Data Management Plan Ethics for Research
By Dr. Zubair Khalid, DVM, MS, PhD ·
Quick Answer
- A data management plan (DMP) must document how you will collect, store, and share data in ways that respect research ethics and funder expectations.
- Start by mapping your data lifecycle against the NIH Data Management and Sharing Policy expectations, then draft your plan using a fill-in-the-blank template.
- A DMP is a living document, not a static form, and it cannot substitute for institutional review board (IRB) approval or other compliance requirements.
Why Data Management Plans Carry Ethical Weight
A data management plan is often treated as a bureaucratic hurdle in a grant application. In practice, the DMP is the place where you commit to ethical behavior with the data you generate. Funders, including the National Institutes of Health, now require a DMP as part of most grant applications, and they evaluate whether your plan addresses data collection, storage, sharing, and long-term preservation. The NIH Grants and Funding pages describe how these plans fit into the broader application and review process.
The ethical dimension of a DMP goes beyond compliance. Your plan makes promises about how you will protect participant privacy, maintain data integrity, and share results responsibly. When you write a DMP, you are beyond describing technical steps. You are committing to a standard of conduct that reviewers and your institution will hold you to.
Core Ethical Principles in Data Management
Respect for Persons and Data Sovereignty
Research ethics begins with respect for the people who contribute data. This principle applies whether you work with human subjects, animal owners, or laboratory samples. Your DMP should state how you will obtain informed consent, how you will protect identifiers, and how you will honor any restrictions participants place on data use. The Research Methods Resources gateway provides access to biomedical research references that describe these foundational ethical obligations.
Data Integrity and Reproducibility
A DMP that lacks attention to data integrity will fail both ethical and scientific review. You must describe how you will document your methods, version your files, and preserve raw data so that others can verify your findings. Transparent reporting is a core expectation in the research community. The EQUATOR Network maintains reporting guidelines that help you decide what methodological detail to include in your DMP and your eventual publications.
Accountability and Authorship
Your DMP should also address how you will handle authorship and credit for data contributions. The Committee on Publication Ethics Core Practices describe expectations for authorship, peer review, and data access. A DMP that names who will manage the data and who will be responsible for sharing it helps prevent disputes later.
At a Glance: DMP Ethics Decision Table
| Decision Point | Ethical Question | What to Document in the DMP |
|---|---|---|
| Data collection | What data will you collect and from whom? | Types of data, consent procedures, and any restrictions on use |
| Data storage | How will you protect the data from loss or breach? | Encryption, access controls, backup frequency, and storage location |
| Data sharing | Who can access the data and under what conditions? | Sharing timeline, access criteria, and any data use agreements |
| Data preservation | How long will the data remain available? | Repository choice, retention period, and preservation format |
| Compliance | Which funder and institutional policies apply? | Policy citations, IRB approval status, and institutional review steps |
How to Write an Ethical Data Management Plan
Step 1: Inventory Your Data Types
Start by listing every type of data you will generate. This includes raw measurements, processed files, code, metadata, and any physical samples that produce data. For each type, note the format, estimated volume, and any sensitive characteristics. This inventory becomes the backbone of your DMP.
Step 2: Describe Collection Methods and Consent
Write a short paragraph for each data type that explains how you will collect it. If you work with human subjects, describe the consent process and how you will document participant permission. If you work with animal data, describe how you will record observations and how you will handle any identifying information. The NIH Data Management and Sharing Policy pages provide examples of what funders expect in this section.
Step 3: Define Storage and Security Measures
For each data type, state where it will be stored and who will have access. Describe your encryption methods, password protocols, and backup schedule. If you use a cloud service, name the provider and explain how you will verify their security practices. Your DMP should also describe how you will handle data during transport, such as when you move files between institutions.
Step 4: Plan for Sharing and Access
Decide what data you will share, when you will share it, and with whom. The NIH policy expects you to describe your sharing approach, including any restrictions that protect participant privacy or institutional interests. If you plan to deposit data in a repository, name the repository and describe the access level. If you plan to share data on request, describe how you will handle those requests.
Step 5: Address Preservation and Retention
State how long you will keep the data and where it will be preserved. The NIH policy requires that data be preserved for a period that aligns with the research and any applicable regulations. Your DMP should name the repository or archive you will use and describe the file formats that will remain readable over time.
