Research Data Governance and Data Sharing

Overview

Research data governance determines who is responsible for data, who may access them, for which purposes, under what safeguards, and what happens when the original study ends. It is broader than cybersecurity. A perfectly encrypted dataset can still be governed badly if access decisions are arbitrary, secondary use exceeds participant permissions, or institutional responsibilities are unclear.[1–4]

Advanced governance balances two ethical goods: protecting participants and enabling responsible scientific use. The appropriate endpoint is often maximum appropriate sharing, not either absolute secrecy or unrestricted public release.

Why this matters

Multicentre research, registries, biobanks and linked datasets cross organisational boundaries. Without a governance model, disputes arise over data access, authorship, future use, commercial collaboration, international transfer and who is accountable after the original investigator leaves. These disputes can delay research and undermine participant expectations.

Governance should therefore be specified while the study is being designed, not negotiated only when a collaborator requests the dataset.

Core principles

Ownership is a legal or institutional concept and may not rest with the individual investigator. Custodianship concerns holding and safeguarding data. Stewardship emphasises responsible decisions over access, quality, preservation and use. Governance defines roles, decision rights, accountability and escalation.

A good governance plan connects participant permissions, ethics approvals, contracts, institutional policy, repository conditions and data-access decisions. It also distinguishes primary use, secondary use within the original scope, and new uses that may require additional review or consent.

Ownership, control and stewardship

Researchers should avoid promising participants that an individual investigator “owns” the data unless that is legally and institutionally accurate. Institutions, sponsors, collaborative agreements and national rules may allocate control differently. Whatever the legal position, the protocol should identify who acts as data custodian and who has authority to approve uses.

Data access committees and decision criteria

Large or sensitive resources may use a data access committee. Decisions should be based on predefined criteria: scientific legitimacy, consistency with consent and ethics approvals, requester qualifications, security environment, conflicts of interest, duplication, community considerations and whether the minimum necessary data are requested. Committee membership and conflicts should themselves be governed.

Data-use agreements

A data-use agreement can specify permitted purpose, users, security controls, restrictions on re-identification, onward sharing, publication, intellectual property, breach notification, retention and destruction. It does not substitute for ethics approval or participant permission when those are required; it operationalises an already legitimate use.

Secondary use and consent scope

Broad consent can support future research within an ethically defined scope, but broad consent is not equivalent to unlimited use. Governance should consider what participants were told, whether new research is compatible with that permission, whether the new use creates materially different risks, and whether ethics review or re-consent is required.[2]

Repositories and access tiers

Open repositories are appropriate for some de-identified, low-risk datasets. Controlled repositories can authenticate users, review requests and enforce conditions. Highly sensitive data may require secure analysis environments where data do not leave the host. Tiered access allows the sharing model to match risk rather than forcing every dataset into one category.

Cross-border and cross-institutional use

International transfer can trigger legal, contractual, sovereignty and cultural obligations that differ by jurisdiction. Protocols should identify where data will be stored and processed, which institutions are responsible, what agreements govern transfer, and whether participants were informed of material cross-border use. Because these rules change, local legal requirements should be verified for each project.

Governance after project completion

Data remain ethically relevant after the primary paper. Governance should define archival duration, who maintains access infrastructure, how investigator departure is handled, how requests are logged, what happens if a repository closes, and how study withdrawal or participant restrictions are represented in derived datasets where feasible.

Current data-sharing policy example

The NIH Data Management and Sharing Policy, effective since 2023, requires covered NIH-supported research to plan for management and sharing. NIH updated the required DMS Plan format for application due dates on or after 25 May 2026, while retaining the underlying 2023 policy.[4,5] This is a funder-specific example, not a universal requirement, but it illustrates the move toward prospective governance and “maximum appropriate sharing”. Publication guidance also links clinical-trial reporting with prospective data-sharing statements and plans.[6] NIH subsequently clarified in July 2026 that transition and reporting requirements also apply to active awards and other applications at specified stages; investigators should consult the current implementation notice for the applicable workflow.[7]

Governance architecture for complex collaborations

Advanced research programmes benefit from a written governance charter that sits alongside the technical data-management plan. The charter identifies the bodies that make decisions, their authority, membership, quorum, conflict management, appeal process and records. A small study may need only the principal investigator and institutional custodian; a national platform may need a steering committee, data access committee, security lead and community or participant representation.

