BootcampSD: Planning to use sensitive data

Planning to use sensitive data
Section 10 of 10

Creating or using sensitive data requires careful planning. Planning should take place at the start of a project, before any actual data gathering or generation has taken place. It is strongly recommended that all researchers produce a Data Management Plan. A Data Management Plan for a project working with sensitive data should consider the following areas:

• How the data will be gathered safely. This might include the use of encrypted hardware or files, appropriate consent procedures
• How the data will be stored securely. How quickly and frequently data will be backed up, secure storage options for data (the University of Bristol recommends its Research Data Storage Facility for the long-term secure storage of sensitive research data), any specified arrangements for the secure storage of third party data
• Anonymisation and modification techniques. How you will ensure the data is suitably and effectively amended, separate storage of any ‘key’ to identifiers
• Documentation and metadata. What information will be provided so that others can understand the data, any changes which have taken place in order to remove sensitivities, details of any original third party datasets and where they can be obtained
• Data sharing. Which data will be suitable for sharing, what repository will be used and any controlled access requirements, any embargo periods on the release of the data.

Many major funders have their own DMP templates which they expect researchers to complete as part of a grant application process. Alternatively, the University of Bristol has also produced a generic template for researchers through the DMPonline tool.

Quiz: which of the following details related to sensitive research data should be included in a Data Management Plan:

1. Type of encryption used for sensitive interviews

• TRUE
• FALSE
• TRUE: the type of encrypted Dictaphone or the encryption software for files which are planned to be used should be recorded

2. Ethical and legislative considerations

• TRUE
• FALSE
• TRUE: details of ethical approval or how you will ensure compliance with the Data Protection Act if necessary should be included

3. Only information on the data which will be shared

• TRUE
• FALSE
• FALSE: you should explain which data cannot be shared and why as well as that which can

4. Only details of original data I will generate

• TRUE
• FALSE
• FALSE: even if you are only working with third party data you should still use a DMP to consider how this will be securely handled and if any derived datasets can be shared

This concludes the bootcamp online tutorial, we hope you found it useful. If you have any specific enquiries please contact us.