What Happens If You Don't Comply with Data Sharing Policies?

By Dr. Zubair Khalid, DVM, MS, PhD · 2026-11-11

Most researchers who fail to comply with a data sharing policy never make a deliberate decision to break the rules. They write a data availability statement, move on to the next project, and nothing happens. Reviews of the research data sharing system show exactly why: despite widespread policies from journals and funders, compliance remains low, enforcement is weak, and monitoring is almost nonexistent, leaving many datasets unavailable or inaccessible [1]. The most common cause of noncompliance, in other words, is the absence of any visible consequence combined with friction in the deposit process itself.

The first thing to check is the data availability statement in your most recent published paper, read against the actual policy of the journal and the funder that paid for the work. If the statement says data are "available on request" and no repository record exists, you are already noncompliant under most modern policies, and you are one email from a reviewer, a meta-analyst, or a funder audit away from finding that out.

This article explains what happens when researchers do not comply with data sharing policies, why noncompliance happens in a predictable order of causes, how to diagnose where your own project stands, and which fixes and prevention practices keep you compliant without turning your research program into a documentation exercise.

What Data Sharing Noncompliance Actually Looks Like

Data sharing policy noncompliance is not a single event. It is a spectrum, and knowing where you fall on it determines what happens next.

The mildest form is a vague availability statement. "Data are available from the corresponding author on reasonable request" satisfies no current major funder policy on its own, yet it remains one of the most common statements in the literature. The next level is a statement with no infrastructure behind it, where the corresponding author has left the institution, the files sit on a departed student's laptop, or the analysis scripts were never archived. A more serious form is a deposit that exists but is hollow: a repository record with no files, no metadata, no license, or a subset of the data that cannot reproduce the published results. The most serious form is refusing a valid request or refusing a journal's verification check, which moves the problem from research practice into research integrity territory.

The consequences scale with severity. They reach from a delayed manuscript at one end to a retracted paper and a damaged career at the other, with effects on the wider evidence base in between.

Data Sharing Policy Noncompliance Consequences at Three Levels

Consequences for the evidence base

Systematic reviews and meta-analyses underpin clinical guidelines and health policy, and their validity depends on access to the underlying datasets and analysis code. When those inputs are unavailable, reviewers are forced to work from incomplete or inconsistently reported summary statistics, use imputation, and rely on unverifiable assumptions. That process can distort effect estimates and mislead clinical decision-making. The damage extends past methodology, because flawed evidence synthesis influences treatment recommendations, healthcare spending, and patient safety, as illustrated by historical cases involving hormone replacement therapy [1].

This is the mechanism most researchers underestimate. A single missing dataset is not a private matter between an author and a journal. If that dataset sits inside a pooled meta-analysis that informs a treatment guideline, noncompliance propagates into patient care.

Consequences for the researcher

For the individual author, the practical consequences arrive in a rough order of severity:

Editorial friction. Editors increasingly request the underlying data at submission or revision. If you cannot produce it, the manuscript stalls or is rejected.
Failed verification. Some journals now spot-check deposits within their editorial workflows, a pragmatic verification approach advocated in the data transparency literature [1]. A record that looks complete to you may fail their check if files are missing or metadata are absent.
Post-publication exposure. When a reader requests data under your availability statement and receives nothing, the complaint can go to the journal and, in serious cases, lead to an expression of concern or a retraction under standard research integrity norms.
Funder consequences. Funders that mandate data sharing can withhold installments, flag grants in reporting, or weigh compliance in future funding decisions. The specific sanctions vary by agency, so read the terms of your own award rather than assuming the worst or the best.
Reputational cost. Collaborators, reviewers, and editors remember labs whose data cannot be verified. In a field where your next grant depends on trust, this cost compounds quietly.

Consequences for policy evaluation itself

There is a deeper, less obvious consequence that comes from policy research on compliance in other domains. When many people covered by a policy do not comply, any summary estimate of the policy's effects blends compliers and noncompliers together, which tends to make the measured effects look smaller than they really are. Analyses of drug benefit policies distinguish between a policy model, which measures the global consequences of a decision, and a clinical model, which measures what happened to people who actually followed the policy versus those who did not, and they show that high noncompliance causes policy evaluations to underestimate real effects [2].

