Research Data Management: Archiving, Ownership, Retention, Security, Storage, and Transfer

Management of research data is a shared responsibility among: the Research Innovation Office (RIO); the Office of the Vice President and Chief Information Officer (OVPCIO); Health Sciences; the University Libraries and system campus libraries; the colleges, schools and system campuses; and the Principal Investigator (PI).

University ownership and stewardship of research data that are generated or acquired by faculty, staff, and students through the use of University facilities and resources are based on applicable laws and regulations, sponsorship agreements, University policies, and sound management principles.

Ensuring that (i) research data management needs and regulatory obligations, including preservation and long-term accessibility, are met for critical, high-value research data, and (ii) operational considerations with respect to the various types of research data are captured is the joint responsibility of the Vice President for Research and Innovation, the Vice President and Chief Information Officer, the Vice President for Clinical Affairs, and the University Librarian and Dean of Libraries.

Ownership and Stewardship of Research Data

Unless superseded by specific terms of sponsorship or other agreements or University policy (see Administrative Policy: Copyright Ownership and Board of Regents Policy: Commercialization of Intellectual Property Rights, the University owns all research data generated or acquired by University employees (faculty and staff) or non-student trainees or fellows (not employed by the University) through research projects conducted at or under the auspices of the University of Minnesota, regardless of funding source.

Students own research data that they generate or acquire in their academic work, unless the research data are:

• generated or acquired within the scope of their employment at the University;
• generated or acquired through use of substantial University resources; or
• subject to other agreements that supersede this right (e.g., Research Data Ownership Acknowledgment form signed by student and PI).

Research data generated or acquired by students outside of their academic work or by volunteers through research projects conducted at or under the auspices of the University of Minnesota, regardless of funding source, are owned by the University unless superseded by specific terms of sponsorship or other agreements.

Multiple organizations or individuals may share ownership of research data, for instance, if the research data are generated or acquired through collaborative research.

The PI is the steward of the research data that are under their control. PIs are responsible for managing access to research data under their stewardship. PIs will select the vehicle(s) for publication or presentation of the data. PIs decide whether or not to share research data, including placing research data in public repositories, unless specific terms of sponsorship or other agreements supersede this right.

The University has the option to take custody of primary research data to ensure appropriate access in case of an allegation of research misconduct (see Administrative Procedure: Conducting an Inquiry).

Retaining and Archiving Research Data

PIs are responsible for ensuring that critical, high-value research data under their stewardship are preserved.

The PI is responsible for determining what needs to be retained in sufficient detail and for an adequate period of time to enable appropriate responses to questions about accuracy, authenticity, primacy, and compliance with laws and regulations governing the conduct of research.

PIs must retain research data for at least the minimum period required by applicable laws and regulations, sponsorship requirements, or other agreements. PIs may choose to retain the data beyond the minimum period, up to any deadline specified by laws, regulations or other agreements. Retention periods might be longer for data underlying published research.

PIs must ensure the destruction of research data when required by laws, regulations, or other agreements, on or before a specified deadline, and follow the applicable process for destroying research data:

• Media Sanitization Standard
• Media Sanitization Guidelines (Atlas login required)
• Administrative Procedure: Destruction of University Records

Transfer of Research Data

If a PI leaves or joins the University or a project is moved to or from another institution, the PI may request that a copy of the research data be transferred. (See Administrative Procedure: Transferring Research Data.)

Meeting Data Management Requirements

The PI is responsible for educating all participants in the research project of their obligations regarding the research data, carrying out their data management plan (if applicable), and for protecting the University's rights and ability to meet obligations related to the research data.

If the PI is a group of researchers, the group must either take on joint responsibilities for complying with this policy or delegate different responsibilities to different members of the group.

The PI; relevant colleges, schools, and system campuses; and Sponsored Projects Administration (SPA) are jointly responsible for identifying research data management requirements that go beyond standard requirements as soon as the requirements become apparent. SPA must be notified and keep a record of such requirements. Furthermore, colleges, schools, and system campuses must inform the SPA if they sign contracts that include stipulations for research data management, including security and retention needs that go beyond standard requirements, e.g., NIST Cybersecurity Framework requirements.

The PI is responsible for working with University administrative and academic units to ensure compliance with this policy.

• As soon as it becomes apparent, whether prior to or after acceptance of a grant or contract, that the PI cannot meet the responsibilities specified, the PI must consult with appropriate University officials in their colleges, schools, or system campuses.
• Colleges, schools, and system campuses are responsible for responding to and working with a PI if they cannot meet any of the responsibilities assigned to the PI described in this policy.

When the responsibilities assigned to the PI described in this policy exceed the capacity of the PI's college, school, or system campus, the respective college, school, or system campus is responsible for informing the Executive Vice President and Provost and working with RIO, OVPCIO, and Health Sciences (in case of health-related research data) to assist the PI in meeting research data management needs. If the research data management needs cannot be met by the University, the PI must be informed in a timely and transparent manner.

The Vice President for Research and Innovation, in consultation with the VP and CIO, the VP for Clinical Affairs, the University Librarian and Dean of Libraries and the Chief Financial Officer, has the authority to deny acceptance of grants or contracts if the University cannot meet the data management requirements of the sponsor.

Securing Research Data

PIs must ensure that research data are protected according to application specifications in Administrative Policies: Data Security Classification and Information Security. PIs can request a risk assessment to determine security requirements and must collaborate with University Information Security if requested in accordance with the Administrative Policy: Information Security Risk Management. PIs must meet all other data security requirements that may be specifically required under the terms of a contract or grant or other agreement or under laws and regulations associated with research data.