Governance should remain proportionate. Creating five committees for a small low-risk dataset can produce bureaucracy without protection. The question is whether decision rights are sufficiently explicit for the scale, sensitivity and longevity of the resource.

Data access decisions should be reproducible

Two researchers making similar requests should receive similar decisions unless a relevant difference exists. Reproducibility can be improved through application forms and decision criteria that ask about scientific purpose, variables requested, ethics status, security, qualifications, conflicts, publication plans and compatibility with participant permissions.

Decisions should be recorded with reasons. This creates institutional memory, supports audit and makes it possible to review whether criteria are being applied fairly. It also helps resist pressure from senior collaborators who expect privileged access.

Secondary analysis can change the risk profile

A dataset collected for cardiovascular outcomes may later be proposed for mental-health, ancestry or commercial prediction research. Even if the same variables are used, the social meaning and risk may change. Governance should consider the sensitivity of the new question, participant expectations, group harms and whether the original consent reasonably covered the use.

Linking a dataset to a new external source can similarly increase identifiability. Secondary-use review should therefore assess the new data configuration, not only the original dataset.

Return of results and incidental findings

Some data resources generate individual findings that may be clinically significant. Whether to return them depends on analytic validity, clinical significance, actionability, consent, professional responsibilities and available confirmation pathways. Research-grade genomic or imaging findings should not automatically be returned as diagnoses.

The governance plan should decide in advance whether individual findings will be sought, whether they will be returned, who confirms them and how counselling or referral occurs. Saying “participants will be informed of important results” is too vague for complex studies.

Commercial use and intellectual property

Commercial collaboration is not inherently unethical, but it may matter to participant expectations and institutional agreements. Consent forms should not promise that participants will share in commercial profits unless such an arrangement exists. Governance should clarify whether commercial researchers can access data, how intellectual property is handled and whether publication rights are protected.

Public–private collaboration may also create conflicts of interest for access committee members. Recusal and disclosure rules should be specified.

Indigenous and community data governance

FAIR principles focus on the ability to find and reuse data, but some communities emphasise collective rights, authority and benefit. The CARE Principles for Indigenous Data Governance—Collective Benefit, Authority to Control, Responsibility and Ethics—provide one complementary framework. They remind researchers that technically de-identified data can still have community-level implications.

Not every health dataset involves Indigenous data, but the broader lesson is important: governance should consider legitimate group interests and community expectations where the research context creates them, rather than assuming all ethical claims are individual.

Cross-border transfer requires more than secure encryption

International collaboration raises questions about legal transfer conditions, institutional authority, data localisation, foreign government access, repository jurisdiction and whether the receiving environment can honour participant permissions. A technically secure server abroad may still be an impermissible destination under the relevant rules.

The data map should therefore record both where bytes travel and which legal/institutional entity controls the processing. Agreements should allocate breach response, subject requests, deletion, audit and onward-transfer duties.

Data sharing should be monitored, not only approved

After access is granted, governance should verify that users remain within the approved scope. Controls can include access expiry, activity logging, publication notification, periodic attestation and requirement to destroy or return data at project end. High-risk secure environments can prevent local downloads and require output review before aggregate results leave the system.

Monitoring should remain risk based. A public aggregate table does not need the same oversight as a genomic dataset linked to longitudinal clinical records.

Governance failures need escalation pathways

The plan should anticipate misuse: attempted re-identification, unauthorised onward sharing, publication outside scope or a security breach. Responses can include suspension of access, institutional investigation, notification to affected parties and future access restrictions according to agreements and applicable rules. Without predefined authority, teams may hesitate when rapid action is needed.

The ethical objective is not punishment for its own sake. Enforcement preserves trust in the access system and demonstrates to participants that sharing conditions are meaningful.

Governance metrics and accountability

A mature data-governance system can monitor indicators such as time from access request to decision, proportion of requests approved, reasons for rejection, security incidents, overdue data returns and publications arising from shared data. These metrics can reveal whether governance is protective, unnecessarily obstructive or biased toward particular collaborators.

Transparency does not require publishing sensitive request details, but the resource can publish its access policy, decision criteria and summary activity. This allows participants, funders and researchers to understand how the data are used and whether promised sharing actually occurs.

