• Section 1 - Purpose
• Scope
• Section 2 - Policy
• Section 3 - Procedures
• Section 4 - Guidelines
• Background
• Part A - Sensitive Information within Research Data
• Data Sensitivity Indicators
• Part B - Research Data Security
• Data Collection
• Active Data Storage
• Active Data Security
• Data Storage and Access for Archiving and Publication
• Section 5 - Definitions

Section 1 - Purpose

(1) This Guideline provides details on data sensitivity indicators and advice for assessing and classifying Data as Highly Sensitive, Sensitive or General. It also documents appropriate security measures and storage options for active data according to its sensitivity classification.

Scope

(2) This Guideline applies to anyone who conducts research or research support under the auspices of Macquarie University, per the Macquarie University Code for the Responsible Conduct of Research.

(3) The list of data sensitivity indicators within this Guideline is not exhaustive. Where a Researcher believes their Data may be Sensitive or has queries relating to this Guideline they are encouraged to contact a Research Data Steward.

(4) The Guideline assists Researchers to apply the principles of the Macquarie University Code for the Responsible Conduct of Research to the management of Research Data at Macquarie University and to direct their implementation of the expected standards.

Section 2 - Policy

(5) Refer to the Research Data Management Policy.

Section 3 - Procedures

(6) Refer to the Research Data Management Procedure.

Section 4 - Guidelines

Background

(7) Research Data may contain information of a personal or sensitive nature which must be protected against unwarranted disclosure.

(8) Sensitive information may include but is not limited to: health-related data; personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs; financial information; genetic data or biometric data processed solely to identify a human being. Sensitive information may also relate to information which may pose a risk to cultural resources, the environment or animals (such as the location of endangered species or threatened archaeological remains), to potentially valuable Intellectual Property, or to national security.

Part A - Sensitive Information within Research Data

(9) Sensitive information must be protected against unwarranted disclosure, monitored for potential Data Breaches resulting in such disclosure and amenable to audit in the event of an actual or alleged Data Breach.

(10) Access to Sensitive information must be safeguarded with appropriate Data Security practices.

(11) Data Security is a shared responsibility between the University and the Researcher (refer to the Cyber Security Policy).

(12) Protection of Sensitive information may be required for legal or ethical reasons, for issues pertaining to personal privacy and welfare, for cultural or environmental factors, for proprietary considerations, or to meet regulatory requirements.

(13) Research Data at Macquarie University can be grouped into three categories depending upon the sensitivity of its information. The categories are:

1. General;
2. Sensitive; and
3. Highly Sensitive.

Data Sensitivity Indicators

(14) Data is generally considered either Sensitive or Highly Sensitive if it contains Identifiable 'personal information' or identifiable health information. This includes:

1. '[Information or an opinion] about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.' (Privacy and Personal Information Protection Act 1998 section 4.1; Health Records and Information Privacy Act 2002 section 5.1)’
2. See also: '…information or an opinion, whether true or not, and whether recorded in a material form or not, about an identified individual, or an individual who is reasonably identifiable.' (Privacy Act 1988).

(15) Data may also be deemed Sensitive due to cultural considerations, environmental, or proprietary considerations.

(16) The type of 'personal information' contained in the Data, or other aspects of the Data, will determine if it should be classified as 'Highly Sensitive' or 'Sensitive' as follows.

(17) Research Data is considered Highly Sensitive when:

1. it contains the following types of ’personal information’ (adapted from the Australian Privacy Principles, Privacy Act 1988, schedule 1; see APP B.138 for more information; see also the Privacy and Personal Information Protection Act 1998 No 133, Section 19.1; the Health Records and Information Privacy Act 2002, Section 6) and is identifiable or (potentially) re-identifiable based on data contained within the record itself or if combined with other publicly available data:
   1. racial or ethnic origin
   2. political opinions
   3. membership of a political association
   4. religious beliefs or affiliations
   5. philosophical beliefs
   6. membership of a professional or trade association
   7. membership of a trade union
   8. sexual orientation or practices
   9. criminal record
   10. health information about an individual
   11. genetic information
   12. biometric information
   13. financial information
2. it contains information that is subject to regulatory controls and is deemed Highly Sensitive by a Research Data Steward or by a relevant Research Management Committee (for example, data relating to controlled technology per the Defence Trade Controls Act 2012 or information which poses a risk to national security).

