How to Write a Data Sharing Plan for Sensitive Human Subjects Data

By Dr. Zubair Khalid, DVM, MS, PhD · 2026-11-11

By the end of this article you will be able to write a complete data sharing plan for a study involving sensitive human subjects data, choose an appropriate access model for that data, and defend every choice in the plan to a funder, an institutional review board (IRB), and a repository curator. You will need the following on hand before you start: your approved protocol and consent forms, your funder's data sharing policy, a list of the variables and file types your study will generate, and the name of your institutional data steward or IRB contact.

Why Sensitive Data Needs a Different Kind of Plan

Research data sharing is now an expectation across most life science and behavioral science funding. The National Institutes of Health Data Management and Sharing Policy, effective January 25, 2023, requires funded investigators to submit a plan describing what data will be shared, where, when, and under what controls [1]. Laboratory-oriented guides to data management describe the same expectations through the FAIR principles, which hold that data should be Findable, Accessible, Interoperable, and Reusable [2].

Sensitive human subjects data changes the picture. A survey of principal investigators holding active human subjects grants from the National Institute of Neurological Disorders and Stroke, the National Institute of Mental Health, and the NIH Brain Research Through Advancing Innovative Neurotechnologies Initiative found that 84 percent of the 397 responding investigators support increased sharing of deidentified individual-level data, yet the same investigators reported substantial barriers. The largest were costs and time, limited interpretability of data without context, lack of incentives, limited standardization of data acquisition and description, and heterogeneity of data types [3]. A data sharing plan for sensitive human subjects data exists to resolve exactly this tension. It commits you to share, and it specifies the controls that make sharing ethical and lawful.

Sensitivity comes in several forms, and your plan should name which ones apply:

Direct identifiers collected from participants, such as names, addresses, dates of birth, and medical record numbers.
Indirect identifiers, such as rare diagnoses, exact geographic locations, recruitment site, occupation, or precise event dates, which can re-identify someone when combined.
Stigmatizing or legally risky content, such as substance use, HIV status, immigration history, illegal behavior, or forensic information.
Data whose meaning depends on context, such as clinician-level or institution-level data embedded in health system research, where release could harm providers or organizations even when patients are deidentified [4].
Data governed by special national rules. Research on human genetic resources in China, for example, treats genetic data as sensitive personal information requiring separate consent, a withdrawal right, a security review for cross-border transfer, and additional assessment by national authorities for sensitive data [5].

The Core Format of a Data Sharing Plan

Most funders, including the NIH, evaluate data management and sharing plans against a consistent set of elements. The format below works for a data sharing plan for sensitive human subjects data across federal, foundation, and journal-mandated submissions. Each numbered section maps to a field you will fill in.

Data description. Types of data, amounts, originating instruments, and whether data are sensitive and why.
Related tools and documentation. Data dictionary, codebooks, analysis code, and the consent language that governs reuse.
Standards. Community data formats, terminologies, and metadata standards where they exist.
Sharing and access. The repository or access mechanism, the access model (open, controlled, or enclave), and who decides on requests.
Privacy and confidentiality safeguards. Deidentification or defacing procedures, re-identification risk assessment, and disclosure controls.
Timeline. When data are deposited, embargoed, and released.
Oversight and governance. Who is responsible, how compliance is monitored, and how violations are handled.
Budget. Personnel time, curation fees, storage, and secure transfer costs.

Guidance on developing data sharing plans in the social sciences emphasizes that these elements should be written as commitments with named responsible parties rather than as aspirational statements [6]. A practical guide for biomedical laboratory researchers similarly recommends building the plan around a data dictionary, unique subject identifiers, and standard operating procedures for data flow, so that the plan describes practices that already exist in the lab rather than practices that will supposedly appear later [2].

Step-by-Step Walkthrough With a Worked Example

The following walkthrough builds a complete plan for a fictional but realistic study. Work through the steps in order, because later sections depend on earlier ones.

Step 1. Inventory and classify your data

List every data product the study will generate, with file formats and sizes. Then classify each item for sensitivity. A worked inventory for a hypothetical study of substance use and neural function in 200 adults looks like this:

STUDY: Adolescent-to-Adult Risk Trajectories Study (example)
PI: Dr. A. Reyes          IRB protocol: 2025-0412

Item 1: Structural and functional MRI (NIfTI format)
  Volume: ~1.2 TB for 200 participants
  Sensitivity: Facial features can be reconstructed from
  structural MRI. Consent covers sharing after defacing.
Item 2: Interview transcripts on substance use (DOCX, then de-
  identified plain text)
  Volume: ~40 hours of audio, ~600 pages
  Sensitivity: High. Narratives contain family details, legal
  events, and small-cell risks. Consent covers controlled
  repository deposit only.
Item 3: Questionnaire and biomarker dataset (CSV plus data
  dictionary)
  Volume: ~200 rows x 340 variables
  Sensitivity: Moderate. Indirect identifiers possible through
  recruitment site plus visit dates.
Item 4: Analysis scripts and codebook (R and Python files,
  GitHub under embargo)
  Sensitivity: Low. No participant data.

