(1) This Procedure documents the expected practices for research data management, including data collection, storage, use, sharing, and retention activities. (2) This Procedure should be read in conjunction with the Research Data Management Policy to assist researchers to understand and apply the principles of the Macquarie University Code for the Responsible Conduct of Research (Macquarie Research Code) to the management of research data. (3) This Procedure applies to anyone who conducts research or research support under the auspices of Macquarie University, as per the Macquarie Research Code. (4) Researchers may consult with a Research Data Steward at any time for advice in relation to this Procedure. (5) Refer to the Research Data Management Policy. (6) Researchers should acknowledge and clearly specify details regarding ownership (refer to the Research Data Management Policy for the default arrangements), custodianship, access, licensing, and intended dissemination and use of any data collected, generated, or collated as part of their research, including: (7) All researchers must clearly establish their intentions related to each stage of the data life cycle for data associated with their project, prior to project commencement as follows: (8) Data should be stored on and backed up to Data Infrastructure sanctioned by Macquarie University. Refer to the Research Data Sensitivity, Security and Storage Guideline for help in assessing the sensitivity of data, appropriate security measures, data resilience and retrieval requirements and suggested platforms). (9) Permanent retention of data through deposit of data outputs into a discipline-specific repository or the Macquarie University Research Data Repository is best practice for all projects. Retention is required where the data is crucial to the substantiation of the research findings, cannot be readily or practically duplicated, and the research is: (10) The significance of research data is not always immediately apparent and permanent retention should be considered the default. If data is not retained permanently, the reason for its disposal should be explained in the DMP, and its disposal protocol should be articulated. The retention period must not be less than the period specified by prevailing standards for the specific type of research and any applicable state, territory or national legislation. For example, research data not of major significance but with potential long-term impact (including, but not limited to, environmental data, or health data such as research involving psychological testing or medical research involving children) must be retained for a minimum of twenty (20) years. Other research data must be retained for a minimum of five (5) years from the completion of the project or from the time that the results of the research are disseminated. (11) When disposal is justified, data used in research should be disposed of in a manner that is safe and secure, consistent with any consent obtained. It should follow the National Statement on Ethical Conduct in Human Research 2023 and any legal requirements and as appropriate for the design of the research. (12) In the event that research results are challenged, all associated records, materials and data must be retained unaltered until the matter is resolved. Research records that are subject to allegations of a breach of the Macquarie Research Code or are subject to legal proceedings must not be destroyed or altered. Platforms used to store data must have appropriate security and audit capabilities attesting to the integrity of the data. (13) Metadata should be captured for all data collected, generated, or collated by researchers. (14) At the conclusion of a project, or at the time of publication or dissemination of a research output, researchers should also disseminate their data as a Data Output, following best practice in their discipline and in accordance with any publisher or funder requirements. (15) Data Outputs should conform to the FAIR data principles as far as possible and any relevant discipline-specific metadata guidelines or practices. Appropriate context (descriptive, technical, methodological, and access information) should be provided, either within the data or in a separate metadata record for the data. (16) Data should be disseminated, regardless of whether the data directly supports the research findings. Such data should be as comprehensive as possible. Data should be as open as possible, and only as closed as necessary to meet ethical, contractual or intellectual property requirements (cf. EU Horizon 2020). Any request not to disseminate data must be justified. (17) Sensitive data can and should be disseminated with appropriate safeguards. Researchers must determine and apply appropriate techniques for safely disseminating research data which includes sensitive information. Doing so could involve removing sensitive information from the data, aggregating data, de-identifying data, or controlling access to a data output (or some combination of these approaches). Note that by combining data sources, it is growing ever more possible to re-identify data, so de-identification strategies must be carefully considered and explained. (18) Data that is being disseminated (a ‘data output’): (19) Data requiring mediated access must also include Terms of Use specifying how the data may be reused (e.g., prohibition against redistributing sensitive datasets). Data should remain as reusable as possible. Other datasets may also have Terms of Use specified (with appropriate justification). The Macquarie University Standard License Terms and Conditions of Use is provided as a default terms of use. Consult a Research Data Steward for further information. (20) If no Data Outputs are being disseminated, dataset-level metadata should be lodged with the Macquarie Research Data Repository, unless exposure of the metadata itself reveals sensitive information. Any request to keep metadata private must be justified. (21) Disseminated data may be subject to an embargo period, typically of eighteen (18) months, to allow researchers time to publish results before making data public. (22) Researchers must consult the Research Data Sensitivity, Security and Storage Guideline to determine the minimum-security measures to be applied during data management together with any terms of applicable research agreements (including but not limited to a Data Access Agreement). Additional security provisions may be required for defense related research projects (following Australia’s Foreign Relations (State and Territory Arrangements) Act 2020). (23) A data breach occurs when personal information or sensitive information collected during research is lost or subjected to unauthorised access or disclosure. A researcher has a responsibility to initiate appropriate remedial action reducing the likelihood of serious harm occurring from the inappropriate use of, access to, or loss of data containing personal or sensitive information. In addition to privacy breaches related to personal data, data breaches may also involve sensitive commercial-in-confidence data, sensitive trade, military or environmental data that may have serious consequences, if released. The researcher must report the data security breach immediately to Macquarie University IT Service Desk and to other relevant parties including the relevant Human Research Ethics Committee. Note that reliably reporting a data breach in a timely fashion requires the use of infrastructure with appropriate security, auditing, and alerts – a principal reason why researchers must use endorsed University platforms or develop alternative mitigation approaches (see clause 24). The Chief Risk Officer and IT will coordinate with the Privacy Officer (as required). (24) If external service providers are used for collection, management, collaboration, analysis, archiving, or dissemination of sensitive or highly sensitive data, the platform must be approved by a Research Data Steward or by the Human Research Ethics Committee as part of a Data Management Plan being submitted. It is the responsibility of the researchers to provide the information necessary to assess the platform’s suitability. Platforms must allow researchers and Macquarie University to comply with relevant legal, ethical, funder and publisher requirements, and provide data security and privacy comparable to research data systems approved by the University. (25) Refer to the Research Data Sensitivity, Security and Storage Guideline. (26) Definitions specific to this Procedure are contained in the Research Data Management Policy.Research Data Management Procedure
Section 1 - Purpose
Scope
Section 2 - Policy
Section 3 - Procedures
Data Governance
Data Management Planning
Data Storage, Retention or Disposal
Metadata and Data Dissemination / Publication
Data Protection
Section 4 - Guidelines
Section 5 - Definitions
View Document
This is the current version of this document. You can provide feedback on this document to the document author - refer to the Status and Details on the document's navigation bar.