Research Data Management

Description:  

Data that could cause harm to the institution, our partners, data subjects or national security if disclosed. Such data is typically Personal Identifiable Information (PII) data subject to regulatory controls or data subject to contractual restrictions. 

Examples:  

• Identifiable human subject data
• Contractually restricted data
• Interview recordings with participant names
• Sponsor restricted datasets
• NIH genomic data requiring special security controls 
• HIPAA-regulated protected health information from a “Covered Entity”
• Export controlled information or other regulated data 
• Other regulated data and data that when merged becomes sensitive and could impact financial standing, economic prospects, provide information about criminal activities or otherwise harm an individual

Handling Requirements:

• Obtain Institutional Review Board (IRB) approval or determination of exemption for obtaining, collecting, storing or analyzing PII for research
• Execute legal agreements when transferring data into or out of UAlbany (please contact [email protected] with any questions)
• Restrict access to authorized personnel only
• Require encryption for data storage (data at rest) and transmission (data in transit)
• Create a robust written Data Management Plan (DMP) or Technology Control Plan (TCP) when items are controlled for export
• Must comply with institutional data management plan standards
• Strict virtual and physical access controls with detailed audit logs
• Training for all project personnel in Research Security and Cybersecurity is required, and other training as appropriate to the project (please visit the Regulatory & Research Compliance Training webpage for more information)
• Maintain up to date lists of all persons who will access the data with ORRC
• Consult with ORRC prior to sharing or use in any AI system 

Description:

Non-public data that needs heightened care because exposure could create meaningful risk or harm. Access such data must be limited to authorized University purposes.

Examples:  

• Data from research that is not yet analyzed and is not ready for publication
• Proprietary information related to commercial endeavors
• Data collected under an IRB informed consent that contains PII
• Data subject to contractual obligations

Handling Requirements:

• Obtain IRB approval or determination of exemption for obtaining, collecting, storing or analyzing PII for research
• Obtain legal agreements when working with an external party
• Limit access project team members only
• Store data on secure institutional systems with access controls
• Develop a written Data Management Plan (DMP) 
• Use only approved tools for analysis and consult the data owner, data steward or ORRC before external sharing or use in vendor, hosted or AI-enabled services 

Description:

Non-Sensitive – Non-Public Data from research that is not yet analyzed and is not ready for publication. This data can also include proprietary information related to commercial endeavors.  

This data does not contain PII, information regulated by the federal or state government, and is not subject to contractual obligations, but requires safekeeping to protect from external entities. 

Examples:  

• Draft manuscripts
• Internal reports
• Preliminary data
• Research protocols
• Lab-specific protocols
• Anonymous survey results where subjects were promised confidentiality
• De-identified data
• Coded (pseudonymized) data where the identifiers will not be released
• Audio or video data that cannot be linked to an individual

Handling Requirements:

• Obtain IRB approval or determination of exemption for obtaining, collecting, storing or analyzing PII for research
• Obtain legal agreements when working with an external party 
• Limit access to project team members only 
• Stored on secure institutional systems with access controls
• Develop a written Data Management Plan (DMP)

Description:  

• Any Personal Data that is either anonymous or identifiable personal data lawfully in the public domain at the time it is collected for research
• Data that is not bulk personal data, as defined in 28 CFR Part 202
• Data that is not proprietary or intended to be commercialized
• UAlbany-developed software that is made freely available to the public without restriction or tracking
• Records of the institution released pursuant to a freedom of information request that are not excepted from public disclosure

Examples:  

• Published research results
• Open datasets
• Conference presentations
• Staff directory information published on the website
• Non-confidential data
• Public data

Handling Requirements:  

• Obtain IRB approval or determination of exemption, as appropriate
• No restrictions on access or distribution
• May be shared widely to public servers or websites without restriction 

• Principal Investigators (PIs) are responsible for the use of data, project personnel and researchers, process and research activity. PIs are also responsible for updating ORRC on any changes in the project team members and ensuring team members are adequately trained.
• Researchers use the data, classify data appropriately, follow handling and use requirements, and report actual or suspected breaches to ITS
• The Data Owner is the party that owns and licenses the data to be used in a project. The University at Albany is the data owner when data is created by University personnel or its agents.
• Data Stewards assist with classification, ensure compliance and provide training. Data stewards are not members of the project team and may manage access to data by researchers when required by the data owner or project sponsor.
• Information Technology Services (ITS) provides secure infrastructure and support for data protection, reviews contract clauses related to specific cybersecurity controls, and provides certifications of controls when required by data owner or project sponsor.
• The Office of Regulatory and Research Compliance (ORRC) monitors adherence to legal and regulatory obligations. ORRC also coordinates institutional reviews of Data Use Agreements.

1. Creation: Classify data at the point of creation or collection.
2. Storage: Use appropriate storage solutions based on classification.
3. Sharing: Share data only with authorized individuals and under approved agreements.
4. Retention: Retain data according to institutional and funding agency policies.
5. Disposal: Securely delete or destroy data when no longer needed. 

All DUA requests, whether they be an initial request or a modification request, should be submitted by the Principal Investigator. 

Initial Request Packet 

Submit the following to request the University enter into an agreement for access to third-party data: 

• Data Use Agreement DUA Initial Execution Request
• The proposed Data Use Agreement and any other forms requiring a University signature
• Any other relevant, data-related forms submitted to the data owner or sponsor (such as a data use application, confidentiality agreements, etc.)
• An IRB determination letter (only for data connected to human subjects)
• A separate Data Management Plan, if created 

Modification Request Packet  

Submit the following to request a modification to an existing DUA or to add data users to an existing DUA’s coverage: 

• Request for Modification to an Active Data Use Agreement (DUA)
• A list of all personnel who would have access to the data under the modified agreement
• DUA Signature Forms (see link above) from all new data users subject to the agreement
• Copies of previously submitted forms
• An updated Data Use Agreement and any other forms requiring a University signature
• Any other relevant, data-related forms submitted to the data owner or sponsor (such as a data use application, confidentiality agreements, etc.)
• An IRB determination letter (only for data connected to human subjects)