Developing Preservation Services for Sensitive Research Data

Preserving research data throughout its lifecycle, particularly sensitive datasets, is a critical challenge for academic institutions. This case study describes how a university library developed trusted preservation services for sensitive research data, addressing key obstacles and lessons learned. Existing infrastructure supported confidential data but was inadequate for high-risk datasets, such as personally identifiable information. De-identification proved complex and costly, creating the need for secure storage and processing of data in its original form. The library’s medium- and long-term preservation services relied on two platforms: an institutional repository and a nationally maintained storage service. Neither initially met the required security standards, so both underwent significant adaptation to achieve compliance. Development was iterative, shaped by evolving legal, technical, and institutional contexts. Five phases defined the process: reviewing requirements, strengthening the expert network, enhancing team competencies, developing workflows, and implementing technical improvements. Reviewing requirements The project commenced with a comprehensive review of requirements for handling sensitive data. This encompassed data protection legislation, information security standards, institutional practices, and research ethics. While the aim was to establish a clear understanding from the outset, many requirements only crystallised over time due to changes in legislation and the regulatory landscape. Strengthening the expert network To manage sensitive data effectively, the team built a strong expert network within the university, leveraging existing institutional expertise. This network engaged legal advisors, data security specialists, ethics committees, and IT professionals. These collaborations enabled timely guidance on complex issues, such as assessing real datasets for compliance. The multidisciplinary approach proved essential for addressing the diverse challenges of sensitive data curation. Enhancing team competencies Internal capacity-building was essential. The library’s data preservation team expanded its responsibilities to include sensitive datasets, requiring significant upskilling before such data could be accepted. Training focused on assessing data sensitivity, advising on compliance, and producing documentation for reuse. A collaborative approach supported knowledge transfer from experienced staff to new colleagues. Practical skills were strengthened through direct engagement with researchers and evaluation of real datasets. Participation in the FAIR-IMPACT programme further enhanced expertise and ensured alignment with FAIR principles, reinforcing interoperability and reusability. Developing workflows and processes Workflows were redesigned to accommodate sensitive personal data, dual-use datasets, and other high-risk research data. A Data Access Protocol (DAP) was introduced for restricted datasets, defining access conditions and reuse criteria. A GDPR-compliant Data Protection Impact Assessment (DPIA) was completed for both services, and terms of use were updated. Preserving and enabling reuse of sensitive datasets requires extensive documentation, which researchers may perceive as unnecessary bureaucracy. A key principle was minimising user workload—an objective that proved challenging. Technical development The most challenging aspect of the technical development proved to be designing adequate information security practices while ensuring the preservation service remained usable. The key areas for improvement included robust access control, encryption, and thorough documentation of the data security measures implemented. These enhancements occasionally conflicted with usability; for example, encrypting large datasets hindered transfer and access. To address these challenges, the current security status of both platforms was assessed, and a development plan was formulated in collaboration with IT and data security teams. Ultimately, only minor modifications were needed, but achieving this conclusion and getting formal approval for it required significant effort. Conclusion Developing secure preservation services for sensitive research data has been a complex, iterative process shaped by legal, technical, and institutional factors. Collaboration, skills enhancement, and workflow refinement have established a sustainable, compliant infrastructure to meet researchers’ needs. Providing secure preservation services remains challenging and demands specialised expertise. Future progress will rely on learning from similar initiatives, enabling continuous improvement and strengthening the knowledge base for sensitive data management.