Translated to research data sharing: if most authors in a field quietly skip deposition, meta-analysts and funders will systematically underestimate both the value of sharing and the size of the transparency problem, because the visible data pool looks more complete and more compliant than the underlying reality. Noncompliance does not just violate a rule. It corrupts the measurement of whether the rule works.

Why Noncompliance Happens: Causes From Most Common to Rarest

Cause 1: No enforcement and no monitoring

The dominant cause is structural, not personal. A policy review in the medical literature concluded that despite widespread data-sharing policies, compliance remains low, enforcement is weak, and monitoring is almost nonexistent, with many datasets unavailable or inaccessible [1]. When the probability that anyone checks approaches zero, rational busy people deprioritize the task. This is the same behavioral pattern documented across policy domains, and it is why the fix in most proposals is stronger enforceable mechanisms and verification built into editorial workflows rather than more exhortation [1].

Cause 2: Friction and the "available on request" loophole

The second cause is procedural friction. Depositing data takes time, choosing a repository takes decisions, writing metadata takes effort, and none of it counts toward a publication record in most evaluations. The request-based loophole removes even the appearance of obligation, because the promise costs nothing at submission time.

Evidence from health policy natural experiments shows how strongly behavior responds to friction and cost. In a Canadian study of all residents over 65, use of inhaled medications declined after a drug plan moved from full coverage to fixed copayments and then to 25 percent coinsurance with an income-based deductible between 2002 and 2003 [3]. Adherence to newly started statin therapy after acute myocardial infarction fell from 55.8 percent under full coverage to 50.5 percent under a fixed copayment, a 5.4 percentage point drop, and stayed 5.4 points lower under coinsurance as well [4]. Beta-blocker adherence showed a smaller but measurable decline of 1.3 percentage points under copayment [5]. The lesson transfers directly to research data sharing: every unit of friction you add between a researcher and compliance produces measurable noncompliance, and the "on request" statement is the copayment loophole of the publishing world.

Cause 3: Lack of trust

The third cause is social. Researchers fear being scooped, fear having their data reanalyzed by adversaries, and fear that secondary users will misinterpret data taken out of context. Compliance research in another regulated domain shows why trust matters: interviews with small-scale fishers in Brazil found that younger fishers and those with a trustworthy relationship with stakeholders were more inclined to comply with rules, and fishers trusted community actors far more than institutional actors such as environmental agencies [6]. The parallel for research data sharing is direct. Researchers comply more when they trust the requesting party, the repository, and the community norms, and they comply less when the policy arrives as an anonymous institutional demand. Solutions that build trust, such as recognized repositories with clear licenses, data use agreements, and credit through citation and DOIs, address this cause directly.

Cause 4: No plan and no infrastructure

The fourth cause is organizational. Many labs have no data management plan, no designated repository, no metadata standard, and no retention schedule. When the paper is accepted and the editor asks for data, the files exist somewhere, but nobody can assemble a clean, documented, depositable package under deadline pressure. The result is a hollow deposit or a postponed one, which becomes a permanent one.

Cause 5: Genuine legal and privacy constraints

The rarest but most legitimate cause involves data that cannot simply be posted openly, such as individual-level human health records. These constraints are real, but they are a reason to plan, not a reason to skip compliance entirely. Large linked studies show the path forward: an Ontario cohort study of 55,924 people in opioid agonist treatment linked prescription, insurance, hospitalization, and mortality databases across the province using encrypted patient identifiers to connect records while protecting individuals [7]. Controlled access repositories, data use agreements, and de-identification exist precisely so that sensitive data can still be shared under a policy rather than around one.

Safety note on human subjects data. Before depositing any dataset that touches individual people, verify what your consent forms, ethics approval, and institutional policy actually permit. Depositing identifiable data to an open repository can constitute a serious privacy breach and a violation of the consent participants gave. When in doubt, use de-identification plus a controlled access repository, and document the restriction in your availability statement.

