How to Align with Institutional Data Sharing Policies

By Dr. Zubair Khalid, DVM, MS, PhD · 2026-11-11

Institutional data sharing policy compliance means matching where and how your research data is stored, documented, and accessed to the rules set by your funder, your institution, and the journals that publish your work. The single fastest way to reach compliance is to classify your data by sensitivity first, then choose the least restrictive repository and access model that still satisfies every applicable policy.

This guide explains what those policies demand, compares your main compliance options side by side, walks through worked scenarios, and lists the mistakes that most often derail research data sharing.

What Institutional Data Sharing Policies Actually Require

Most institutional data sharing policies converge on a small set of concrete requirements. A policy typically asks you to produce a written plan describing what data you will generate, how you will document and store it, where you will deposit it, and who can access it and under what conditions. The 2023 NIH Data Management and Sharing (DMS) Policy is the clearest example in the biomedical space. It requires NIH-funded researchers to submit a DMS Plan with their proposal and to share the underlying scientific data at the time of publication or at the end of the award, whichever comes first.

Compliance is more than a paperwork exercise. Policies increasingly require deposits in repositories that issue persistent identifiers, enforce metadata standards, and support controlled access for sensitive data. A study of researcher readiness at an academic medical center found that 67 percent of surveyed researchers understood the DMS policy, but only 47 percent felt comfortable developing a DMS Plan, only 29 percent had used the DMPTool planning platform, and only 40 percent were confident identifying an appropriate repository [1]. Those gaps are exactly where compliance tends to fail, so the rest of this article focuses on the decisions that fill them.

Who Sets the Rules: Funders, Institutions, and Journals

Three layers of policy shape your obligations, and they do not always align.

Funders set the broadest requirements. The NIH DMS Policy applies to all NIH-funded research that generates scientific data. A survey of the top 20 public and top 20 private clinical trial sponsors running trials in Europe found wide heterogeneity in how sponsors document data sharing policies, data management and sharing plans, and data use agreements, which means you cannot assume that a funder's expectations match those of a collaborating sponsor [2]. Read the specific policy of every funder on a grant, not a generic summary.

Institutions add their own layer. Universities and academic medical centers impose rules on human subjects data, controlled-access storage, data transfer agreements, and export of data across borders. The practical reality is that researchers rarely master this layer alone. At one academic medical center, 68 percent of surveyed researchers perceived executing a data management and sharing plan as burdensome, and qualitative themes included administrative overload, uncertainty about managing sensitive data, and calls for clearer institutional guidance [1]. Institutions have responded by building support structures. At the University of Virginia, a library and Clinical and Translational Science Institute partnership convened a working group with research compliance, regulatory affairs, sponsored programs, and the institutional review board to produce guidance, templates, and a website for researchers writing DMS plans and choosing repositories [3]. Washington University School of Medicine launched its own generalist institutional data repository with a fully mediated curation workflow staffed by library personnel [4]. Your institution may offer the same kind of help, and using it is usually the best institutional data sharing policy compliance option available.

Journals form the third layer. A survey of 275 journals in ecology and evolution found that 38.2 percent mandated data sharing and 22.5 percent encouraged it, while 26.9 percent mandated code sharing and 26.6 percent encouraged it [5]. In orthopaedic surgery, only 14 percent of 1,084 original research articles published in top journals between 2020 and 2023 included a data-sharing statement, showing how uneven journal enforcement remains across fields [6]. When a journal mandates sharing, it usually requires the deposit to happen before or at peer review, so journal deadlines can arrive earlier than funder deadlines.

Check all three layers before you collect a single data point. A plan written for the funder but silent on institutional human subjects rules will bounce back at the review stage.

Your Compliance Options Compared

The core decision in institutional data sharing policy compliance is which repository and access model to use. The table below is a data repository comparison across the options you are most likely to weigh.

