Most departments within the FGB take on students for research internships or as temporary research assistants. When students work with research data, the confidentiality of the information, the privacy of the research subjects and the overall security of the data are at risk if students are not taught how to correctly manage and protect this research data. First determine the privacy risk categorization for the research data (and where applicable the confidentiality risk categorization); use this risk category alongside the following principles to determine the best methods for your students to safely manage and work with research data.
Students that are working with “Red”, “Orange”, “Yellow”, or “Green” data must sign a nondisclosure agreement (sometimes called a confidentiality agreemnt) before starting their research. For students conducting research solely under the supervision of the VU, a template agreement can be obtained from your section or department head, who will also sign it on behalf of the FGB director of operations. If the student is working at another institution where all data collection and data storage will take place, and the role of the VU is solely supervision of the research internship, then the other insitution is responsible for setting up an appropriate agreement with the student.
If the VU and another institution are both responsible for the data that the student will work with (i.e. data collection and/or storage happens at both the VU and the other institution) then the student must sign agreements with both the VU and the other institution. It is advised that the supervisor review the FGB template agreement in such a situation to ensure that there aren’t any issues impacting collaboration with the other institution; if there seems to be a problem, contact IXA for advice.
When providing research data to students, ensure that you use an appropriate method, based on the privacy and/or confidentiality risks, to either digitally transfer the data or physically provide the data (e.g. with an encrypted USB-stick).
Although the VU offers many data storage options, not all of these options are available to students. The following provides guidance on data storage options for students with consideration for the privacy and confidentiality risks to the data. The focus of this section is to describe solutions for data storage while a student is processing and/or analysing data. If students will be involved in data collection, see the relevant section below.
NB: The research data used in a research project can have a variety of risk categories: the raw data may be “Red” data, but the processed data may be “Yellow” or “Green”. It is recommended whenever possible to first process the data that will be provided to a student to reduce the risks as much as possible. De-identification methods can also be used, where appropriate, to reduce the risks in the data provided to students.
It is strongly recommended that students work with “Red” data on location at the VU on VU workstations under supervision of the student’s supervisor. The data should be stored on Research Drive and accessed via WebDAV or Cyberduck as discussed in the Secure Storage Guide.
In the event that it is not possible for a student to work onsite at the VU (for example, due to a massive pandemic), and it is absolutely necessary for the student to have access to these data, consider options that allow access, but avoid the local storage of the data on the student’s personal computer:
In the extreme case that a student must work from home with “Red” data:
If a student cannot be given access to a VU storage option and they must, therefore, store the data on an encrypted external hard drive or on their computer’s hard drive, there will be an increased risk of data loss. The supervisor should make a back-up plan with the student in this case. The data should be securely transferred to the supervisor in a similar method to how the data was provided to the student, and the supervisor should store the data on an appropriate VU storage option. It is up to the supervisor as to how often the data need to be backed up (at a minimum, once per month); back-ups should happen more frequently for data that will be used for research publications and for data that are extremely valuable and not easily replaced.
When the student has completed working with the data, they need to return the data to their supervisor via an appropriate method and then permanently remove the data the external hard drive or the computer’s local hard drive. This applies to all data regardless of the privacy/confidentiality risk.
Students may also be tasked with collecting raw data for a research project and physically transporting the data to the VU for storage. These students require guidance from their supervisors on how to securely transport these data. Advice on how to securely transport data can be found in this guide; students are expected to read the relevant sections of this guide, particularly the general tips. The researchers responsible for these students should also provide the students with clear instructions specific to the research project so that they know exactly what is expected of them. If a data collection process is particularly complex and/or there are many people responsible for data collection, it is recommended to document a data collection protocol which everyone on the research team can refer to as needed.
Regardless of the privacy or confidentiality risks posed by the research data, students are expected to document all of their work, particularly any code that is used to process and analyse the data. Students involved with data collections should be instructed on any relevant information that should be documented about the data collection process, for example, in logbooks.
Documentation is important for ensuring the integrity and quality of the research data, which is especially important if the data students are working with data that will be used for future research publications. At a minimum, good documentation by students will assist their supervisors in understanding and reviewing the data at the end of the internship.
It is recommended that students read the Security Basics.
For basic IT support on setting up (remote) access to VU networks for students, contact the IT Servicedesk.
For faculty-level support, contact the Technical Support for Research (TO3) Helpdesk. They can provide equipment for short-term data collection and storage, and if given sufficient notice, they can develop solutions for more complex research projects.
If the recommendations of this guide are not feasible, contact the Research Data Management Support Desk; they will bring you into contact with the relevant specialists in IT who can develop an alternative solution.