Step 6: Assign Roles and Responsibilities
Name the person who will manage the data on a day-to-day basis. This person is often a postdoctoral researcher or a data manager. Also name the person who will be responsible for sharing the data and for responding to access requests. The ORCID for Researchers pages describe how persistent identifiers can help you track research outputs and data contributions across your career.
Step 7: Review Against Funder Policy
Before you submit your grant application, review your DMP against the funder policy. The NIH Grants and Funding pages describe the application and review process, and the Data Management and Sharing Policy pages list the elements that must be present. Check that you have addressed each element and that your plan is internally consistent.
Records and Measurements for DMP Compliance
Your DMP is not a one-time document. You need to keep records that show you are following the plan. These records include consent forms, data dictionaries, version logs, and access logs. You should also keep a record of any changes you make to the plan, along with the reason for each change.
| Record Type | What It Documents | How Often to Update |
|---|---|---|
| Consent forms | Participant permission and any restrictions | At the time of consent |
| Data dictionary | Variable names, definitions, and formats | When you add or change variables |
| Storage and backup log | Where data is stored and when backups run | Weekly or monthly |
| Access log | Who accessed the data and when | Every time data is accessed |
| DMP revision log | Changes to the plan and the reason | When the plan changes |
Common Failure Patterns in Data Management Plans
Failure to Address Sensitive Data
A common failure is to write a DMP that treats all data the same. If your research involves human subjects, you must describe how you will protect identifiers and how you will handle the risk of re-identification. A generic statement about data security will not satisfy a funder review.
Failure to Name a Repository
Many DMPs say that data will be shared in a repository but do not name the repository. Funders expect you to identify a specific repository and to describe its access policies. If you do not know which repository you will use, describe the criteria you will use to choose one.
Failure to Assign Responsibility
A DMP that does not name a person who will manage the data is a red flag. Reviewers want to know that someone will be accountable for the data. Name the person and describe their role.
Failure to Plan for Data Loss
A DMP that does not describe a backup strategy is incomplete. Data loss can happen through hardware failure, accidental deletion, or a security breach. Your plan must describe how you will prevent loss and how you will recover data if it is lost.
Failure to Address Data Sharing Restrictions
Some data cannot be shared openly. Your DMP must describe any restrictions and explain why they exist. If you plan to share data only under a data use agreement, describe the agreement and how you will handle requests.
Limitations and Professional Escalation Criteria
A DMP is not a substitute for institutional approval. Your plan must be consistent with your institution's policies and with any IRB or animal care committee approvals. If you are unsure whether your plan meets a funder requirement, escalate the question to your institutional research office or to the funder's program officer.
You should also escalate a question if you discover that your data handling practices do not match your DMP. For example, if you find that a backup has failed or that a data file has been accessed without authorization, you must report this to your supervisor and to the appropriate institutional office. The Committee on Publication Ethics Core Practices describe the responsibilities of researchers to report misconduct and to correct the record.
Welfare and Safety Context in Data Management
Data management ethics also touches on animal welfare and laboratory safety. If your research involves animals, your DMP should describe how you will record animal health and welfare data and how you will handle any adverse events. The Research Methods Resources gateway provides access to texts that describe the ethical treatment of animals in research.
Your DMP should also describe how you will handle data that could pose a safety risk, such as data on hazardous materials or dual-use research. If your data falls into these categories, you must describe the security measures you will take and the institutional approvals you will need.
Build a Risk-Based Data Ethics Review Before You Submit
A DMP that reads well on paper can still fail in practice if you have not tested it against realistic failure scenarios. Grant reviewers increasingly look for evidence that you have thought through what can go wrong, beyond what you plan to do right. A risk-based ethics review is a structured method for stress-testing your DMP before submission. It forces you to identify the highest consequence failure points in your data lifecycle and to document concrete mitigation steps for each one. This framework is distinct from the drafting steps above because it is a verification exercise, not a writing exercise. You use it after you have a complete draft and before you finalize your submission.
Step 1: Rank Your Data by Ethical Consequence
Start by listing every data type from your inventory and assign each one a consequence score from 1 to 5. A score of 5 means that a breach, loss, or misuse of that data would cause serious harm to participants, animals, institutions, or public trust. A score of 1 means the data is public or has no identifiable content. The scoring is subjective, but the act of ranking forces you to think about which data matters most.