Option	Access model	Best for	Key requirements	Relative effort	Main risk
Open deposit in institutional repository	Anyone can download	Non-sensitive biomedical, imaging, survey data	Curation, metadata, DOI assignment	Moderate, often institution-supported	Accidental exposure of identifiable data
Restricted deposit in institutional repository	Access by request, governed by agreements	Human subjects data, genomic data, licensed datasets	Data use agreements, institutional review approval, mediated requests	Moderate to high	Slow or denied access requests frustrate reuse
Disciplinary or subject repository	Open or controlled, field-specific	Domain-standard data types and formats	Format compliance, community metadata standards	Low to moderate	Does not always satisfy funder repository preferences
Journal-mandated deposit at peer review	Usually open, sometimes restricted	Any paper under a strict journal policy	Deposit before or during review, citation of the dataset	Low if data ready, high if not	Timing pressure, rushed documentation
Data available on request	Ad hoc	Situations where no repository path exists	A working contact and a promise you can keep	Low to declare, high to honor	Very low actual fulfillment rates
Federated or technology-mediated access	Data stays local, analysis travels	Cross-institution health data, cross-border projects	Federated infrastructure, policy automation, governance agreements	High, usually institutional	Complex setup, evolving legal frameworks

No single option is best in every situation. The right choice depends on data sensitivity, funder rules, and how your field reuses data. Each option is explained on its own terms below, followed by the criteria that decide real choices.

The Compliance Options in Detail

Option 1: Open Deposit in an Institutional Repository

An institutional repository is a service run by your university or academic medical center that stores published datasets under a persistent digital object identifier (DOI), a permanent web address that citations can point to even if files move. Open deposit means anyone can download the dataset without permission.

Washington University School of Medicine's Digital Commons Data@Becker illustrates the model in practice. Launched in response to the 2023 NIH DMS Policy, it uses a mediated curation workflow in which library staff guide researchers through consultation, metadata capture, documentation, and quality control. Draft DOIs are issued once the access type is chosen, and final DOIs publish after curation. The repository captures persistent identifiers including ORCID iDs for researchers and ROR IDs for organizations, and it applies the DataCite metadata schema plus custom fields. Since launch it has published 30 datasets spanning biomedical imaging, sequencing, quantitative assays, flow cytometry, and qualitative survey data, and those datasets have accumulated 4,409 views and 4,120 file downloads [4].

Pros. Curated metadata makes your data discoverable and citable. A DOI satisfies most funder requirements directly. The institution absorbs the hosting and preservation burden, and mediated support lowers the skill barrier for researchers who are not confident about repositories [1], [4].

Cons. Open access is inappropriate for identifiable human data. Curation takes time, so deposits need lead time before a grant deadline or paper submission. Generalist repositories may lack the format-specific validation that disciplinary repositories provide.

Option 2: Restricted or Controlled Access Through an Institutional Repository

Restricted access keeps a dataset in the repository but gates downloads behind a request process. At Washington University, restricted datasets require review by the Human Research Protection Office and execution of a Data Transfer and Use Agreement (DTUA), a contract that specifies who may use the data and for what purpose before any files change hands [4].

The usage numbers show how this plays out in practice. Across the first 30 published datasets, restricted datasets generated 13 access requests, of which three were granted through DTUAs [4]. That ratio is normal for controlled access. It protects participants at the cost of slower reuse.

Pros. You can comply with funder sharing mandates without exposing identifiable or sensitive data. The agreement process creates an auditable record of who received data and why. Institutions with in-house workflows, like the one at Washington University, handle much of the administrative load for you [4].

Cons. Requests can be declined, delayed, or lost in paperwork, which weakens the reproducibility goal that motivated sharing in the first place. The related study found that only 47 percent of researchers at one center felt comfortable preparing a DMS Plan and only 38 percent felt confident budgeting for data management and sharing activities, and restricted-access workflows amplify both difficulties because agreements take staff time and sometimes fees [1].