(18) Data is considered Sensitive when it:

1. is identifiable and contains personal information/human subject data but does not concern the sensitivity indicators listed above in clause 17(a);
2. concerns a sensitivity indicator listed above in clause 17(a) but has been De-identified and cannot plausibly be re-identified from the Data itself or if combined with other, publicly available data. However, files relating reference codes or unique; identifier keys (e.g., Personal Identifier Number or PINs) to an identifiable person must be treated as Highly Sensitive data;
3. contains cultural heritage location information or other heritage data where community consent for release is lacking (standards and procedures vary in different countries);
4. contains ecological or environmental data concerning rare, threatened or endangered species;
5. contains data governed by IP/commercialisation agreements;
6. contains data that one or more investigators on the project do not consent to release (agreement should be reached before a project is launched and articulated in a Data Management Plan (DMP));
7. contains non-work-related contact information, location information, or other information deemed 'private', 'confidential', or 'sensitive' by any Macquarie University policy; or
8. it is associated with a project that is under regulatory control and is deemed Sensitive by a Research Data Steward or by a relevant Research Management Committee (for example, an Animal Ethics Committee per the Animal Research Act 1985 and the Australian Code for the Care and Use of Animals for Scientific Purposes or by an Institutional Biosafety Committee).

(19) Data is classified General when it is:

1. publicly available third-party data;
2. open data in the public domain or carrying an explicit, permissive license (e.g., an open Creative Commons or Open Data Commons license);
3. anonymised, aggregated or other derivative datasets based on personal information where the data cannot be disaggregated or used to reconstruct the original dataset (alone or in combination with publicly available data);
4. de-identified personal information that does not concern a sensitivity indicator listed above (17 a.) and cannot plausibly be re-identified from the data itself or if combined with other, publicly available data; or
5. not otherwise Sensitive or Highly Sensitive.

Part B - Research Data Security

(20) Examples of how Research Data can be classified according to its sensitivity, and how that relates to the Information Classification and Handling Procedure include (but are not limited to) the examples provided below:

Data Collection

(21) Data capture or collection practices vary from discipline to discipline and must be specified in your Data Management Plan.

(22) Researchers must use Macquarie University sanctioned platforms for the collection, capture, or collation of Sensitive or Highly Sensitive data where such platforms are available. The sanctioned platforms are listed in Table 1: Data Collection, Storage, Archiving, and/or Publication Platforms.

(23) If no platform exists for your research discipline consult a Research Data Steward regarding the process for proposing use of a non-Macquarie University sanctioned data platform.

Active Data Storage

(24) The Macquarie University sanctioned storage options for Data can be found in Table 1: Data Collection, Storage, Archiving, and/or Publication Platforms (appropriate security measures per clauses 29-31 must be implemented).

(25) Custom storage solutions using Australia-based commercial web services (e.g., AWS, Azure, Google Cloud) or peak facilities (e.g., NCI, Pawsey) may also be acceptable but will require approval by a Research Data Steward via a Data Management Plan in FoRA.

(26) Bespoke on-site storage solutions may be possible and will require approval by a Research Data Steward via a Data Management Plan in FoRA.

(27) If no platform exists for your research discipline consult a Research Data Steward regarding the process for proposing use of a non-Macquarie University sanctioned data platform.

Table 1: Data Collection, Storage, Archiving, and/or Publication Platforms

(28) Table 1: Data Collection, Storage, Archiving, and/or Publication Platforms outlines the storage options sanctioned by the University (internal access only).

Active Data Security

(29) Security practices must be applied to all active data to prevent unauthorised access or accidental loss. The required security controls are summarised in Table 2: Security Controls according to Data Sensitivity Classification.

(30) The sensitivity level of the Data determines the security practices that must be applied during data management.

