IRB Policies & Guidelines

About IRBs

An Institutional Review Board (IRB) exists to protect the rights, welfare, and dignity of human research participants. Its purpose is grounded in both ethical principles and federal regulations that ensure research involving human subjects is conducted responsibly.

Key reasons the IRB exists:

• To uphold ethical standards: Rooted in foundational documents like the Belmont Report, the IRB ensures that research adheres to principles of respect for persons, beneficence, and justice.

• To assess and minimize risks: The IRB evaluates research protocols to ensure that risks to participants are minimized, are reasonable in relation to potential benefits, and that researchers have appropriate plans for managing privacy, consent, and data protection.

• To ensure informed consent: The IRB verifies that researchers obtain voluntary, informed consent from participants, and that individuals understand their rights and the nature of their involvement.

• To ensure compliance with federal and institutional regulations: IRBs are mandated by U.S. federal law (45 CFR 46, also known as the Common Rule) and similar frameworks internationally, to ensure that research meets legal and institutional standards.

• To build public trust: By reviewing and monitoring research, the IRB reinforces accountability and transparency, which are essential for maintaining public confidence in academic and scientific inquiry.

Examples of Research That Might Require an IRB

Because human subject research can take many forms—ranging from interviews and archival work to digital projects and creative practices—it’s not always immediately clear when IRB review is required. Research methods are diverse, and the line between scholarly inquiry, artistic expression, and human subjects research can sometimes be blurred. 

Inquiry about whether your project might need an IRB should happen when the research project involves living human subjects and the information collected about them will be analyzed and shared in a way that contributes to generalizable knowledge. When in doubt always ask for guidance from the IRB.

A few hypothetical examples of the many types of human subject research/projects that might need an IRB:

• Digital humanities projects that involve collecting and analyzing community stories

• Analyzing personal correspondence of living individuals housed in an archive

• Surveys of students on mental health and academic stress 

• Interviews with formerly incarcerated individuals

• Human subject interviews, surveys, etc. on drug use or sex

• Cognitive experiments measuring stress 

• Collecting biometric data (e.g., EEG, heart rate)

• Surveys on public attitudes toward GMOs

• Interviews with developers about AI and ethics

• Studying food insecurity through surveys and ethnography

• Theater-based research with trauma survivors

• Testing health-related apps with user experience interviews

• Interviews with refugees about their migration experiences

• Use of data sets with personally identifiable information

Regardless of whether a study formally requires IRB review, informed consent is often still necessary when engaging with human participants. This includes situations such as when a researcher might:

• Interview or interact with individuals, even in informal or exploratory ways

• Record audio, video, or photograph people

• Collect or use personal stories, opinions, or reflections

• Access sensitive or private information, such as health, identity, or family history

Finally, an IRB operates at the intersection of ethics, governance, and the law. In the area of privacy and data protection laws, these various laws necessitate compliance, regardless of whether IRB approval or oversight is explicitly required by Colby’s policies.

Definitions

Below is a list of definitions to foster clarity and build a shared understanding of key Colby IRB definitions and concepts.

• Generalizable Knowledge: Knowledge expressed through theories, principles, or statements of relationships that can be widely applied, used to draw general conclusions, inform policy, add to an existing body of knowledge, and disseminated in various formats to researchers at all levels of experience and expertise, scholars, practitioners, communities of practice, and other relevant individuals both inside and outside the institution.

  • Statements of relationships refer to descriptions or explanations of how variables, factors, or entities are connected or interact with one another. These statements can express correlations, causations, or associations within a given context, often forming the basis for theories or principles.