For human subject data, consequence is driven by identifiability and sensitivity. Direct identifiers such as names, addresses, and medical record numbers score high. Indirect identifiers such as dates of birth, rare occupations, or small geographic areas also score high because they can enable re-identification. For animal data, consequence is driven by welfare implications and by any proprietary or competitive value. For laboratory data, consequence is driven by reproducibility value and by any safety or dual-use concerns. The Research Methods Resources gateway provides access to biomedical texts that describe how to classify data sensitivity in research contexts.
Step 2: Identify the Highest Risk Points in Your Data Lifecycle
For each data type that scores 4 or 5, walk through the lifecycle and identify where the risk is highest. The highest risk point is not always the same for every data type. For a clinical dataset, the highest risk point is often during transfer from a clinical site to your institution. For a genomic dataset, the highest risk point is often at the point of sharing, because the data cannot be fully de-identified. For a field observation dataset, the highest risk point is often during collection, because you may be recording observations in a notebook that is not encrypted.
Write one sentence for each high risk data type that names the risk point and the specific threat. An example is, "The highest risk point for the survey data is during transfer from the tablet to the institutional server, because the tablet is not encrypted." This sentence becomes the basis for your mitigation plan.
Step 3: Design a Mitigation Plan for Each Risk Point
For each risk point you identified, write a specific mitigation step. The mitigation must be concrete and verifiable. A statement such as "we will use encryption" is not enough. You must state the encryption method, who will perform the encryption, and when it will happen. For the tablet example, the mitigation might be "the field coordinator will encrypt all survey files on the tablet before any transfer, and the transfer will occur only over the institutional VPN."
The NIH Data Management and Sharing Policy pages describe the security expectations that funders apply to data with identifiable or sensitive content. Your mitigation should be proportional to the risk. A high consequence data point with a weak mitigation is a red flag in review. A low consequence data point with an elaborate mitigation is a waste of space.
Step 4: Identify the Single Point of Failure in Your Plan
Every DMP has at least one single point of failure. This is the step in your plan where, if one person fails to act or one system fails, the entire ethical commitment breaks down. Common single points of failure include a single backup location, a single person who holds the only copy of the consent forms, or a single repository that has not yet agreed to accept your data. Your risk review must name the single point of failure and state what you will do if it fails.
For example, if your DMP says that all data will be stored on a single institutional server, the single point of failure is that server. Your mitigation is to describe a second location or a backup schedule. If your DMP says that the data will be shared through a repository that you have not contacted, the single point of failure is the repository. Your mitigation is to name a backup repository or to describe the criteria you will use to choose one if the first is not available.
Step 5: Write a Risk Table for Your DMP
The output of this review is a risk table that you can include in your DMP or keep as an internal planning document. The table has four columns: data type, risk point, consequence score, and mitigation. The table is a compact way to show reviewers that you have done the ethical reasoning work. It also serves as a living document that you can update when your data handling changes.
| Data Type | Risk Point | Risk Score | Mitigation |
|---|---|---|---|
| Clinical survey data | Transfer from tablet to server | 5 | Encrypt files on the tablet before transfer and use the institutional VPN |
| Genomic sequence data | Sharing in repository | 5 | Deposit in a controlled access repository and require a data use agreement |
| Animal health records | Collection in the field | 4 | Use a password protected notebook and transfer to the server daily |
| Laboratory instrument logs | Storage on the instrument computer | 3 | Back up the instrument computer weekly to the institutional server |
Step 6: Test Your Plan with a Tabletop Exercise
A tabletop exercise is a low cost way to test your DMP before you submit it. Gather the people who will handle the data and walk through a scenario. The scenario should be a realistic failure, such as a lost laptop, a failed backup, or a request from a journalist for your data. For each scenario, ask the group to state what they would do and where they would find the instructions. If the group cannot answer, your DMP is missing a step.
The tabletop exercise is not a formal requirement of any funder, but it is a practical way to find gaps. The Committee on Publication Ethics Core Practices describe the responsibility of researchers to maintain the integrity of the research record. A tabletop exercise is a way to test whether your plan will hold up under pressure.
Step 7: Document the Review and Update the DMP
After you complete the risk review, document the date, the people who participated, and the changes you made to the DMP. This documentation is part of your record keeping. If a reviewer asks how you arrived at a particular mitigation, you can show the reasoning. If a failure occurs later, you can show that you had considered the risk and that you followed your plan. The NIH Grants and Funding pages describe the expectation that applicants maintain records that support their applications.