Option 3: Disciplinary and Subject Repositories

Disciplinary repositories are community-run archives built around the data standards of a specific field. Genbank-style sequence archives, crystallographic repositories, and psychology-focused archives are common examples. They often validate file formats and enforce field-standard metadata, which makes deposited data genuinely reusable by specialists.

Pros. Your audience already searches these repositories. Format validation catches errors a generalist repository might not. Many disciplines treat the relevant subject repository as the default answer to where data should go.

Cons. A funder may prefer or require an institutional or funder-designated repository, so you need to check whether a disciplinary deposit satisfies the policy text. Coverage is uneven across fields. If your subfield has no repository, you fall back on the institutional options above.

Option 4: Journal-Mandated Sharing at Peer Review

Many journals now require data (and sometimes code) to be available before they accept a manuscript. The ecology and evolution survey found that journals which mandated data sharing typically required it for peer review in 59 percent of cases, and journals mandating code sharing required it at review in 77 percent of cases, while journals that merely encouraged sharing demanded it far less often at that stage [5].

Pros. Compliance is checked by an editor rather than by your memory, and the dataset becomes public exactly when readers first encounter the paper.

Cons. The timing is unforgiving. If you wait until revision stage, you may be curating metadata under a submission deadline. Also, journal policy and funder policy can specify different repositories, and you may need to satisfy both with one deposit or two.

Option 5: Data Available on Request

Many papers state that data are "available from the corresponding author on request." This is the weakest compliance option, and the empirical evidence says so plainly. In the orthopaedic study, thematic analysis of data-sharing statements identified the gatekeeper role of authors and conditional availability as the predominant themes, and when corresponding authors were contacted, willingness to share was limited [6]. In the social sciences, researchers requested data from 400 authors who had stated data would be available on request or had not denied sharing. Sixty-seven responded, and only 15, about 4 percent, actually provided data, far below the roughly 12 percent fulfillment rate reported in the medical sciences [7].

Pros. It requires almost no advance work and can be a fallback when privacy, licensing, or indigenous data governance rules truly prevent deposit.

Cons. Promising data on request and then declining damages trust and can violate funder policy. Many policies now explicitly discourage or disallow this model except under documented justification.

Option 6: Federated and Technology-Mediated Access

Federated access means the raw data never moves. Researchers send analysis code or queries to the data holder, computations run inside the data holder's environment, and only aggregated results travel back. The European ICUData4EU program works this way, allowing intensive care unit data to be analyzed within local hospital environments while researchers across the EU access aggregated analytical results remotely, a structure designed to reduce the risks of cross-border data transfer under GDPR and the European Health Data Space framework [8].

Technical approaches in this space are advancing quickly. Frameworks built on blockchain-verified access control can verify policy compliance without revealing user identities or credentials, with reported on-chain verification latency around 390 milliseconds in one evaluation [9]. Policy-as-code systems let institutions express sharing rules as machine-readable policies applied automatically to data movements, an approach demonstrated for geographically distributed cloud data and for secure data exchange across distributed computing infrastructure [10]. Related cryptographic work embeds compliance-checking policies directly into encrypted "data capsules" so that only authorized, compliant analysis programs can process the data.

Pros. Sensitive or legally constrained data can still contribute to research. Cross-institution and cross-border collaborations become possible where raw transfer would be prohibited.

Cons. Most individual researchers cannot build this themselves. Federated access depends on institutional infrastructure and governance agreements, and legal questions about authorization and privacy risk distribution remain active, as the ICUData4EU analysis itself notes [8]. For a typical lab, this option enters the picture when a collaborator institution or consortium provides it.

How to Choose: The Criteria That Decide Real Choices

Decision path that starts with data sensitivity and leads to open deposit, restricted deposit with an agreement, or request-based access.

When you weigh institutional data sharing policy compliance options, five criteria separate workable plans from aspirational ones.

