Publishing and sharing research data

For publishing research data or metadata about research data, keeping a data management plan (DMP) from the outset is immensely useful (and most often required). If you document and structure your data from the beginning, you save yourself a lot of work preparing the data for later publishing. A thorough and living DMP ensures that you plan ahead regarding future use of the data, making the potential re-use of your data easier.

A good starting point for a data management plan is Science Europe’s practical guide. This resource illustrates the core components of a DMP and is in alignment with requirements from both the Research Council of Norway and the European Commission. For more information about writing a DMP, see our data management planning section, and  for further assistance specifically on early stage archiving and publishing data planning, check out the national knowledge resource to support Data Management planning for Norwegian research institutions.

Remember that you need permission from all research collaborators before you publish your research data, and you should sign a written agreement stating the conditions for ownership, reuse, sharing and publication at the start of any project when such issues are relevant. It is common practice to follow the same guidelines for co-authorship as for publications when publishing data.

There are many reasons for publishing research data openly. Increased trust in research, possibilities for replication and reproduction, as well as avoiding unnecessary work when relevant data already exist, are some of these reasons. Both the Research Council of Norway and the European Commission have policies on data publishing, and some funding programs require that you make your data openly available unless you are restricted by e.g. sensitivity issues. Most journals encourage sharing the underlying research data, and quite a few, like Nature or the American Journal of Political Science also require that research data accompany the published articles. If your journal of choice does not require the publishing of related datasets, you should still keep in mind that your data could be valuable for other researchers. Making it available will contribute to increase the trust in your research. Remember also that your institution most likely has a policy on data publishing, which you must follow.

Although you may not be required to publish your data, there are still good reasons for doing so, both for yourself and for other researchers (Boczar & Schmidt, 2022; Miguel, 2021). 

• Publishing your data increases your visibility as a researcher.
• Studies that make data available in a public repository can in some cases receive more citations than similar studies without published datasets.
• Publishing data might lead to new collaborations, and seeing how other people interpret and use your data may be beneficial for your own future research.
• Publishing data makes research more transparent, and thus more trustworthy, since misinterpretation and fraud can be detected more easily.
• The research community can access a wider range of data to use for re-analysis, comparison, integration and testing.
• Quicker access to data allows science to develop faster.
• Less risk of data duplication makes research more sustainable.

It may be the case that the journal in wich you want to publish, or the funder of your research project, requires you to use a specific repository. Then the process will be fairly straightforward. If not, there are several possibilities for publishing data. You can identify and use an:

• Institutional archive
• Interdisciplinary archive
• Subject-specific archive
• Or a data journal

Most likely you will be better off choosing a subject-specific, trusted archive if this exists in your subject area: the curators will have first-hand knowledge of the type of data you have collected. For identifying existing relevant subject-specific repositories, you can visit the repository registries re3data.org or fairsharing.org.

DATA REPOSITORIES IN NORWAY

Several data repositories are nationally available in Norway. Follow the links in the non-exhaustive list below for a description of some of the Norwegian repositories, their focus, services and security level.

DataverseNO is a national, generalist repository for open research data. The Repository is managed by UiT The Arctic University of Norway on behalf of a national consortium consisting of the DataverseNO partner institutions. The repository supports the FAIR Guiding Principles for scientific data management and stewardship and is CoreTrustSeal certified. All management and use of the repository is regulated through the DataverseNO Organizational Agreement. Since it is an open repository, it is unsuitable for personal or sensitive data. Individual researchers affiliated with Norwegian research institutions that are not partners of DataverseNO are granted up to 10 GB storage space for free.  

Sikt (the Norwegian Agency for Shared Services in Education and Research) research data archive is responsible at a national level for archiving and sharing data from the social sciences, humanities, and parts of medical and health research. Sikt can archive all types of digital research data, including data that requires special handling or permissions, such as personal data. Sikt is in alignment with the principles of archiving as openly as possible, and as closed as necessary. Any researcher with an active Feide-account can log in and describe his or her data for an evaluation of the archiving possibilities. Sikt offers services for curating and assessing which level of restrictions can and should be placed on research data, ranging from open publishing to various levels of access control.

Sikt also owns Sigma2, the national e-infrastructure for computational science in Norway, offering services in high-performance computing (supercomputing) and large-scale data storage for research and education. Sigma2 services are available for Norwegian researchers and projects funded by the Norwegian government. The Sigma2-services include high-security data storage and a tool for data management plans. The Sigma2 repository service is called Nird, which is also compliant with the DataCite schema. Nird will store your data for a period up to 10 years. Nird is free and you log in with your Feide-account.

Sikt/Unit also offers a repository interface called BIRD through its consortium services. Norwegian institutions can create repositories within this interface for their own needs. BIRD is mainly intended as a data storage facility and should not be treated as a proper repository for sharing data openly. Sharing is possible through requests. BIRD is currently not offering services to new institutions, due to the launch of the new National Research Archive (NVA).

How to choose a repository

If you are interested in international multi-disciplinary data repositories, have a look in the section on finding research data. There are a few things to consider when choosing the right archive. The Digital Curation Centre has a checklist and a more detailed guide for evaluating data repositories, aimed at research support staff in UK higher education institutions, but the information is general in character and will be useful for you as well.

1. Is a reputable repository available?
2. Will it take the data you want to deposit?
3. Will it be safe in legal terms?
4. Will the repository sustain the data value?
5. Will it support analysis and track data usage?

