---
name: research-ethics-data-management
description: Plan research ethics and data handling for a study, including consent, access, retention, sharing, and institutional review dependencies.
---

# Research ethics and data management

Prepare a practical, study-specific plan that distinguishes proposed safeguards from approvals, legal conclusions, and controls actually in place. Consult the relevant institution and qualified experts for authoritative decisions.

## Identify obligations and risks

Describe the research activities, participants or data subjects, jurisdictions and institutions, recruitment, data sources, collaborators, and intended use. Identify whether human participants, animals, sensitive or identifiable information, restricted materials, or consequential decisions are involved. Verify applicable institutional rules and current governing requirements from authoritative sources when they affect a decision; do not infer that a study is exempt or approved.

Map potential harms, power relationships, risks of re-identification, vulnerable populations, and incidental findings in the study's actual context. For participants, plan comprehensible consent, voluntariness, withdrawal conditions, and procedures for concerns or distress. Ensure promised withdrawal or deletion is technically and legally feasible. Describe confidentiality and anonymity accurately; removal of direct identifiers alone does not guarantee anonymity.

## Plan the data lifecycle

Inventory each data type, sensitivity, origin, lawful or approved basis for use, responsible owner, and expected volume. For collection and storage, specify minimum necessary data, supported devices and repositories, encryption and access controls where appropriate, separation of identity keys, backups, and audit or access review arrangements. Do not include passwords, access tokens, or personal records in the plan itself.

State who may access, analyze, transfer, and publish each dataset, and under what permissions or agreements. Plan de-identification and disclosure-risk review for sharing; consent, contractual terms, community expectations, or law may prohibit open release. Specify retention and disposal periods only when supported by current institutional or applicable requirements. Record the procedure for incidents and who must be contacted, rather than promising a response that has not been arranged.

Make reproducibility possible within the allowed access: document variable definitions, provenance, versioning, code, restricted access procedures, and derived outputs. A secure repository or encryption setting should be described as implemented only after verification. Do not upload sensitive data or change permissions merely because a plan proposes it.

## Participant-facing materials

When requested and appropriate to the study, prepare an editable participant information sheet and consent record using the institution's current required templates and approved protocol when available. Write for the intended audience and access needs; use clear language, suitable translations or alternative formats where needed, and explain technical terms. Mark unknown details for the researcher to resolve rather than presenting assumptions as approved procedures.

The information sheet can describe the study's purpose, who is invited and why, what participation involves, expected time and foreseeable burdens or risks, any supported benefits, voluntary choice, and a feasible process for withdrawal. Explain what information will be collected, who can access it, intended uses and sharing, retention where confirmed, and any limits to withdrawal or confidentiality. Include the appropriate researcher and independent contact details when supplied or verified. Do not promise anonymity, deletion, compensation, support, or a right beyond what the actual protocol and applicable requirements establish.

The consent record should identify the study and version, document the participant's informed agreement through the approved process, and give separate optional choices where appropriate, such as recording or future use. Make any required and optional activities clear, avoid preselected agreement, and allow space for dates and signatures or the approved alternative. Plan how questions and comprehension will be addressed and how consent records will be stored separately and securely when appropriate. The format and required elements depend on the setting, consent process, and institutional rules; a draft is not evidence that consent was obtained or ethics approval granted.

## Deliver

Provide a data inventory, risk and control table, proposed lifecycle, roles, required approvals and agreements, and unresolved decisions. Identify the authoritative rules checked and their date, and distinguish verified controls, planned controls, and unknowns. Escalate consequential questions to the institution's ethics, privacy, security, or data steward; this plan is not an ethics approval or legal opinion.