  • Examples of formats of generalizable knowledge include:

  • Abstract or Summary

  • Blog Post

  • Case Study

  • Conference Proceedings

  • Dataset

  • Fact Sheet

  • Handout or Brochure

  • Infographic

  • Journal Article

  • Newsletter

  • Podcast Episode

  • Policy Brief

  • Poster

  • Presentation or Slide Deck

  • Research Paper/Thesis

  • Social Media Post or Thread

  • Technical Report

  • Video 

  • Webinar/Online Presentation

  • Website or Webpage

  • White Paper

• Human Subject Research is structured and methodical research involving human subjects (i.e., living individuals) where information and/or data is collected from interventions, interactions, or observations.  Additionally the information/data that is generated from the above is intended to be analyzed using a systematic approach(s). Examples of such research activities include: surveys, interviews, dataset creation, participant observation, biometric data collection, etc.. This type of research also can include accessing existing datasets that contain individually identifiable and or private information.

• IRB Review is a process where a researcher submits either an official application or a detailed document that provides comprehensive information about the research project, so that the IRB can determine if a formal submission or formal IRB approval is required for their research. The information for the review includes specifying the topic of the research and example questions that will be explored. Researchers must also detail when and where the research will take place, the methods that will be employed, and the processes for data collection and management. Additionally, information populations involved, including any vulnerable groups, must be clearly outlined, along with an explanation of how the data will be used and who will have access to it. Finally, the document should describe how the data will be managed and include if needed how it will be securely stored to ensure confidentiality. 

• Individually Identifiable Information refers to any data that can be used to uniquely identify, contact, or locate a single person, either directly or indirectly. This type of information is commonly known as personally identifiable information (PII) and may include:

  • Any address (home or email)

  • Bank account or credit card details

  • Biometric identifiers (e.g., fingerprints, facial recognition data, retinal scans)

  • Criminal history

  • Date of birth

  • Device identifiers (e.g., MAC addresses, IMEI numbers)

  • Education records (e.g., school name, grades, student ID)

  • Employment information (e.g., job title, employer name)

  • Full name

  • Gender

  • Geolocation data

  • Health data (e.g., diagnosis, treatment records, lab results)

  • Identifying numbers (government or institutional, such as driver’s license, passport number, Social Security, study Visa, Colby Card ID, etc.)

  • Marital status

  • Mother’s maiden name

  • Online behavior (e.g., browsing history, cookies)

  • Photos, videos, or audio recordings 

  • Place of birth

  • Race or ethnicity

  • Telephone number

  • ZIP code

• Private information is any data about a person that is generally not available to the public and can be sensitive if disclosed. This includes not only individually identifiable information but also additional information that reveals personal aspects about an individual, such as:

  • Health information, diagnoses, or treatment records

  • Biometric Data (e.g., fingerprints, facial recognition data)

  • Genetic information

  • Educational Information (e.g., grades, academic history)

  • Financial  Information (e.g., income, credit scores)

  • Personal opinions or behavior details

  • Sensitive experiences or deeply personal views: When individuals disclose experiences or opinions that are intimate, traumatic, or controversial, this information may be classified as private, especially if they expect confidentiality.

• Research Data Management (RDM) refers to the organization, storage, preservation, and sharing of data collected and used during a research project. Effective RDM ensures that data is handled systematically throughout its lifecycle, from creation and collection to analysis, sharing, and long-term preservation, in compliance with ethical, legal, and institutional standards.

• Umbrella IRB is IRB application type and refers to a single, overarching IRB protocol that covers multiple related research projects or activities under a unified framework. This approach is typically used when:

  • Multiple Studies Share a Common Goal or Theme: The research projects are part of a larger program, initiative, or thematic study (e.g., a capstone course, multi-site project, or institution-wide initiative).

  • Similar Research Methods or Populations: The studies use consistent methodologies, participant populations, or research designs.

  • Efficient Oversight: Instead of requiring separate IRB applications for each individual study, the umbrella approval streamlines the review and approval process, reducing administrative burden.

  • Student or Collaborative Research: Common in academic settings, especially when multiple student researchers are conducting similar projects under faculty supervision.

Key Features of Umbrella IRB:

• Principal Investigator (PI): Often a faculty member or project leader who oversees compliance and ensures ethical standards are met across all included studies.