(31) Researchers are expected to obtain assistance from a Research Data Steward or IT (if needed) to meet the following requirements:

1. The standard security practices that should be applied to Research Data which is not classed as either Sensitive or Highly Sensitive are:
   1. If using a personal device to store or access Data it must be properly maintained (e.g., regarding antivirus software).
   2. You must back up locally-stored data. Backups of locally-stored data should be automated, either via continuous synchronisation (as with SharePoint or OneDrive sync clients), or should be frequent and regular (e.g., with a daily incremental backup via a shell script).
   3. You must ensure unique, strong passwords for all services related to the Data.
   4. You should encrypt all personal or work devices on which Data is stored and from which the Data will be accessed.
2. If your Data is classed as sensitive, the following security practices are expected:
   1. You must ensure unique, strong passwords for all services related to the Data.
   2. You must encrypt all personal or work devices on which Data is stored and from which the Data will be accessed.
   3. You must back up locally-stored data. Backups of locally-stored data should be automated, either via continuous synchronisation (as with SharePoint or OneDrive sync clients), or should be frequent and regular (e.g., with a daily incremental backup via a shell script).
   4. If using a personal device to store or access data it must be encrypted and properly maintained (e.g., antivirus software).
3. If your Data is Highly Sensitive, the following security measures must be applied:
   1. You should avoid storing Highly Sensitive data locally (i.e., access, edit, and analyse it in its online location without downloading it).
   2. If you cannot avoid storing Highly Sensitive data locally, then you must only use Macquarie-issued, encrypted devices and back up locally-stored data (e.g., to SharePoint). Backups of locally-stored data should be automated, regular, and frequent. Consult a Research Data Steward for further advice.
   3. You must ensure unique, strong passwords for all services related to the Data.
4. Additional security controls may be required for defence-related research projects (or in projects deemed high-risk by the Research Risk Review Committee).

Data Storage and Access for Archiving and Publication

(32) The Macquarie University sanctioned archiving and publication platform options can be found in Table 1: Data Collection, Storage, Archiving, and/or Publication Platforms.

(33) Security practices must be applied to all archived data to prevent unauthorized access.

(34) The sensitivity level of the Data determines the security and access practices that must be applied when Data is archived and published for reuse.

1. The standard storage and access practices that should be applied to Research Data which is not classed as either Sensitive or Highly Sensitive are:
   1. You must archive Data in an appropriate trustworthy repository (a discipline-specific Research Data Repository, the Macquarie Research Data Repository, a general-purpose Research Data Repository or in national or international database, registry, or collections).
   2. You must explicitly license your Data.
   3. You should license your Data with a CC-0 or CC-BY License unless you justify a different License.
2. If your Data remains Sensitive or Highly Sensitive at the time of archiving and publication, the following storage and access practices should be applied:
   1. You must archive Data in an approved repository that supports Mediated Access and implements appropriate access controls (e.g., the Australian Data Archive, another approved Research Data Repository, or the Macquarie Research Data Repository). Contact a Research Data Steward for advice if required.
   2. You must select a Mediated Access regime for data placed in the Macquarie Research Data Repository (in consultation with a Research Data Steward if necessary):
      1. Restricted Access: Macquarie manages data access on your behalf, logging access to the Data and ensuring users consent to stipulated Data Access Agreement.
      2. Special Access: You will be informed by Macquarie of each request to use the Data, to give or withhold permission.  
   3. If you use the Australian Data Archive or another approved repository, you must select an appropriate Mediated Access regime from the options available from that repository (in consultation with a Research Data Steward if necessary).
   4. You must explicitly license your Data.
   5. You must set terms of use of your Data with a Macquarie University Data Access Agreement (for the Macquarie University Research Data Repository), or a similar terms and conditions of use restricting data redistribution, such as those offered by the Australian Data Archive or other approved Research Data Repositories.

(35) Data that cannot be disseminated for reuse must be retained in archival storage appropriate to its sensitivity level, ensuring proper security is in place to prevent unauthorised access. Data should be retained in Macquarie University sanctioned infrastructure to meet the Data’s privacy, security, legal, ethical, contractual, and institutional requirements (see the Research Data Management Procedure). Consult a Research Data Steward if uncertain.

Table 2: Security Controls according to Data Sensitivity Classification

(36) Table 2: Security Controls according to Data Sensitivity Classification outlines the security measures that are expected to be applied (internal access only).