Data sensitivity. Identify whether the data are identifiable, re-identifiable, licensed, or export-restricted before anything else. This single classification eliminates most options immediately.
Policy text, not policy rumor. Cite the exact requirement from the funder, the institution, and the journal. A survey of 40 major clinical trial sponsors found substantial heterogeneity in publicly available policies and agreements, so secondhand summaries are unreliable [2].
Where your field actually looks. Depositing into a repository nobody in your discipline searches satisfies the letter of a policy but not its purpose.
Support available to you. If your institution offers mediated curation, consultation, and templates, use them. The library-CTSI model at UVA and the in-house repository team at Washington University both exist because researchers asked for centralized, discipline-specific help [1], [4], [3].
Budget and timeline. Some funders allow data management and sharing costs in the budget. Only 38 percent of surveyed researchers felt confident budgeting for these activities, so ask your sponsored programs office early rather than discovering the gap at award stage [1].

A practical rule of thumb emerges from these criteria: open repository deposit when the data are non-sensitive and your funder permits it, restricted institutional deposit with a data use agreement for human or otherwise sensitive data, and federated or request-based access only when policy genuinely forbids broader release, with documentation of why.

Worked Scenarios

Scenario 1: An NIH-funded researcher with de-identified sequencing data. The DMS Plan names the institutional repository, lists the metadata standard, and requests budget support for curation. The dataset is deposited openly after the associated paper is accepted, receiving a DOI through the DataCite schema as the institutional workflow describes [4]. No DTUA is needed because the data are de-identified and no consent restrictions apply. This is the simplest path and the one to prefer whenever data classification allows it.

Scenario 2: A researcher with identifiable clinical imaging data. Open deposit is off the table. The researcher chooses restricted access in the institutional repository, obtains institutional review board approval for the sharing plan, and the repository routes future access requests through the Human Research Protection Office and a DTUA [4]. Access will be slower and less frequent, which the researcher documents in the DMS Plan as the appropriate trade-off for participant protection.

Scenario 3: An ecologist submitting to a journal that mandates data sharing at submission. The journal's policy requires the dataset link during peer review, which is consistent with the pattern seen across 275 ecology and evolution journals [5]. The researcher deposits data in a disciplinary repository early, well before writing the methods section, so the accession number exists at submission. The funder's policy is checked against the same deposit to confirm one deposit satisfies both layers.

Scenario 4: A pediatric genomics project deciding its governance policy. Genomic data from children raises ethical, legal, and social issues because children cannot consent for themselves. The Key Implications of Data Sharing (KIDS) framework, validated through a three-round policy Delphi with 12 Canadian clinician-scientists, genomic researchers, ethics board members, and pediatric ethicists, reached consensus on nine original statements plus one new statement covering institutional genomic data governance [11]. A project in this situation can adapt a validated framework like KIDS to write its own institutional guidance instead of starting from a blank page.

Scenario 5: A multi-country global health collaboration. Partners span jurisdictions with different privacy laws and different resources for secure storage. The RESPIRE collaboration, led from the University of Edinburgh and Universiti Malaya with partners in low- and middle-income countries, developed open science policy guidelines that standardize data sharing practices while ensuring compliance with each partner's privacy laws, aligning with the UNESCO open science recommendation [12]. The lesson is to write a shared policy guideline at the start of a collaboration rather than negotiating data handling case by case after the data exist.

A Step-by-Step Alignment Workflow

Flowchart of the alignment workflow: inventory policies, classify data, write the plan, choose a repository, then deposit and cite.

Inventory your policies. List every funder, institutional, and journal rule that applies to the project. Note deadlines for each, because journal-mandated deposits often come first [5].
Classify the data. Record sensitivity, identifiability, consent terms, and any contractual restrictions. Classification drives every later choice.
Write the plan with institutional help. Use your library or research office templates. Demand for tailored templates is high, with 87 percent of surveyed researchers at one center requesting discipline-specific templates and centralized consultation [1].
Choose the repository and access model using the comparison table above, and record the decision in the plan with a specific repository name.
Budget the work. Include curation time, repository fees if any, and agreement negotiation for restricted data [1].
Document as you collect. Capture metadata during the project, not at the end. Repositories with mediated curation workflows will ask for it, and late documentation is the most common cause of delayed deposits [4].
Deposit, curate, and publish the DOI. For restricted data, confirm the agreement process before publication so access requests do not stall [4].
Cite the dataset in the paper and update the DMS Plan status at reporting milestones.