• Standardized Protocol: A general research plan, consent forms, and data management procedures are typically standardized across studies.

• Flexibility: Researchers can add or modify individual projects under the umbrella approval without submitting entirely new applications, provided the changes fit within the approved framework.

• Ongoing Monitoring: Regular updates and annual reviews ensure continued compliance with IRB standards.

Applying the Common Rule Classification at Colby

The Common Rule (45 CFR 46) governs human subjects research conducted or supported by 19 federal departments and agencies. It outlines the basic provisions for IRB review, informed consent, and institutional compliance. The Colby IRB applies these guidelines to determine the appropriate level of oversight for all human subjects research.

• Exempt Research
  Research classified as “exempt” involves activities that present no more than minimal risk to participants and fit into one or more of the federally defined exempt categories (45 CFR 46.104). Despite the term "exempt," such research is not exempt from ethical standards, applicable state, federal, and international laws, institutional policies, or IRB oversight. Instead, it is exempt from certain federal regulatory requirements, such as continuing review.
  
  At Colby, all research involving human subjects requires IRB review to determine whether it qualifies for exempt status. This determination is made by the IRB Chair or their designee. Researchers cannot self-designate their projects as exempt. Even when a study is granted exempt status, it is not free from oversight; the research must still comply with ethical standards, related laws, and Colby’s institutional policies. Research classified as exempt remains under the jurisdiction of the Colby IRB and is assigned an IRB Protocol Number.

• Expedited Review
  Research that involves no more than minimal risk and falls within specific categories defined by the Common Rule may qualify for expedited review. In these cases, the IRB Chair or designee can review and approve the project. Expedited review does not exempt the research from IRB oversight; it simply streamlines the review process.

• Full Board Review
  Research that poses more than minimal risk to participants, or that does not qualify for exempt or expedited review, requires full IRB review. This means that all IRB members review the project and vote to approve or deny. Full board review ensures comprehensive oversight for higher-risk or more complex studies.

Compliance with IRB policies and procedures is essential to protect the rights, welfare, and privacy of research participants. Our IRB policies are grounded in federal regulations, state laws, international data protection laws, and Colby College policies, all of which work together to ensure that research involving human subjects is conducted responsibly, transparently, and with respect for participants.

 Following IRB-approved protocols, obtaining proper consent, and safeguarding human subjects' data are not only ethical obligations but legal requirements. Researchers are responsible for complying with applicable state and federal laws, international regulations (such as GDPR), and Colby’s institutional policies on data privacy, security, and research conduct. These frameworks help ensure that sensitive data is handled responsibly, reducing risks to participants and protecting both researchers and the institution.

Maintaining compliance promotes research integrity, safeguards participant trust, and helps prevent legal, regulatory, and reputational risks. Ultimately, it reflects a shared institutional and professional commitment to ethical, respectful, and accountable research practices.

 When there is non-compliance, the IRB’s primary goal in these situations is to work collaboratively with researchers to resolve issues and support ethical, compliant research.

Depending on the nature and severity of the noncompliance, the IRB may require corrective steps for all researchers, such as additional training, increased monitoring of research activities, temporary suspension of research, or, in rare cases, termination of IRB approval. Researchers may also be required to notify or re-consent participants if appropriate. Serious or repeated noncompliance may need to be reported to institutional officials and/or funding agencies, and could lead to restrictions on future research privileges, or, for students, academic or institutional sanctions or discipline. 

The IRB’s primary goal in these situations is to work collaboratively with researchers to resolve issues and support the continuation of ethical, compliant research.

Guidelines for Faculty and Staff Human Subject Research

• For projects that receive IRB approval, all faculty and staff research will receive initial approval for three years. Approval letters will contain the approval period.

• If the research period goes beyond the three year period faculty will need to ask for a renewal within at least 30 days of the end of the approval period.

