Open data is key to open science, helping to build transparency and trust in research and improve research reproducibility. However, for some researchers working with sensitive or commercial data, it can be more challenging to follow open data practices. In our blog, we explore seven steps researchers can take to share sensitive data openly while maintaining security and privacy.

What is sensitive data?

Sensitive data can take many forms in different types of research.

One of the main types of sensitive data is human data, which can include:

• Images, videos, audio files, or qualitative data related to attitudes, opinions, or experiences
• Clinical trial results
• Datasets from social media sites
• Personal identifying information, such as age, ethnicity, location, and sexuality
• Sensitive health status information, such as alcohol dependency

These typically arise during health and social science research but can also be found in other research areas.

Some of these data types could allow individuals to be identified, especially when used in combination, and could lead to increased risk to individuals if they were identified. As a result, it’s vital for human data to be handled appropriately and only shared openly when sufficient safeguarding measures are in place.

Other types of sensitive data that can occur in all types of research include:

• Intellectual property, such as new inventions
• National security data, such as classified information from governmental bodies
• Third-party data, such as proprietary commercial information

Seven steps to help researchers share sensitive data openly and securely

Create a Data Management Plan

A Data Management Plan, or Output Management Plan, is one of the best ways to ensure you share sensitive data safely.

A DMP or OMP allows you to identify from the outset, before you even begin your research, the types of data you may collect, create, or reuse throughout the project.

Creating a Data Management Plan will help to inform how you carry out your research, and how you deal with data at each step of a project. This can help to:

• Identify what type of data might be sensitive
• Identify what data can be shared and what must not be shared at any point
• Provide adequate time to implement alternative data sharing measures for any sensitive data
• Allow you to obtain guidance from institutions, ethics boards, or funders before starting the time sensitive publication process.

It’s important to consider human and non-human data in a DMP, including any commercial or third-party data that might be reused or developed. There are lots of resources available for creating a DMP, including resources from OpenAIRE.

Identify legal data requirements

Once you understand the type of data being collected or used, you also need to understand all applicable legal requirements for your research and resulting data.

These differ depending on where you as an author are based, where your participants might be based, where your research is conducted, or where any third parties are based.

For example, in Europe, GDPR legislation governs data protection. And, according to the UN, 137 countries around the world have some form of data protection legislation.

As a result, it’s important to identify relevant legislation for your work.

Identify ethical data requirements

In addition, ethical considerations must underpin any data sharing, especially sensitive data, and you must ensure you consider the rights and dignity of individuals.

Your institution, funder, or organization can usually provide guidance on ethical and legal considerations for both human and non-human sensitive data.

For all articles published with Open Research Europe, the research must have been conducted according to the requirements of ethics and integrity in Article 14 of the Model Grant Agreement of Horizon Europe.

Submitted articles must respect European and national laws, including the EU Charter of Fundamental Rights and the European Convention for the Protection of Human Rights and Fundamental Freedoms, and have obtained relevant institutional and/or national ethics approval, as well as any additional ethical approval from Horizon Europe, which will be requested at submission.

Gain consents

As your research progresses, and you begin to collect or use data, you then need to gather appropriate consent. This relates to human participants or other third parties whose data you may be using.

You need to clearly communicate what data you propose to share, how the data will be shared, the level of access to be granted, and any limitations on access.

All participants or third-party organizations must have the option to opt out of their data or IP being shared and, in the case of human data, the option to have data anonymized if they wish when sharing.

These consents need to be recorded clearly in the DMP, ideally with evidence in writing, for the avoidance of doubt. It’s also important to note that once these consents are given, you can only share data in the exact way that has been consented.

Anonymize human data

When working with human data, one of the safest ways to share data openly while maintaining confidentiality is anonymization.

This removes any identifying information from a dataset to reduce the likelihood of re-identification. However, this is not a replacement for consent and should only be done with data for which you have already received informed consent to share.

Anonymization can be done for direct identifiers, such as full name, date of birth and address, and indirect identifiers, such as ethnicity, gender, sexuality, or place of birth.

Key data anonymization techniques include:

• Removing any variables that are not necessary for analysis or relevant to the research
• Making an information point less specific, such as swapping an address for a city
• Referring to a research participant without using their real information by using aliases
• Taking specific information like age and putting it into a banded range

Control access to data

In some cases, human data cannot be anonymized without losing its value, or you may be working with different sensitive data such as intellectual property or commercial data.

In these cases, authors can use a controlled access data repository to safely share data (again, only when consent is already granted).

These repositories allow researchers to store their data, but not publish it publicly. Instead, a metadata record such as a Data Availability Statement on Open Research Europe will be shared openly, which describes the data’s location and the conditions under which to access it.

The repository will then require users to meet certain requirements to access the data, thus ensuring that data is shared only in a way that is fully controlled by researchers.

Publish data-related information

With all that being said, there are some cases where data cannot be shared openly, regardless of the measures taken by authors.

As a result, most publishers and funders will have exceptions to open data policies, including Open Research Europe.

In these cases, authors can publish some of their data-related information instead, such as:

• Methods sections that provide a detailed description of how the study and subsequent data were created.
• Metadata, such as Data Availability Statements, providing a description of the final data, discussion of any variables assessed, and a data sharing disclaimer.
• Any intermediary data that can be shared without concern.
• Detailed information about where third-party data was sourced and how users can source it themselves.

This helps other researchers to reproduce the research for themselves, even if the original data is unable to be shared.

Next steps

If you’d like to find out more about sharing data, take a look at our open data guidelines.