Records and Measurements for the Risk Review
The risk review produces its own records. Keep the risk table, the notes from the tabletop exercise, and the revision log that shows what you changed in the DMP. These records are separate from the consent forms and access logs described in the main article. They document your reasoning process, not your data handling operations.
| Record Type | What It Documents | How Often to Update |
|---|---|---|
| Risk table | Data types, risk points, scores, and mitigations | When the data inventory changes |
| Tabletop exercise notes | Scenarios, responses, and gaps found | At least once before submission |
| DMP revision log | Changes made after the risk review | When the DMP changes |
Common Failure Patterns in the Risk Review
The most common failure in a risk review is to score all data as high risk. This makes the table useless because it does not help you prioritize. A second common failure is to write mitigations that are not specific. A mitigation that says "we will follow institutional policy" is not a mitigation. A third failure is to skip the tabletop exercise because it feels like a formality. The tabletop exercise is the step that finds the gaps that the writing process misses.
Limitations and Professional Escalation Criteria
The risk review is a planning tool, not a guarantee. It cannot predict every failure, and it does not replace the need for institutional security review or IRB approval. If your risk review identifies a risk that you cannot mitigate with the resources you have, you must escalate the issue. You should escalate to your institutional research office or to the funder program officer before you submit the application. A DMP that contains an unmitigated high risk is a sign that the project needs more planning or more resources.
If the risk review reveals that your data handling practices do not match your DMP, you must correct the DMP or correct the practice. The Committee on Publication Ethics Core Practices describe the responsibility to correct the record when you find an error. The risk review is the tool that helps you find the error before a reviewer does.
Frequently Asked Questions
What is the difference between a data management plan and a data sharing plan?
A data management plan covers the entire data lifecycle, including collection, storage, preservation, and sharing. A data sharing plan is a subset that focuses specifically on how and when data will be shared. The NIH policy requires a single plan that addresses both management and sharing.
Do I need a DMP if my research does not involve human subjects?
Yes. The NIH policy applies to most research funded by the NIH, regardless of whether it involves human subjects. Your DMP must describe how you will handle all data, including animal data, laboratory data, and computational data.
How long must I preserve data after a project ends?
The NIH policy requires that data be preserved for a period that is consistent with the research and any applicable regulations. Your DMP should state the retention period and the repository you will use. The policy does not set a single universal retention period.
Can I use a DMP template from my institution?
Yes, but you must adapt the template to your specific project. A generic template will not address the ethical and practical issues that are specific to your data. Review the template against the funder policy and fill in every section with project-specific details.
What should I do if my DMP changes during the project?
You should update the DMP and record the change in a revision log. If the change affects the ethical commitments you made, you may need to notify the funder or your institutional review board. A DMP is a living document, and you should keep it current.
How do I choose a repository for my data?
Choose a repository that is appropriate for your data type and that meets funder requirements. Consider the repository's access policies, preservation practices, and cost. The NIH policy pages describe the characteristics of acceptable repositories.
What is the role of ORCID in data management?
An ORCID identifier helps you link your data and other research outputs to your researcher profile. This is useful for tracking your contributions and for demonstrating your data management record. The ORCID for Researchers pages describe how to use your identifier.
What should I do if I discover a data breach?
You must report the breach to your supervisor and to the appropriate institutional contact immediately. You should also document the breach and the steps you take to address it. The Committee on Publication Ethics Core Practices describe the responsibility to report misconduct and to correct the record.
Related Articles
- NSF Data Management Plan: Requirements and Writing Tips
- Research Data Management Plan: From File Naming to Long-Term Sharing
- Data Lifecycle Management in Research: From Collection to Preservation
- Data Management Plan Template: A Practical Guide for Researchers
- Clinical Trial Data Management: From Collection to Database Lock
References and Further Reading
- Research Methods Resources. National Library of Medicine.
- EQUATOR Network. EQUATOR Network.
- Core Practices. Committee on Publication Ethics.
- NIH Grants and Funding. National Institutes of Health.
- ORCID for Researchers. ORCID.
- Data Management and Sharing Policy. National Institutes of Health.
- NCBI Literature Resources. National Center for Biotechnology Information.
- PubMed. National Library of Medicine.
This article is educational and does not replace institutional policy, professional advice, or applicable safety and regulatory requirements.