Troubleshooting Table: Diagnosing Your Own Noncompliance

Decision path asking whether a repository record exists, whether it holds files and metadata, and whether the statement points to it.

Symptom	Likely cause	How to confirm	Fix
Paper says "data available on request", no repository record exists	Request-based sharing with no infrastructure	Email your own former address as a test requester, or audit whether any documented route to the data exists	Deposit the dataset in a suitable repository and replace the statement with a DOI
Repository record exists but has no files, no metadata, or no license	Deposit treated as a checkbox during the submission rush	Open the record in a private browser window and view it as a stranger would	Complete the deposit, add a metadata description, assign a license, and link it to the paper
Editor asks for data at revision and nothing is assembled	No data management plan during the project	Inventory the raw files, processed files, and analysis scripts, and check whether a stranger could rerun the analysis	Deposit what exists now, document the analysis pipeline, and add a data plan to the next project
Data contain identifiable patient information	Privacy constraints mistaken for a total prohibition	Re-read consent forms, ethics approval, and the funder's data policy for the allowed sharing model	Use de-identification and a controlled access repository, or a formal data use agreement, and state the access conditions in the paper
Funder compliance report or audit flags missing data	Funder data policy ignored at award stage	Compare the award's terms against what was actually deposited and when	Contact the program officer, propose a written remediation plan, and deposit before the next reporting cycle
Data cannot be located after a student or postdoc left	No retention schedule or institutional storage	Search departed personnel's drives, email attachments, and departmental storage before the account is closed	Reconstruct what is recoverable, deposit it, and move all future data to institutional storage with a named custodian
A reader requested data months ago and never received a reply	The corresponding author changed or the request was never routed	Check the published statement, then check who currently holds the files	Respond promptly, deposit the data publicly so future requests answer themselves, and notify the journal if the delay was long

A Diagnostic Sequence You Can Follow

Work through this list in order for any paper, funded project, or manuscript in revision:

Read the actual policy. Find the journal's data policy and your funder's data management requirement. Write down the deposit deadline, the required metadata standard, and whether controlled access is permitted.
Inventory the data. List raw data, processed data, and analysis code. Note file formats, total size, and where each copy currently lives.
Classify sensitivity. Mark anything with direct identifiers, rare disease combinations, or geographic detail that could re-identify individuals. This determines open versus controlled access.
Choose a repository using a data repository comparison suited to your field (see the next section).
Prepare the deposit. Export to open formats where possible, write metadata a stranger can understand, assign a license, and obtain a DOI or accession number.
Rewrite the availability statement so it points to the repository record, the accession number, and any access restrictions, rather than to a promise.
Test it. Open the record as an anonymous user, download the files, and confirm they open. Then answer the next data request within days, not months.

How to Fix Noncompliance: Data Repository Comparison and Practical Solutions

Comparison of generalist, domain-specific and institutional repositories by examples, best use and access model.

The core fix is a real deposit in a real repository, and the main decision is which kind. There are three broad families to compare.

Repository type	Examples	Best for	Access model
Generalist repositories	Zenodo, figshare, Dryad	Any discipline, datasets that lack a domain home, software and supplementary materials	Usually open, with persistent identifiers
Domain-specific repositories	GenBank for sequences, the Sequence Read Archive for raw sequencing reads, the Protein Data Bank for structures	Data types with community standards and required formats	Usually open, some with submission validation
Institutional repositories	Your university's research data service	Large files, long-term institutional custody, data tied to a specific institution's retention obligations	Varies, often open with local support

The general rule from the research data sharing community is to use a domain-specific repository when one exists for your data type, because community curation and standard formats make your data reusable. Use a generalist repository when no domain home exists, and use an institutional repository for custody and retention. Avoid personal lab websites and cloud folders as the primary sharing mechanism, since they rot when URLs change and provide no persistent identifier.