Common Mistakes and Limitations

Treating "data available on request" as a plan. Actual fulfillment rates under this model are very low, about 4 percent in one social science study and 12 percent on average in the medical sciences, so a request-based promise is close to a promise of nothing unless you have the infrastructure to honor it [7].
Assuming your field has solved this already. Orthopaedic surgery, a heavily funded clinical field, saw data-sharing statements in only 14 percent of articles across ten leading journals from 2020 to 2023 [6]. Do not model your practice on field norms. Model it on the policy text.
Choosing a repository before classifying the data. This is the most common ordering error, and it produces deposits that must be moved or re-restricted later.
Ignoring code. Many policies now cover code alongside data, with roughly a quarter of surveyed ecology and evolution journals mandating code sharing [5]. A data plan that omits code can fail a journal check.
Underestimating the human effort. Sixty-eight percent of researchers at one academic medical center described executing a data management and sharing plan as burdensome, citing administrative overload and uncertainty with sensitive data [1]. Build the time into the grant, and route the work through institutional support offices rather than absorbing it alone.
Relying on one person's memory of policy. Sponsor-level policies vary widely even within the same sector, as documented across 40 major clinical trial sponsors [2]. Verify against the primary document.
A limitation of this guide. Institutional policies differ in their specifics, and human subjects determinations depend on your protocol, your consent language, and your institutional review board. Check the primary documents for your own institution and funders, and consult your library or research compliance office before finalizing any plan.

Frequently Asked Questions

What is institutional data sharing policy compliance?

It is the practice of making your research data storage, documentation, and access decisions conform to the requirements of your funder, your institution, and your journal. In practice it means writing an approved data management and sharing plan, depositing data in an appropriate repository with persistent identifiers and adequate metadata, and controlling access through documented agreements when the data are sensitive.

Which repository should I choose for NIH DMS compliance?

Choose a repository that accepts your data type, issues persistent identifiers such as DOIs, and enforces suitable metadata and access controls. A generalist institutional repository with mediated curation, like the one Washington University built for this purpose, works well for many biomedical datasets, while disciplinary repositories suit field-standard formats [4]. Match the repository to both the data classification and the funder's stated preferences.

What are the pros and cons of restricted versus open data sharing?

Open sharing maximizes reuse, visibility, and reproducibility and requires the least administration. Restricted sharing protects human subjects and satisfies consent limitations, but access requests move slowly because they require review and data use agreements. In one institutional repository, restricted datasets drew 13 access requests over their early period, with three granted through formal agreements, illustrating the trade-off between protection and reuse [4].

Do I have to share human subject data openly?

No. Funder and institutional policies allow restricted access with a documented justification and a data use agreement for human subjects data. What policies generally do not allow is promising data "on request" as a substitute for a real access mechanism without justification. Determine the appropriate access level with your institutional review board and research compliance office before submission.

What happens if I promise data on request and then decline?

Declining after promising damages trust, may violate funder or journal policy, and contributes to the reproducibility problem documented empirically. In one study, only 15 of 67 responding authors in the social sciences actually provided requested data, roughly a 4 percent fulfillment rate [7]. If you cannot deposit data, state the specific reason in your data-sharing statement rather than offering an open-ended promise.

How early in a project should I start aligning with data sharing policies?

Start before data collection begins. Policy layers from funders, institutions, and journals can conflict, journal deposits are often required at peer review, and curation takes longer than researchers expect. Researchers themselves report the highest uncertainty at the plan-writing, repository-selection, and budgeting stages, which is exactly the work that benefits from institutional consultation at the proposal stage [1].