Classification at this stage drives everything downstream. Interview transcripts collected on sensitive topics behave differently from imaging data, which behaves differently from tabular survey data.

Step 2. Choose and document your deidentification approach

Deidentification means removing or transforming information that could identify a participant. Write the specific procedure into the plan, not a general promise. For tabular data, this means naming the direct identifiers you will strip and the indirect identifiers you will coarsen, such as rounding ages above 89 into a single category or reporting recruitment region rather than clinic.

For imaging, the procedure should be equally concrete. In head and neck radiotherapy research, investigators benchmarked four publicly available defacing algorithms, mri_deface, defacer, fsl_deface, and pydeface, on T2-weighted MRI scans from 55 head and neck cancer patients with eight previously segmented organs at risk. They used a 5-fold cross-validation 3D U-net segmentation model to test whether defacing degraded the anatomical structures needed for radiotherapy planning. The study illustrates a critical point for any plan involving medical images: a privacy transformation such as defacing can interact with the scientific use of the data, so your plan should state which deidentification tool you will use and confirm it preserves the structures your data are meant to support [7].

Do not assume anonymization makes data safe to release anywhere. Reviews of mobile phone signaling data used in smart city planning show that even data anonymized under the applicable legal definition can still reveal a person's workplace, home location, and behavioral profile once trajectories are mapped to geographic space, which is why such data is treated as personal sensitive information despite anonymization [8]. Your plan should acknowledge residual re-identification risk honestly and match the access model to it.

Step 3. Select an access model and a repository

Decision path asking if data are deidentified and low risk, then if consent permits open release, then if legal risk needs an enclave.

This is the decision where most plans fail review. The access model must match the sensitivity level you classified in Step 1, not the most permissive model your funder would prefer.

The Human Connectome Project offers a useful real-world model. Its ConnectomeDB platform disseminates MRI and magnetoencephalography data along with behavioral and demographic data from the WU-Minn Human Connectome Project. Imaging data and much of the behavioral data are publicly available subject to acceptance of data use terms, while access to some sensitive behavioral data is restricted to qualified investigators under a more stringent set of terms. This tiered structure, open for low-risk data and controlled for high-risk data, with signed data use terms at both tiers, is a pattern you can replicate in your own plan [9].

The National Addiction and HIV Data Archive Program, established by the National Institute on Drug Abuse in 2009, shows the other end of the spectrum. It curates and disseminates highly sensitive social and behavioral addiction research data, including quantitative and qualitative assessments, biomarkers, and imaging, using practices and curation standards developed specifically for confidential data, with technical assistance for both depositors and users [1]. Archives like this exist precisely because some datasets should never sit in an open download.

Institutional and legal context also matters. Work on ethical data sharing in forensic research notes that biomedical research has centralized protected databases with rigorous approval processes that vet both the researcher and the scientific hypothesis, explicit signed agreements, institutional training requirements, and IRB review, safeguards that other fields are still building [10]. If your data carry legal risk, for example forensic interview data, your plan should name an access mechanism with that level of vetting.

The table below summarizes the three standard access models and when each is defensible in a plan.

Access model	How it works	Appropriate when	Example grounding
, -	, -	, -	, -
Open access	Anyone downloads after agreeing to data use terms	Deidentified, low re-identification risk, consent permits open release	ConnectomeDB public imaging and behavioral tiers [9]
Controlled access	Requesters submit an application, data use agreement, and sometimes IRB approval, and the repository or data steward vetts them	Sensitive content, small cells, residual re-identification risk, consent limits reuse	ConnectomeDB restricted behavioral tier [9], NAHDAP [1]
Enclave or no distribution	Data never leave a secure environment, analyses run remotely, only results leave	Highest-risk data, legal restrictions, forensic or genome-scale data	Protected biomedical database model with vetted researchers and signed agreements [10]

When you compare candidate repositories for your plan, evaluate them on five practical criteria: whether they accept your data type and format, what access tiers they support, whether they issue a persistent identifier and citation, what curation services they provide, and what happens if the repository loses funding. A repository that cannot enforce the access terms your consent form promises is the wrong repository, no matter how good its metadata support is.

Step 4. Check consent and governance documents against the plan

Read your consent forms before finalizing the sharing section. The plan can only promise what participants authorized. Where consent was study-specific and did not cover sharing, you have two defensible options: restrict sharing to the model the consent allows, or plan a secondary consent process.