Beyond the deposit itself, the effective solutions map onto the causes:

Against weak enforcement, build your own accountability. Put data deliverables into the lab's project templates so they are checked before submission, not after.
Against friction, do it early. A deposit done during data analysis, when the files and codebook are fresh, takes a fraction of the effort of one assembled two years later from a departed student's folders.
Against mistrust, choose reputable repositories, use clear licenses, offer controlled access for sensitive data, and cite datasets formally so reusers give you credit.
Against missing plans, adopt a one-page data management plan per project that names the repository, metadata standard, license, and retention period before the first participant or sample is collected.
Against legal constraints, use the established mechanisms for restricted sharing rather than treating the constraint as an exemption.

Prevention Practices That Keep You Compliant

Prevention costs far less than remediation. Five practices cover most labs:

Write the data plan at the start of every project, not at submission time.
Deposit during the analysis phase while context is fresh, then update the record before publication.
Keep raw data in an institutional or backed-up system with a named custodian, so personnel turnover never orphans a dataset.
Standardize the availability statement format across all papers from the lab, always pointing to a persistent identifier.
Schedule a yearly lab audit in which each open project's repository record is opened as a stranger would see it and any hollow record is completed.

Common Mistakes and Limitations

Treating "available on request" as compliance. Under current journal and funder policies it generally is not, and it fails exactly when it matters, when someone actually requests.
Depositing summary statistics instead of the underlying data. A spreadsheet of group means does not allow reanalysis, and verification checks look for the level of data the analysis actually used.
Confusing code sharing with data sharing. Both are increasingly expected, and a dataset without the analysis script that produced the figures only half-answers a replication request.
Assuming privacy law forbids all sharing. Restricted and controlled access models exist for sensitive human data, and the constraint usually shapes the mechanism, not the obligation.
Assuming nobody checks forever. Enforcement is weak today, but the trend in editorial workflows is toward pragmatic verification, and a hollow record from 2024 can surface in a review process in 2027.
Individual cases vary. Your obligations depend on the specific journal, funder, consent terms, and institutional rules that govern your project, and your institutional research office or ethics board is the right place to resolve conflicts between them.

Frequently Asked Questions

What are the real consequences of not complying with data sharing policies?

The realistic consequences are editorial rejection or delay, failed verification checks, funder compliance flags, and damage to the evidence base when meta-analyses cannot access your data. In serious cases, an unfulfilled availability statement can escalate to expressions of concern or retraction under research integrity norms.

Can journals reject my paper if I do not share data?

Yes, many journals treat the data policy as a condition of publication and can reject or hold a manuscript when the underlying data are not accessible. A growing number also verify deposits during editorial review, so a fabricated or hollow statement is increasingly detectable.

Is "data available on request" compliant with data sharing policies?

Usually no. Most current funder and journal policies require a deposit in a repository or a documented controlled access arrangement, and request-based statements are widely criticized because requests are frequently ignored.

What if my data contain identifiable patient information?

You are not exempt, but you share through a controlled access repository, de-identified files, or a data use agreement rather than an open deposit. Check your consent forms and ethics approval first, then state the access conditions in your availability statement.

Which data repository should I choose for my project?

Use a domain-specific repository such as GenBank, the Sequence Read Archive, or the Protein Data Bank when one exists for your data type, a generalist repository such as Zenodo, figshare, or Dryad otherwise, and an institutional repository for custody and retention needs. The comparison that matters is standards, curation, and access model, not storage size.

Can I be forced to share data after publication?

In practice, yes. Funders can enforce award terms on already funded work, journals can require deposits as a condition of acceptance, and editors can pursue unfulfilled availability statements through research integrity channels even after publication.

Why do so many researchers ignore data sharing policies?

Because enforcement is weak and monitoring is nearly nonexistent, so noncompliance carries little immediate cost, while compliance carries real friction and perceived risks such as scooping. Trust and convenience, not rule knowledge, are the strongest levers on actual compliance behavior.

How do I fix noncompliance for a paper that is already published?

Deposit the data now in an appropriate repository, update or correct the availability statement through the journal if it was misleading, respond to any outstanding requests in writing, and document the remediation in case a funder or editor asks. If the data no longer exist, say so plainly and early rather than promising a deposit you cannot deliver.