• At the completion of their human subject research (all data has been collected, analyzed, and destroyed or have been properly anonymized) the researcher will fill out a BRIEF form that lets the IRB know the research is no longer active.

• All faculty/Staff must complete The Collaborative Institutional Training Initiative (CITI Program) for human research OR have documentation of equivalent training.

  • National Institutes of Health (NIH) Human Subjects Research Training

  • International Human Research Ethics Training Programs

  • Online Research Ethics Programs Offered by Government or Nonprofit Organizations

  • Professional Society Certification Programs

• Research conducted with students that will go beyond the time that the student is at Colby should have the faculty or staff as the principal investigator on the research project.

• All human subjects research outside the United States should have an IRB review and approval if needed.

• Additionally, it is important that all researchers be mindful of the data protection and privacy laws applicable to the states and countries from which they are collecting data. 

Colby Faculty/Instructors who offer courses and/or structured learning opportunities (e.g., independent study) that include student-driven human subject research assignments or projects, solely aimed at meeting educational and instructional objectives, have flexibility regarding whether their students must seek IRB approval for their projects. This flexibility is particularly relevant for courses where the primary focus is on teaching research methods or introducing foundational research concepts, rather than conducting research intended for broader dissemination.

The criteria for this flexibility are:

• The educational activities are intended only to enhance students' learning experiences, develop their skills, or fulfill course requirements, without any intention to contribute to generalizable knowledge (as defined above).

  • Note these projects can be presented at the end of the semester within the confines of the institution, for instance, at the Colby Liberal Arts Symposium (CLAS) without IRB approval. 

• The structured learning is conducted on the Colby Campus.

• The human subject research project is not part of a senior project or thesis.

Finally, for student human subject research on sensitive topics or research involving vulnerable populations (policies below), faculty must ensure the research aligns with Colby's IRB policies on these areas. Faculty are responsible for reviewing IRB policies, as well as the students' research to confirm that appropriate safeguards are in place to protect participants and uphold ethical standards.

IRB options for faculty when the student research meets the conditions above:

1. • Umbrella IRB Approval: Faculty may choose to have an umbrella IRB approval in place for a course, outlining the type of research to be conducted. This eliminates the need for individual IRB submissions from students.

   • Individual Student IRBs: Faculty may choose to submit individual IRB submissions from students.

   • No IRB Approval: Faculty and instructors may opt not to have students secure IRB approval, provided that:

     • Students are taught when IRB approval would be necessary.

     • Research conducted is strictly limited to personal use or classroom discussions, with no sharing in any format beyond the institution (external sharing).

     • Participant consent and best data management practices are used in the research.

     • Applicable Colby Policies, laws, and regulations are taken into consideration/

When IRB Review or Approval Is Required for Student Human Subject Research:

• Student human subjects research requires IRB review or approval when any of the following apply:

  • A faculty or staff member requires the student project to have IRB approval; and/or

  • The research is part of a Senior Thesis; and/or

  • The research is being conducted outside of the United States; and/or

  • The research involves human subjects as defined by IRB policy and the research or data collected will be shared with audiences beyond Colby College, in the context of:

    • Coursework

    • Independent Study

    • Internship 

• NOTE: Any human subject research that is conducted outside of the United States requires IRB review. This includes when students are studying abroad through another program that requires a Colby IRB or for independent research sponsored by Colby. When students know that an IRB might be required to do research abroad, it is required that their Colby IRB approval is in place before they travel outside the United States. Furthermore, if the student intends to later use the information from that research for a project at Colby, IRB review and approval is needed. 

  • Additionally, it is important that all researchers be mindful of the data protection and privacy laws applicable to the states and countries from which they are collecting data. Support on this can come from the IRB working with Colby’s Office of General Counsel.