Section 5 - Definitions

(37) The following definitions apply for the purpose of this Policy:

1. Data or Research Data may differ from discipline to discipline. Data means any information, sources, facts, observations, experiences, measurements, or materials that are generated, collected, collated or used in the conduct of research for purposes of substantiating research scholarship and findings. This may include, but is not limited to, information or primary and secondary materials held in any digital format or media, or anything that can be digitised, on which an argument, theory, test or hypothesis, or another Research Output is based. Data may also include other ‘digital research objects’ such as analytical code that support research outcomes. Research Data may be in the form of facts, observations, images, computer program results, recordings, questionnaires/surveys, biographies, audio files, physical specimens or artefacts, measurements, experiences or various other forms. Data may be numerical, descriptive, visual or tactile and could be raw, cleaned or analysed.
   1. Data referred to in this Policy does not include the information about research performance or statistical research data which is used by Macquarie University for planning and budget purposes or that which is reported to government agencies, e.g., Excellence in Research for Australia (ERA).
2. Data Breach is the accidental or deliberate access or exposure of Macquarie University information (including Research Data) to unauthorised parties. Potential or actual Data Breaches must be reported appropriately in accordance with the Data Breach Policy and the Cyber Security Policy.
3. Data Management Plan describes the management of Data through all stages of its lifecycle and includes documentation of how data will be created, collected, stored, and managed, and the provisions for access to data from its creation or collection to its preservation (refer to the Research Data Management Procedure).
4. Data Repository is information infrastructure, which may also be known as a data library or data archive. A Data Repository is used to store data for the long term and often supports data sharing or publication (open or Mediated Access) and data reuse reporting. Data outputs should be deposited in a domain-specific, domain-general, or institutional data repository. The submission of a Data Output into a data repository is often a requirement for publication or funding. Data repositories differ in their ability to offer users the ability to set Mediated Access conditions. Research data containing sensitive information that is being deposited into an online repository should have appropriate Mediated Access conditions assigned to it (refer to ‘Mediated Access’ or ’Specialised Access’ in the Research Data Sensitivity, Security and Storage Guideline. A restrictive license is also applied that limits redistribution of the Data.
5. Data Retention refers to the length of time that Data and records are kept after research project completion for the purpose of meeting legislations, funders, organisation, and other requirements.
6. Data Security refers to the process of protecting Data from unauthorised access and data corruption throughout all stages of its lifecycle. This may include practices such as: data encryption, two factor authentication, backup and other key management practices that protect data across all applications and platforms. Refer to the Research Data Sensitivity, Security and Storage Guideline.
7. De-identified or Anonymised Data: These terms are often used interchangeably, but for the purposes of these documents:
   1. De-identified Data refers to data which has had any direct and indirect identifying details (eg personal or locational) removed or transformed to protect privacy or confidentiality. However, identifying information may be able to be re-associated with the data later or re-identification may be possible in association with other publicly available data.
   2. Anonymised Data refers to data which has been collected or processed in a manner that makes it permanently impossible to identify individuals or locations from it. This usually involves stripping all identifiable elements from the data, for example, by aggregating or summarising the data to such a general level that individuals or locations cannot be identified, and the data cannot be re-engineered to identify individuals or locations.
8. Intellectual Property (IP) includes all copyright and all rights in relation to inventions (including patent rights), registered and unregistered trademarks (including service marks), registered and unregistered designs, confidential information, and circuit layouts and all other intellectual property rights resulting from intellectual activity in the academic, industrial, scientific, literary, and artistic fields recognised in domestic law anywhere in the world.
9. License offers researchers and institutions a standardised way of sharing Data Outputs with others and understanding their rights to use a Data Output generated by other researchers without infringing copyright. When a Data Output is being produced at Macquarie University, a licence (such as one that is defined by the Creative Commons, see further resources) should be assigned, which sets out the uses that may lawfully be made of the Data Output, and specifies the conditions under which its future use.
10. Mediated Access data has been deposited in a repository but requires a request from any would-be user, followed by the granting of permission for the use of the data either from a representative of the repository (e.g., ‘restricted access' data in the Macquarie Research Data Repository) or from the researcher(s) who produced the data, typically the designated Data Custodian (e.g., 'special access' data in the Macquarie Research Data Repository).
11. Researcher is any person (or persons) who conducts or assists with the conduct of research under the auspices of Macquarie University - may include staff members (academic and professional), visiting students, visiting fellows, volunteers, honorary and adjunct title holders, Emerita/us Professors, occupational trainees, and any student in any course at the University who conducts or assists with the conduct of research at or on behalf of the University.