Personal, sensitive & confidential data

For research that involves sensitive data, which can come in a range of forms, it is imperative that all policies and agreements that are in place are followed at all times. However, it is still possible to apply FAIR principles to such data. This is made easier if considered early in the project and incorporated into your data management practice. Policies and agreements that you may have, and that should ideally align with each other, include:

University and external ethics 

A research project's University ethics approval, and the broader University Ethics Policy, will specify some elements of what you can and cannot do with your data. However, you may need to consider any additional ethical applications that are required (e.g. from the Health Research Authority) and what they stipulate with regard to your data. 

Informed Consent

A fully comprehended and signed consent form can allow the processing, depositing and/or sharing of deidentified/anonymised personal data, although the distinction between the consent to participate in the research and the consent for the uses to which the data is to be put should be clearly made. If you are planning to anonymise the data (see below) to remove any personal data before storage, you should make clear in the participant information sheet that once this process has occurred, it will no longer be possible to remove individuals from the data.

Data Protection Impact Assessment (DPIA)

A DPIA may be required for research projects that may impact the privacy of individuals and/or involve the use of personal data - you can find more information on the governance and management page. 

Upstream/Third-party Agreements

You should consider whether there are any agreements in place regarding any third-party data that you have used. You should not assume that you can share data, or derived data, simply because they are available online. 

Data Sharing Agreement (DSA)

Where existing third-party data is being used, some data providers will require a signed DSA before allowing access to or transfer of the data. All DSAs should be approved by an authorised signatory in Research Services. Some DSAs will have rigid requirements of both the research team and the processing and storage of the data that must be followed; they may also have a destruction date. If you wish to share your data at the end of a project, it is important that this is discussed with the third party and is potentially represented in any DSAs. Requests should be made through the MyResearch service in MUSE (under RS Agreements System).  Guidance from the Contracts and Agreements team within Research Services can be sought using the contact details available here. 

Privacy Notice

If you have collected personal data from people, either with or without their consent, you should publish information on this data in the form of a privacy notice, typically prior to the data collection. The type of information that this should include can be found on the Information Commissioner's Office pages, and it should be displayed, normally, until the end of the project. There is also a privacy notice template that can be used available here.

While these policies and agreements should be in place at the start of your project, and in most instances before any data is obtained, they will all have an impact on what you will be able to do with the data at the project's end, and may not permit the sharing of the raw data. Where this creates restrictions, there may be other things you can do to make your data more FAIR, as detailed below.