Research on Sensitive Topics that May Not Require IRB Approval 

Some student interactional research does not require IRB oversight when it is conducted solely to fulfill course or instructional objectives. However, when such projects involve sensitive topics and interaction with living human participants, ethical risks still exist. Researchers remain responsible for adhering to institutional policies and applicable laws and regulations. Even when IRB approval is not formally required, applying ethical research principles, protecting participant welfare, and ensuring compliance with privacy and data protection standards are essential. 

When students are conducting human participant research that may not formally require IRB approval because it is undertaken solely to meet educational or instructional objectives, it is the policy of the IRB that the faculty member or instructor overseeing the research assess whether IRB review is needed. Instructors should carefully consider whether the research activities or observations involve sensitive topics that present any potential risks, including: 

• Psychological or emotional distress

• Privacy or confidentiality risks

• Legal, financial, or social harm

• Personal discomfort or distress

• Immediate or long-term negative consequences to participants or student researchers

• Loss of standing or harm to reputation

• Possible academic or institutional discipline

• Social Stigma

• Financial Loss

• Exposure to liability or college sanctions

• Discrimination

• Damage to personal relationships

• Breaches of confidentiality and privacy around information on sensitive topic

Sensitive topics include the following:

• Body Image and Eating Disorders

• Chronic Illness and Terminal Illness

• Hate Speech and Discrimination (e.g., based on race, religion, gender, sexual orientation)

• Human Trafficking and/or Exploitation

• Illegal or Illicit Activities (anywhere)

• Mental Health and Mental Illness

• Racial or Ethnic Bias or Discrimination

• Self-Harm and Suicide

• Sexual Behaviors

• Substance Use (legal or illegal)

• Violence, Trauma, or Abuse of any type and in any form

If any student research involves sensitive topics, faculty/instructors should review applicable institutional policies as well as relevant laws and regulations. Faculty should also be mindful of the types of data being collected, particularly when the data could render human participants identifiable. If unsure about any applicable policies or requirements, faculty are encouraged to contact the IRB for guidance, even if formal IRB review is not required. Consulting the IRB can help clarify responsibilities and ensure that research proceeds in alignment with ethical standards and institutional expectations. 

Below are a few examples of research that students might want to conduct for a project where research is conducted solely to fulfill course or instructional objectives that might be harmful to the subject:

• Academic Dishonesty or Cheating: Collecting non-anonymous accounts (video, audio, etc.) involving students sharing personal experiences of cheating or academic dishonesty.

• Recreational Drinking and Drug Use Where Prohibited (e.g., On Campus): Collecting non-anonymous accounts (video, audio, etc.) of prohibited behaviors, such as underage drinking or drug use.

• Mental Health Challenges or Self-Harm: Collecting identifiable narratives about mental health struggles or self-harm can pose emotional risks to participants.

• Mandatory Reporting: If during research conducted on campus, something falling under Title IX, such as sexual harassment, sexual assault, stalking, or any form of gender-based discrimination, is disclosed,  the subject should be aware of mandatory reporting beforehand, and faculty should be prepared to navigate these issues.
  
  
  

When IRB Approval Is Required: Additional Considerations for Sensitive Research

When research studies on sensitive topics is submitted for IRB review and the data collection is not anonymous, researchers should address the following critical considerations to ensure ethical and responsible conduct of the study.

Risk Mitigation 

Researchers must submit a risk mitigation plan outlining:

• How participants will be supported if they experience emotional distress, discomfort, or triggering reactions during the study.

• Steps researchers will take to manage disclosures of sensitive information (such as self-harm, abuse, or illegal activity), in compliance with ethical and legal obligations.

• Available resources or referrals that will be offered to participants, such as counseling services or crisis support.
  
  

This plan should demonstrate that the researcher has anticipated potential risks and has practical strategies in place to protect participant welfare.

Evidence of Relevant Training

Researchers must provide documentation of appropriate training in preparation for working with participants on sensitive topics. This may include:

• Completion of ethics or human subjects research training (such as CITI training).

• Specialized preparation related to trauma-informed research practices, mental health awareness, or working with vulnerable populations.