Researchers studying data sharing and linkage in Brazil found that data subjects, researchers, and managers all balance risks and benefits constantly, and that perceived risk weighs more heavily depending on the individual's socioeconomic context. The same work found that people fear data processing by government more than processing by large technology companies, and that individuals and groups want representation in decisions about their data [11]. The practical implication is that consent language and community engagement belong in your plan, not afterthoughts left to the repository.

Ethical scholarship on human biospecimens argues that governance should respond when transformations change the risk profile of a resource. The Transformation-Triggered Governance framework identifies five triggers, biological, informational, purposive, relational, and commercial, each calling for proportional responses such as renewed consent, controlled access, transparency, or benefit-sharing conditions [12]. The informational trigger applies directly to data sharing plans. If a dataset collected before routine whole-genome sequencing is later combined with genomic data, the re-identification risk changes, and the plan should anticipate a governance response rather than treating the original consent as final.

Step 5. Set the timeline, including deliberate delay

Five phase timeline from month 0 to 30 collection through month 48 transcript release, with annual access review ongoing.

Funders want deposit dates, but sensitive qualitative and social science data often cannot be released on the same schedule as laboratory data. David Zeitlyn describes this as an Augustinian problem. Saint Augustine prayed to be made chaste, but not yet, and qualitative researchers often endorse open data the same way, in favor, but not yet, because duties to participants and communities conflict with immediate openness. Zeitlyn argues that adding delay resolves many of these conflicts, summarized in the phrase to make me open, but not yet, and that the real obstacle is often infrastructure that is not resourced to plan over long timescales rather than technical limits.

Build the delay into the plan explicitly. A defensible timeline for the worked example:

TIMELINE (example)
Month  0-30:   Data collection and primary analysis
Month 30:      Deposit deidentified quantitative dataset and
               defaced imaging to repository under embargo
Month 36:      Publication of primary results, quantitative
               dataset moves to controlled access
Month 36-48:   Transcript redaction and qualitative curation
               with repository curators
Month 48:      Transcripts released under controlled access,
               subject to data use agreement
Ongoing:       Access decisions reviewed annually by PI and
               data steward

A two-year embargo after deposit is a common and defensible structure for qualitative data on sensitive topics. State the reason for the delay in the plan itself, so reviewers see a considered schedule rather than a stall.

Step 6. Write the actual plan text

Assemble everything into the document you will submit. A filled example, using the study above, shows the format in practice:

DATA SHARING PLAN (example, abridged)

1. DATA DESCRIPTION
This study generates structural and functional MRI (NIfTI),
semi-structured interview transcripts, a questionnaire and
biomarker dataset (CSV with data dictionary), and analysis
code. Data are sensitive because they concern substance use,
imaging carries facial reconstruction risk, and transcripts
contain contextual identifiers.

2. DOCUMENTATION
A data dictionary defines all 340 variables. Consent language
governing reuse is included in the codebook. Analysis code is
deposited under embargo alongside the data.

3. STANDARDS
Imaging: NIfTI format, BIDS directory structure.
Tabular: CSV with variable-level metadata per the data
dictionary. Transcripts: plain text with a redaction log.

4. SHARING AND ACCESS
Imaging and tabular data: deposit to a controlled-access
repository at month 30, released at month 36 after
publication. Access requires a data use agreement and
institutional affiliation.
Transcripts: deposit at month 48 to the same repository under
controlled access. Requesters must document IRB approval for
secondary use.
Code: public repository, embargo lifted at month 36.

5. PRIVACY SAFEGUARDS
Imaging defaced with pydeface, output visually inspected for
each scan before deposit. Direct identifiers removed from all
tables. Ages above 89 grouped. Recruitment region reported at
state level. Residual re-identification risk assessed by the
PI and the institutional data steward before each release.

6. TIMELINE
As listed above. Embargo periods are contractual with the
repository, not aspirational.

7. GOVERNANCE
The PI and institutional data steward approve access requests
within 15 business days. The repository enforces data use
terms. Violations are reported to the IRB and the funder.

8. BUDGET
Estimated personnel time for curation and redaction is
included in the grant budget under data management costs.
Repository fees, if any, are budgeted for the archive years.

A plan in this format answers the questions funders ask in the order they ask them, and it survives contact with a repository curator because every claim in it is checkable.

Step 7. Verify the plan before submission

Run through this checklist:

Every dataset in the inventory appears in the sharing section. Nothing was silently dropped.
The access model matches the sensitivity classification, item by item.
Consent forms actually permit the sharing model described. If they do not, the plan says so and describes the fallback.
Deidentification tools are named, and you have confirmed they preserve the scientific value of the data.
The timeline has real dates, not "upon publication."
A named person, not a job title alone, is responsible for access decisions.
Budget lines exist for curation, redaction, and repository costs, since investigators consistently report cost and time as leading barriers [3].