Data access and authorship should remain separate

Providing data does not automatically entitle the custodian or original investigators to authorship on every secondary paper. Requiring honorary authorship as a condition of access can distort scholarly credit. At the same time, complex datasets may require substantive involvement from data experts to avoid misinterpretation. The governance policy should encourage appropriate collaboration without making authorship a compulsory access fee.

Secondary users should cite the dataset or acknowledge the resource according to repository policy. Contribution-based authorship can then be decided using the same standards taught in RM-P15-M09.

Withdrawal and downstream datasets

Participant withdrawal becomes complicated after data have been shared, transformed or included in published aggregate results. Governance should define what withdrawal can realistically achieve at each stage. It may be feasible to stop new sharing from the central repository but impossible to retract data already incorporated into completed analyses held by authorised external users.

Consent materials should explain these limits honestly. Overpromising total deletion can create obligations the system cannot fulfil, while refusing any withdrawal without justification undermines respect for participants.

Governance for machine learning and high-dimensional data

Prediction and AI research can create derived representations, trained model parameters and embeddings that are not conventional row-level datasets. Governance should consider whether these artefacts can leak participant information, whether models may be transferred internationally and whether secondary model use remains within the approved purpose. The fact that a model does not contain a visible spreadsheet does not automatically remove privacy or governance concerns.

Model-development collaborations also create risks of uncontrolled local copies. Secure analysis environments and federated approaches may reduce data movement, but they introduce new technical and governance complexities. The design should be chosen for the actual risk and scientific need rather than because a technology is fashionable.

Plan for governance sustainability

Long-lived cohorts and registries need resources for stewardship after the original grant. Server maintenance, access review, metadata curation and participant communication all cost money. A sharing promise without a sustainability plan may fail in practice. The protocol should identify likely funding and institutional ownership of these responsibilities.

If a resource will eventually close, the governance charter should explain whether data are archived, transferred to another custodian or destroyed, and how existing agreements are handled. Responsible stewardship includes an end-of-life plan.

A minimum governance record for every external data release

For each release, retain the request, scientific purpose, ethics or institutional approvals where relevant, variables supplied, access conditions, agreement identifier, date granted, expiry date and final disposition. If the request is refused, record the reason. This creates a defensible trail showing that access was governed consistently.

Derived datasets should also have identifiers and provenance. When an external user creates a cleaned or harmonised version, the team should know whether it returns to the repository, remains with the requester or must be destroyed. Without provenance, later analyses may use inconsistent definitions while appearing to come from the same source.

Participants are more credibly told that their data will be “shared responsibly” when the research programme can demonstrate this concrete decision history.

Participant and public involvement in data governance

For long-lived or sensitive resources, participant or public representatives can contribute to governance by identifying concerns that technical committees may overlook, such as unexpected commercial uses, culturally sensitive linkages or communication preferences. Representation should have a clear role and support; adding a single participant member without information or influence can become symbolic. The appropriate model depends on the resource, but governance benefits when affected communities can meaningfully inform access norms and benefit considerations.

Governance should be understandable to data contributors

Participants do not need to memorise committee structures, but the broad governance promise should be explainable in ordinary language: who holds the data, whether outside researchers may apply, what protections apply, whether commercial access is possible and whether future studies require further review. If the governance system cannot be described coherently to participants, its decision rules may also be unclear internally. Plain-language explanation is therefore a useful stress test for advanced governance design.

Final governance stress test

A governance framework should be tested using difficult hypothetical requests before the first external application arrives. Examples include a commercial researcher requesting identifiable linkage, a collaborator seeking data for a question outside the original consent, a senior investigator demanding immediate access without committee review, or a request from a country with different transfer requirements. If the governance charter cannot produce a clear, defensible response, its decision rules are incomplete. Stress testing is therefore a practical way to convert abstract principles into operational governance before conflicts arise.

Governance charters should also specify how policy changes are approved, communicated and versioned. Long-lived resources need change control so access rules do not evolve informally through precedent or personal negotiation.

Strong governance should remain understandable, reviewable and proportionate as the resource evolves over time.

