Research Data Collection and Storage
Collection, storage and processing of research data can occur in many different ways, varying by discipline, methodology and research project. Data can be gathered from instruments or by survey, interview, observation or audio/visual recording. Regardless of how data is collected it is important to ensure that it is collected, stored and processed in a reliable, secure and compliant manner.
The checklist below provides guidance on selecting and using appropriate technologies to support your research.
All University individuals undertaking research related to living indivudals should make sure they are in compliance with the General Data Protection Regulation and if applicable the Health Research Regulations.
The University Information Compliance office provides information on the legislation and guidance on whether a Data Protection Impact Assessment is required.
When working with valuable research data you should ensure that you are protecting the data correctly. IT Services provides comprehensive information on how to ensure that your personal computing environment, your computers and mobile devices are all configured securely .
If working with Personal data you may find it useful to identify and classify the personal data that you are working with and then to document the appropriate technical security measures that you are putting in place to protect the data.
Note: Data should not be transferred over public wireless networks such as those in a coffee shop or airport without the use of a Virtual Private Network (VPN) to ensure that the data cannot be intercepted.
Staff should configure their Wi-Fi settings so that your computer asks permission to join a new wireless network. If you are not using a VPN then do not use public Wi-Fi to access University Information.
The tools listed below are provided and supported by IT Services and when used correctly are safe, secure and GDPR compliant.
| Tools | Usage |
| University provided Computers and mobile devices | |
| Removable Storage devices | |
| Microsoft Forms | |
| Surveymonkey | |
| Qualtrics (Subject to licence) | |
| Custom Web forms from Research IT | |
| Microsoft Teams | |
| Redcap | |
| Microsoft Sharepoint | |
| Microsoft Onedrive | |
| Custom Databases from Research IT |
If you plan to use a software tool or service not provided by IT Services where data will be collected stored or processed and which has not been checked to ensure that it is secure and GDPR compliant. Then you should perform your own due dillegnce to ensure that the tool is suitable and that all University data will be properly protected.
This can be done by reviewing the IT Security and privacy measures or certifications the provider has in place. IT Service providers or software providers can demonstrate compliance with security and privacy in several ways:
Researchers procuring new technologies should:
- Review the Contract and/or Data processing agreement to ensure they contain appropriate protections for Univeristy data
- Review the Privacy Statement of the company/product to ensure compliance with relevent legislation
- Complete a Data Protection impact Assessment
- Review the Security controls in place in the software product or service
- Look for evidence of independent Security ceritfication such as ISO27001 for the product or service
If you are unsure of whether a proposed partner or service is appropriate for University data you should consult with IT Services and the Data Protection Officer.
Many useful services are provided free of charge on the Internet, however, many free tools are not GDPR compliant and may pose a risk to the privacy and security of your Research data.
When you use free services you do not have a
IT Services encourages Researchers to use approved vetted services rather than Public Cloud services such as Facebook or WhatsApp or free versions of tools such as Dropbox which may not be GDPR compliant.
There are a number of University policies which are relevant including:
Relevant online training is available at: