What is the process for determining if a dataset can be shared publicly or must be restricted?

Determining whether a dataset can be shared publicly or must be restricted is a critical decision point in the research data lifecycle, and one that requires thoughtful evaluation of the data’s sensitivity, legal obligations, ethical considerations, and contractual constraints. At IU, researchers should follow these steps to decide if their data can be shared openly or must remain restricted:

1. Assess the data content.
   • Use the RCData Sharing and Handling ToolProvides guidance on data storage, sharing, disposal & classification RC Data Sharing and Handling Tool to classify the data (e.g., Public, University-Internal, Restricted, Critical)
   • Identify if it includes personally identifiable information (PII), RCprotected health information (PHI)IU policy regarding use of protected health information in research RC protected health information (PHI) , RCFERPA-regulated dataFERPA compliance information RC FERPA-regulated data , or other sensitive content.
2. Check consent and approvals.
   • For human subjects research, review RCIRBCompliance policies for human subjects research RC IRB protocols and informed consent documents to see what sharing was permitted.
3. Review legal, ethical, and contractual obligations.
   • Confirm there are no limits from Data Use Agreements, third-party licenses, or sponsor requirements.
   • If data is de-identified and unrestricted, it may be eligible for open access.
4. Select an appropriate sharing platform.
   • For open sharing, consider RCDataCOREProvides access & preservation services for digital research data RC DataCORE or RCDataWorksRepository for preserving and sharing IUI digital research data RC DataWorks with proper metadata and licensing.
   • For restricted sharing, consider controlled-access repositories or create a metadata-only record with a RCDOIMints DOIs for scholarly work deposited in DataCore & IUScholarWorks RC DOI and request instructions.
5. Seek support if needed.
   • Consult with RCIU data librariansContact information for IU Research Data Services Librarians RC IU data librarians or RCSecureMyResearchFree resources & consulting to help researchers protect data RC SecureMyResearch for help interpreting requirements, evaluating risk, and planning sharing pathways.

This process ensures compliance with IU policies ( RCDM-01IU policy regarding the management of institutional data RC DM-01 , RCDM-02IU policy regarding disclosure of institutional information to third parties RC DM-02 ) while striking a balance between openness and participant and data protection.