Best Practices for Sharing Sensitive Research Data Securely

Research data sharing accelerates discovery, but it also introduces risk—especially when handling sensitive information like personally identifiable information (PII), protected health information (PHI), or export-controlled materials.

This guide provides a practical checklist for researchers, data managers, and IT teams to share data securely without compromising compliance or collaboration.

Define Sensitivity and Obligations

Before sharing any dataset, answer these questions:

1. What Type of Sensitive Data Do You Have?

• PII: Names, addresses, Social Security numbers
• PHI: Medical records, patient identifiers (HIPAA-regulated)
• Export-Controlled: Technical data subject to ITAR, EAR, or other regulations
• Proprietary/NDA-Protected: Industry partnerships, trade secrets

2. What Are Your Obligations?

• IRB Requirements: Does your Institutional Review Board require specific data handling?
• Grant Compliance: Do funders mandate data sharing policies?
• Institutional Policies: What does your university or organization require?

Minimize Data Exposure

Principle of Least Privilege: Only share what's necessary.

Strategies

1. Subset the Data: Share only the columns/rows needed for collaboration
2. Anonymize: Remove direct identifiers (names, dates of birth) where possible
3. Aggregate: Provide summary statistics instead of raw data when appropriate

Encryption In Transit and At Rest

What Does "End-to-End Encryption" Mean?

• In Transit: Data is encrypted while being uploaded/downloaded
• At Rest: Data is encrypted while stored on servers

TeraSender uses industry-standard encryption (TLS 1.3) for all transfers and stores files encrypted on secure servers.

Retention Windows and Expiry

Don't leave data accessible indefinitely. Short retention windows reduce risk.

Recommended Approach

• Collaboration Data: 30-day expiry
• One-Time Transfers: 7-14 day expiry
• Long-Term Sharing: Use institutional repositories (e.g., Dataverse, Zenodo) instead of file transfer tools

Access Control and Tracking

Who Should Have Access?

Use email-based delivery instead of open links when sharing sensitive data. This ensures only specified recipients can download.

Auditability

For compliance, you may need to log:

• Who accessed the data
• When they downloaded it
• IP addresses (in some cases)

TeraSender's download tracking provides visibility into file access, helping you meet audit requirements.

Use vouchers + short expiry transfers to reduce risk.