• Instructor-supervised preparation sessions focusing on how to manage sensitive disclosures, participant distress, and confidentiality concerns.

• This training ensures that researchers are prepared to responsibly and ethically engage with participants, reducing risks of harm.

Why This Matters

Research on sensitive topics can place both participants and researchers at risk of emotional distress, breaches of confidentiality, or legal and ethical complications. By requiring a risk mitigation plan and evidence of appropriate training, the IRB helps ensure that sensitive research is conducted:

• With respect for participant dignity and well-being

• In compliance with institutional and legal requirements

• In a manner that minimizes harm and protects both participants and researchers

Any human subject research (as defined above) whether it is solely undertaken to meet educational and instructional objectives on the topics listed below will require an IRB review (as defined above). During the review process, the Colby IRB will consider the conditions and guidance under which the student will conduct the research, as well as the proposed methods, questions, and populations involved.

• Fetuses

• Mentally or Cognitively Impaired Individuals

• Others Who Are Not Able to Give Legal Consent to Be Part of Your Research

• Persons Under the Age of 18

• Pregnant Women

• Those in the Prison Population

Note: Other vulnerable populations depending on the questions and research might include: Refugees, Economically Disadvantaged Individuals, Elderly Individuals, Racial and Ethnic Minorities, People with Physical Disabilities, and Non-English Speakers, etc.  

The IRB reserves the right to update this list in compliance with law and Colby policies

Student Submission of an IRB:

• All students submitting research for IRB review must have an appropriate sponsor for their research. This can be faculty or professional staff who have expertise and experience with the methods, topics, and training to support/guide/oversee the student research.

• All student IRB applications must be reviewed by their sponsor before submission to the IRB. The sponsor will indicate that they have reviewed the IRB proposal.

• The time period granted to students for conducting their research will be only for the duration of the academic year they submit their application in, unless otherwise requested. Approval letters will contain the approval period.

• All students must complete The Collaborative Institutional Training Initiative (CITI Program) for human research OR have documentation of equivalent training (listed below):

  • National Institutes of Health (NIH) Human Subjects Research Training

  • International Human Research Ethics Training Programs

  • Online Research Ethics Programs Offered by Government or Nonprofit Organizations

  • Professional Society Certification Programs

• When students are studying abroad either through a program that requires an IRB, through Colby, or for independent research, it is required that their IRB approval from Colby is in place before they go abroad.

• All researchers must review the research data management best practices document and also demonstrate awareness of the data protection and privacy laws applicable to the states and countries from which they are collecting data.

IRB and Legal Agreements

The IRB will coordinate, as deemed necessary, the use of legal agreements to ensure ethical oversight and compliance particularly when research involves collaboration between multiple institutions or external parties. Examples of such agreements include (but are not limited to):

• IRB Reliance Agreements (IRA): Allow one IRB to serve as the IRB of record for multiple institutions in a collaborative study.

• Memorandum of Understanding (MOU): Establishes the terms and conditions under which institutions/entities will collaborate, including IRB reliance

• Data Use Agreements (DUA): Defines how data can be shared, accessed, and used between institutions while ensuring confidentiality and compliance with privacy regulations. If an legal agreement is required the IRB will coordinate with the applicant and the Office of General Counsel to create a data management plan that is responsive to the laws, etc.

The following types of activities involving persons would most likely not require IRB review/oversight, provided they meet one or more of the specified criteria below and are not part of a research study that involves human subject research as defined above:

• Internal Use Activities: Activities involving individuals conducted solely for internal purposes (e.g., satisfaction surveys) to improve or develop new services or programs,  or as part of organizational operations with no plans for external presentation or publication.

• Biographies: Research focused on documenting the life of an individual without intent to generalize findings to a broader population.

• Oral Histories: Projects focused solely on recording specific historical narratives by individuals, where the narratives are collected and presented without interpretation or data analysis beyond what is present in the narrative itself.

