them. A useful plan makes responsible handling possible in everyday work and leaves the institution able to explain what happened to the data after the original team has moved on.