These points involve long time preservation, possibilities for adding sufficient metadata and assigning a persistent identifier like a DOI. You should make sure that the archive you choose complies with the FAIR principles.

Some examples of interdisciplinary international open repositories are Open Science Framework (OSF), Zenodo and Figshare.

Under some circumstances data cannot be published openly. These include:

• Safety issues, e.g. data that may represent a threat to national security
• Personal sensitivity/confidentiality issues (cf. GDPR - General Data Protection Regulation), e.g. patient information
• Commercial issues, e.g. data have commercial value or involve external collaboration with industry
• IPR/copyright issues, e.g. restrictive licenses preventing redistribution/reuse

In terms of data publishing, these issues can sometimes be solved if addressed at an early stage, for example including formulations about sharing data in your consent forms to interview participants. You cannot share research data with personal information about others unless they are properly anonymized, include suitable expressions of consent for data publishing, or other relevant legal or research ethical considerations that align with sharing in the public interest are in place. However, if you have made sure to anonymize your data or you have obtained consent to share it, you may share your data openly. If not, metadata about a dataset can still be made available and searchable openly, while the actual underlying data can be archived with restricted access and control. It is important to assess what level of sensitivity your data represent, and if they have protective needs or need to be processed before sharing, and that the legal basis for processing the data includes sharing at the end of the project.

Data that are fully anonymized are no longer considered personal data, and fall outside the scope of GDPR regulations. In Norway, Sikt offers archiving options with restricted access, but they do not accept already anonymized qualitative data. 

Even though your research data may not be eligible for open publishing (yet), you still might need or want to send your data to another person, institution or project. This may be during the active phase of research, for further analysis or other forms of re-use. When you send your data directly to an identifiable unit, you are responsible for making sure that the receiver of the data will treat them according to relevant legislation and regulations. The best way of doing this is to sign a data processor agreement with the receiver of the data. Ask your institution's data protection official if there is a standard template for a data processor agreement, or create one using the information on Data Protection Authority's (Datatilsynet) webpages about data processing agreements.

As the data owner, it is you who must decide what the proper handling of your data is, and you are also responsible for obtaining any approval needed for processing personal data. However, any receiver of research data must make sure that all approvals are in place before they start processing the data.

The information below is important if you are transferring personal data. 

If you transfer your data to another institution, you must make sure that the receiving institution has a proper information handling system. Note that the Personal Data Act also applies to data transfer, meaning that any data that needs approval for research or collection also needs approval for transfer. If the receiving organization is subject to current industry or conduct norms, or is a certified information handler, you could most likely go ahead with the transfer. Try contacting the receiver institution data protection officer if you are unsure. Sikt also provides data protection services for many Norwegian research institutions.
Your institution is the data controller in this setting. It is the researcher's responsibility to determine the purpose of any data transfer as well as the way the data are to be transferred. This will often need to be clarified with help from the institutional data protection officer.

• Make sure that the receiver has a satisfactory information security system
• The requirements of the Personal Data Act must be met, meaning that the transfer must be legal and in accordance with defined purposes, as well as representing the least possible intrusion on privacy
• A risk assessment should always be performed before transferring personal data
• A data processing agreement which describes relations and authority must be signed between the data controller (you) and the data processor (receiver)

THE DATA PROCESSING AGREEMENT

When writing a GDPR-compliant data processing agreement you will most likely need help from your local data protection officer. If you need to issue a data processing agreement to a third party, even within Norway, you can use the following template as guidance.

• Example data protection agreement

The template is a freely available example adapted from the Proton Mail DPA.  

The Norwegian Data Protection Authority (Datatilsynet) has published a guide to the data processing agreement explaining what must be included in a general agreement if you should choose to write one on your own.

• Data processor agreements pursuant to the Personal Data Act and the Personal Health Data Filing System Act

If you are part of a larger project where a collaborating foreign university needs your data transferred for further processing, you are per definition transferring your data out of the country. The regulations in the Personal Data Act apply regardless of how long the data is stored abroad; international data transfer is regulated by the same requirements for approval as your own collection and handling of the same data. If your project needs approval by your institutional data protection officer before collecting data, it also needs approval for transfer out of the country.

Some data handling is regarded as transferring or sending data abroad. If you are part of a larger project where a collaborating university needs your data transferred for further processing, you are in fact transferring your data out of the country. The regulations in the Personal Data Act apply regardless of how long the data is stored abroad; international data transfer is regulated by the same requirements for approval as your own collection and handling of the same data. If your project needs approval before collecting the data, you also need approval if you need to send the data abroad.

• Research data may be transferred to countries within the EU and EEA.
• Personal data may be transferred to countries approved by the EU as recipients of personal data.
• Personal data may be transferred to other countries depending on the existence of a valid basis for the transfer.
• The regulations on processing in the Personal Data Act must be met:
  • there must be a legal basis for the transfer
  • the transfer must be in accordance with the purpose stated in the data handler agreement
• Transferring research data abroad does not require a separate notification to the data protection official, but the transfer must be described in any future application concerning the main purpose of the data processing.
• A data processing agreement is needed if the data is transferred to a data processor.

Boczar, J., & Schmidt, L. (2022). Analyzing Faculty Open Access Publishing: A citation analysis of select colleges at the University of South Florida. Journal of Academic Librarianship, 48(2), Article 102493. https://doi.org/10.1016/j.acalib.2022.102493

Miguel, E. (2021). Evidence on research transparency in economics. Journal of Economic Perspectives, 35(3), 193-214. https://doi.org/10.1257/jep.35.3.193