Common Mistakes and Limitations

Promising open sharing for data that cannot support it. Reviewers see many plans that promise open deposit of interview transcripts or geolocated health data. Open access is appropriate for a subset of deidentified data. For transcripts about illegal or stigmatized behavior, or mobility traces that can reveal home and workplace, a controlled model is the defensible choice, and the strongest plans say why.

Treating anonymization as a guarantee. Anonymous data can still be re-identified when combined with other sources, especially location trajectories and small-cell demographic tables. Plans should name the residual risk and the controls, not declare the data anonymous and stop there.

Defacing without checking scientific impact. Applying a defacing algorithm to a clinical imaging dataset can damage the structures the data exist to capture. Benchmark work in head and neck radiotherapy exists precisely because this had not been tested before, and any plan involving defaced clinical images should cite or perform an equivalent check for the anatomical regions of interest [7].

Forgetting that context can be the identifier. Pragmatic and embedded health system research often operates under consent waivers and uses electronic health record data. Even when patients cannot be identified, releasing data can expose providers or institutions to harmful out-of-context comparisons. Plans for such studies need safeguards at the provider and organization level, not only the patient level.

Writing the plan after the study. Data management practices such as unique subject identifiers, a maintained data dictionary, and standard operating procedures for data flow make sharing possible later. Research data management guidance is explicit that these practices should be designed in from the start, for labs of all sizes [2]. Retrofitting a plan onto chaotic data produces plans reviewers can see through.

Ignoring infrastructure timelines. Repositories and archives need funded curation capacity to honor long embargoes and controlled access over years. Zeitlyn's analysis of social science archiving emphasizes that infrastructures are often not resourced to plan over the timescales that sensitive data require [13]. Confirm repository capacity and fees before you commit to an embargo length.

Assuming one national rulebook applies everywhere. Cross-border sharing triggers additional requirements in many jurisdictions. Human genetic resources in China, for example, require security review and filing with the National Health Commission, plus additional assessment for sensitive data, and international cooperation projects declined after 2023 as regulatory classifications were refined [5]. If any collaborator or any portion of the data sits outside your country, your plan should address transfer approval explicitly.

Communicating privacy protections poorly. When researchers tested how to explain differential privacy, a technique that protects individuals by perturbing data, to laypeople, participants understood implications-based descriptions better than definition-based ones and were more willing to share data when descriptions made the practical guarantee clear. Write the privacy section of your plan, and any participant-facing explanation, in terms of what protections mean, not only how they work.

One general limitation applies to this article. Every study's ethics and regulatory situation is individual, and the plan you write must be reviewed by your own IRB, data steward, and sponsored programs office before submission.

Frequently Asked Questions

What is a data sharing plan for sensitive human subjects data?

It is a written document, usually required by a funder, that specifies what data a study will produce, which parts are sensitive and why, how they will be deidentified or protected, where and when they will be shared, who can access them, and who is responsible for access decisions. It turns the general commitment to research data sharing into specific, verifiable commitments.

Is a plan still needed if the data will be deidentified?

Yes. Deidentification reduces but does not eliminate risk, and the plan must still document the deidentification procedure, the residual re-identification risk, and the access model. Investigators themselves overwhelmingly support sharing deidentified data while still reporting barriers that a plan must address [3].

What format should the plan follow?

Use the eight-section format in this article: data description, documentation, standards, sharing and access, privacy safeguards, timeline, governance, and budget. This structure maps cleanly onto federal funder review criteria and onto what repositories need to know when you approach them.

Can I share data if my consent forms never mentioned sharing?

Only within what the consent permits. If consent was silent or study-specific, restrict sharing accordingly or plan an approved secondary consent or waiver process. Participant perspectives research shows people want representation in decisions about secondary use of their data, so treating consent as a real constraint rather than an obstacle is both ethical and practical [11].

How long can I delay release of sensitive data?

Long enough to protect participants, stated explicitly in the plan. Embargoes of one to three years after deposit, with a stated rationale tied to participant protection and publication timing, are defensible, and qualitative researchers have argued that deliberate delay resolves many conflicts between openness and duties to participants [13].

How do I choose between repositories?

Compare candidate repositories on data type compatibility, supported access tiers, curation services, persistent identifiers, and enforcement of data use terms. Archives like NAHDAP demonstrate what curation for sensitive behavioral data should look like, and ConnectomeDB demonstrates tiered access in practice, so use those models as benchmarks [9][1].

What if my funder requires sharing but my IRB restricts it?

Write the plan around the restriction and document it. Funders accept plans that specify controlled access, enclaves, or staged release when those models follow from consent and ethics requirements. The key is to show that the restriction is documented, that some sharing pathway exists, and that a named person manages it [1].

Does sensitive data sharing cost anything?

Yes, and the plan should say so. Personnel time for deidentification, redaction, curation, and secure transfer are real costs, and investigators report cost and time among the largest barriers to sharing human subjects data [3]. Include these as budget lines rather than absorbing them silently.