• Journalistic Interviews: Interviews conducted solely to document personal narratives or opinions about specific events or topics, with the aim of preserving firsthand accounts or providing perspectives on an event, without interpretation or analysis.

• Service or Course Evaluations: Evaluations performed solely for assessing services or courses, unless the intent is to generalize findings to other individuals or contexts.

• Internal Concepts and Programs: Research on services, courses, or concepts where results are intended solely for use within the Colby community, with no plans to share findings externally.

• Some Usability and Product Tests: Confer with the IRB before conducting usability tests to determine if it requires an IRB, especially of the data will be shared outside of Colby and will contribute to generalizable knowledge.

• Expert Interviews: Interviews conducted solely to gather information from experts about policies, agencies, programs, technologies, techniques, or best practices, provided the questions are limited to the expert's knowledge of external topics and do not pertain to their personal experiences or opinions. For such research, researchers should consult with the IRB to review the selection of experts and the specific questions being asked to determine if an IRB is needed.

In each of the above cases, we strongly encourage participant consent when applicable and using best data management practices for the data.

Data Management and Data Privacy

A research data management plan is a key component of an IRB application because it demonstrates how researchers will handle participant data responsibly throughout the study. It ensures that data collection, storage, sharing, retention, and disposal are conducted in ways that protect privacy, maintain confidentiality, and comply with ethical and legal standards. By clearly outlining these practices, the plan provides accountability and safeguards both participants and the institution. 

Research Data Management Best Practices: Regardless of whether Colby IRB review or approval is required, all researchers at Colby are expected to apply best practices in research data management (RDM). These practices ensure that research data are collected, stored, analyzed, and shared responsibly, and that privacy, security, and compliance obligations are met

Key Principles of Research Data Management

• Informed consent and data use – ensuring participants understand how their data will be stored, shared, and retained.

• Confidentiality – protecting personal and sensitive data from unauthorized access.

• Data minimization – collecting and retaining only the data essential for the research purpose.

• Secure storage – safeguarding data through encryption, password protection, or access controls.

• Transparency – maintaining clear documentation of methods, data handling, and reporting practices.

• Responsible sharing – sharing data only in appropriate, ethical ways and with proper permission.

• Data retention and disposition – keeping data only as long as required by institutional or sponsor policies, and securely destroying or fully anonymizing human subject data. Human subject analyzed data may be retained as long as needed for verification, replication, or future publications, provided it has been de-identified or aggregated and stored securely.
  
  

Privacy and Data Collection Laws: Researchers must also comply with state, federal, and international data protection regulations when collecting or managing research data. For example:

• China – The Personal Information Protection Law (PIPL) regulates personal information collection, use, storage, and deletion.

• European Union – The General Data Protection Regulation (GDPR) governs collection and processing of personal data, including its extraterritorial application to U.S. researchers working with EU data subjects.
  
  

For human subject research data, researchers should work with Kara Kugelmeyer, Data Librarian, to craft a research data management plan; she will coordinate with the Office of the General Counsel as needed. All other inquiries not related to human subject data should be directed to the Office of the General Counsel for guidance on applicable privacy and data collection laws.

Project Completion and Data Retention: An IRB project is considered complete when all human subject recruitment, interactions, and data collection are finished, and all analysis has been completed. After analysis, any identifiable data must be either anonymized or securely destroyed in accordance with the approved data management plan, institutional retention requirements, and any sponsor or funding obligations. If identifiable data are retained beyond analysis, the study must remain open with the IRB until the data are either de-identified or destroyed, or transferred to a separate approved repository protocol. De-identified or aggregate data may be retained as long as needed for purposes such as verification, replication, or future publications, provided they are stored in accordance with approved data management practices.

Support: For assistance in creating a research data management plan, contact Kara Kugelmeyer, Data Librarian, who will coordinate as needed with Colby Information Technology Services (ITS) and the Office of the General Counsel.