DECISION GUIDE

Select a sharing pathway

• Is the proposed use within the consent and approved ethical scope?
• What residual identifiability and sensitivity remain?
• Which institution has authority to release or permit access?
• Would open, controlled or secure-environment access best match the risk?
• What agreement, review and audit trail are needed for the requester?

PROTOCOL CHECKLIST

Data governance specification

• Identify custodian, steward and decision-making authority.
• Define primary and permitted secondary-use scope.
• Specify open, controlled and secure access tiers.
• Describe data access committee or equivalent decision process.
• Use data-use agreements for approved external sharing where appropriate.
• Address repositories, cross-border transfers, retention and post-study stewardship.
• Keep an auditable log of access requests and decisions.

APPRAISAL CHECKLIST

Appraise a sharing plan

• Does the plan match what participants were told?
• Are “ownership” claims legally and institutionally defensible?
• Can access decisions be explained using predefined criteria?
• Are controls proportionate to sensitivity and re-identification risk?
• Does the plan cover the period after the original grant or investigator involvement ends?

Worked example

WORKED EXAMPLE

Creating governance for a five-hospital cohort

The collaborators replace the phrase “data belong to the study team” with a formal governance schedule. The coordinating institution acts as custodian of the integrated dataset under the collaboration agreement; contributing sites retain defined responsibilities for source data. A multisite access committee reviews secondary-use requests against consent scope, ethics status, scientific rationale and security.

Requests receive a minimum-variable extract in a controlled environment whenever feasible. Approved external users sign a data-use agreement prohibiting re-identification and onward sharing. New research materially outside the original permission requires further ethics consideration. This framework supports reuse without pretending that all data can safely be made public.

Suggested protocol or governance wording

Common mistakes

Knowledge check

What is the difference between stewardship and ownership?

Answer and reasoning

Ownership is a legal or institutional concept; stewardship concerns responsible management, access decisions, preservation and use. A person may steward data without legally owning them.

Does FAIR require public release of row-level participant data?

Answer and reasoning

No. FAIR supports findability and clearly governed accessibility; controlled access can be fully compatible with FAIR principles.

Can a data-use agreement replace ethics review?

Answer and reasoning

No. It can operationalise an approved use, but it does not by itself create ethical authority for a secondary use that otherwise requires review or consent.

Why plan governance after project completion?

Answer and reasoning

Because data-access requests, retention, participant permissions and institutional responsibilities continue after the primary analysis and may outlast individual investigators.

Key take-home messages

SUMMARY

Key take-home messages

• Research data governance defines roles, decision rights and accountability beyond technical security.
• Ownership, custodianship and stewardship should not be conflated.
• Responsible sharing may be open, controlled or restricted depending on risk and permissions.
• Secondary use must align with consent, ethics approval and institutional authority.
• Prospective, auditable governance enables scientific reuse while protecting participants.

References

1. World Medical Association. Declaration of Helsinki: ethical principles for medical research involving human participants. Ferney-Voltaire: WMA; 2024. https://www.wma.net/what-we-do/medical-ethics/declaration-of-helsinki/
2. Council for International Organizations of Medical Sciences. International ethical guidelines for health-related research involving humans. 4th ed. Geneva: CIOMS; 2016. https://cioms.ch/publications/product/international-ethical-guidelines-for-health-related-research-involving-humans/
3. Wilkinson MD, Dumontier M, Aalbersberg IJJ, et al. The FAIR Guiding Principles for scientific data management and stewardship. Sci Data. 2016;3:160018. https://doi.org/10.1038/sdata.2016.18
4. National Institutes of Health. Data Management and Sharing Policy overview. Updated 2026. https://grants.nih.gov/policy-and-compliance/policy-topics/sharing-policies/dms/policy-overview
5. National Institutes of Health. Updated elements of an NIH Data Management and Sharing Plan. NOT-OD-26-046. 2026. https://grants.nih.gov/grants/guide/notice-files/NOT-OD-26-046.html
6. International Committee of Medical Journal Editors. Recommendations for the conduct, reporting, editing, and publication of scholarly work in medical journals. Updated January 2026. https://www.icmje.org/recommendations/
7. National Institutes of Health. Implementation Update: NIH Data Management and Sharing Plan Requirements. NOT-OD-26-100. 29 July 2026. https://grants.nih.gov/grants/guide/notice-files/NOT-OD-26-100.html