Research Data Management

About Research Data Management

Effectively managing research data involves establishing and following a plan for the systemic organization, storage and retrieval of data to ensure accuracy, accessibility and security.

This process is critical for complying with regulations, ensuring operational efficiency and maintaining data integrity.

Please use this page to complete the following tasks:

Review Data Classification Guidance for Researchers
Access Data Management Resources
Complete Required Training
Request a Data Use Agreement (DUA) Review
Understand the Genomic Data Sharing Process

Review Data Classification Guidance for Researchers

This guidance provides a working framework for understanding research data and its classification within the UAlbany Data Classification Standard.

Placement of data is based on its sensitivity, value and regulatory or contractual requirements. The goal is to ensure appropriate handling, storage and sharing of data to protect confidentiality, integrity and availability.

This guidance applies to all research data created, collected, obtained, analyzed, processed or stored by researchers, staff or collaborators associated with UAlbany.

This guidance does not address information and records of the institution generated, stored or used to fulfill the University’s educational, employment or student support obligations (such as student educational records).

guidance

Category 1: Protected Data (Personally Identifiable or Regulated)

Description:

Data that could cause harm to the institution, our partners, data subjects or national security if disclosed.

Such data is typically Personal Identifiable Information (PII) data subject to regulatory controls or data subject to contractual restrictions.

Examples:

Identifiable human subject data
Contractually restricted data
HIPAA-regulated protected health information from a “Covered Entity”
Export controlled information
FERPA-regulated student educational records
Other regulated data and data that when merged becomes sensitive and could impact financial standing, economic prospects, provide information about criminal activities or otherwise harm an individual

Handling Requirements:

Obtain Institutional Review Board (IRB) approval or determination of exemption for obtaining, collecting, storing or analyzing PII for research
Legal agreements when transferring data into or out of UAlbany (please contact [email protected] with any questions)
Access must be restricted to authorized personnel
Encryption is required for data storage (data at rest) and transmission (data in transit)
A written Data Management Plan (DMP) or Technology Control Plan (TCP)
Must comply with applicable laws
Must comply with institutional data management plan standards
Strict virtual and physical access controls and audit logs
Training for all project personnel in Research Security and cybersecurity is required, and other training as appropriate to the project (please visit the Regulatory & Research Compliance Training webpage for more information)

Category 2: Internal Use Data (Non-sensitive & Non-public)

Description:

Data from research that is not yet analyzed and is not ready for publication. This data can also include proprietary information related to commercial endeavors.

This data does not contain PII, information regulated by the federal or state government, and is not subject to contractual obligations, but requires safekeeping to protect from external entities.

Examples:

Draft manuscripts
Internal reports
Preliminary data
Lab-specific protocols
Anonymous survey results where subjects were promised confidentiality
De-identified data
Coded (pseudonymized) data where the identifiers will not be released
Audio or video data that cannot be linked to an individual

Handling Requirements:

Obtain IRB approval or determination of exemption for obtaining, collecting, storing or analyzing PII for research
Legal agreements as appropriate
Access limited to project team members
Stored on secure institutional systems with access controls
Develop a written Data Management Plan (DMP)

Category 3: Public Data (Non-sensitive & Public)

Description:

Any Personal Data that is either anonymous or identifiable personal data lawfully in the public domain at the time it is collected for research
Data that is not bulk personal data, as defined in 28 CFR Part 202
Data that is not proprietary or intended to be commercialized
UAlbany-developed software that is made freely available to the public without restriction or tracking
Records of the institution released pursuant to a freedom of information request that are not excepted from public disclosure

Examples:

Results of research
Open datasets
Conference presentations
Staff directory information published on the website
Non-confidential data
Public data

Handling Requirements:

Obtain IRB approval or determination of exemption, as appropriate
No restrictions on access or distribution
May be shared widely to public servers or websites without restriction

Roles & Responsibilities

Researchers: Classify data appropriately, follow handling requirements and report breaches.
Data Stewards: Assist with classification, ensure compliance and provide training
Information Technology Services (ITS): Provide secure infrastructure and support for data protection
Office of Regulatory and Research Compliance (ORRC): Monitor adherence to legal and regulatory obligations

Data Lifecycle Management

Creation: Classify data at the point of creation or collection.
Storage: Use appropriate storage solutions based on classification.
Sharing: Share data only with authorized individuals and under approved agreements.
Retention: Retain data according to institutional and funding agency policies.
Disposal: Securely delete or destroy data when no longer needed.

Access Data Management Resources

The first step to managing data to develop a written plan. A Data Management Plan (DMP) or a Technology Control Plan (TCP) is required when you're using regulated data, controlled data or data that cannot be shared freely.

The University Libraries’ Data Services unit can help you find, manage, collect and document, store and analyze, and share and preserve data. The DMP Tool available through the University Libraries can also help you create a DMP.

resources

Complete Required Training

Information privacy, security and export control training is available to all UAlbany campus community members through the CITI Program.

Training is required for anyone planning to receive or use regulated, controlled or third-party data.

Please visit the Regulatory & Research Compliance Training webpage for more information.

training

Request a Data Use Agreement (DUA) Review

A Data Use Agreement (DUA) is a contractual document used for the transfer of data between parties.

DUAs describe in detail what data is being shared, who is allowed access, for what purpose and for how long, and define any access restrictions or security protocols that must be followed by the data recipient.

UAlbany enters DUAs so our researchers can access third-party data needed for their work.

All data purchases must meet required procurement standards and receive approval from the relevant procurement team before any transfer of funds is made:

The DUA review process safeguards our faculty, staff and students, as well as their work, while ensuring the University meets its various obligations, such as federal and state laws, for the responsible use of data.

The Office of Regulatory and Research Compliance (ORRC) manages the University’s DUA review process, working and consulting with other offices as needed. Contact [email protected] with any questions.

data-use

How to Request a DUA Review

All DUA requests, whether they be an initial request or a modification request, should be submitted by the Principal Investigator.

Completed DUA packets should be sent to [email protected].

Initial Request Packet

Submit the following to request the University enter into an agreement for access to third-party data:

DUA Initial Request Form
DUA Signature Forms from all data users subject to the agreement
The proposed Data Use Agreement and any other forms requiring a University signature
Any other relevant, data-related forms submitted to the data owner or sponsor (such as a data use application, confidentiality agreements, etc.)
An IRB determination letter (only for data connected to human subjects)
A separate Data Management Plan, if created

Modification Request Packet

Submit the following to request a modification to an existing DUA or to add data users to an existing DUA’s coverage:

DUA Modification Request Form
A list of all personnel who would have access to the data under the modified agreement
DUA Signature Forms (see link above) from all new data users subject to the agreement
Copies of previously submitted forms
An updated Data Use Agreement and any other forms requiring a University signature
Any other relevant, data-related forms submitted to the data owner or sponsor (such as a data use application, confidentiality agreements, etc.)
An IRB determination letter (only for data connected to human subjects)

Understand the Genomic Data Sharing Process

Investigators who plan to share certain genomic data about human participants must obtain approval from the Institutional Review Board (IRB) and obtain a National Institutes of Health (NIH) Institutional Certification.

An NIH Institutional Certification — submitted by the Principal Investigator and signed by the UAlbany’s Office of Regulatory and Research Compliance (ORRC) — determines whether it is necessary to limit secondary research use.

This process ensures large-scale human genomic data submitted to an NIH-designated data repository adheres to NIH policy and any relevant laws, as well as the original study participants’ informed consent and preferences.

For additional information, please review the following resources:

Contact [email protected] with any questions.

genomic-data