Who Is Responsible for Multi-Institutional Data Sharing Policies?

By Dr. Zubair Khalid, DVM, MS, PhD · 2026-11-11

In a single-lab project, one principal investigator (PI) sets the data sharing policy and everyone in the lab follows it. In a multi-institutional project, that simplicity disappears. The one-sentence difference is this: when several institutions collaborate, no single person owns the whole data sharing policy, because the lead institution owns the funder-facing plan, each participating institution owns its own compliance obligations, and the individual researchers who generate the data own the day-to-day execution.

The rule of thumb for choosing who should hold responsibility is simple. Whoever administers the award writes the umbrella policy. Whoever generates a dataset executes the policy for that dataset. And whoever leads the network, formally or informally, monitors whether the policy is actually being followed. Most failed research data sharing arrangements trace back to a gap between these three layers, where everyone assumed someone else was holding the pen.

This article walks through the main responsibility models, compares them on the criteria that decide real choices, works through concrete scenarios, and lists the mix-ups that most commonly derail multi-institutional collaborations.

The Short Answer

Multi-institutional data sharing policy responsibility is shared across four layers, and each layer answers a different question.

1. The lead institution (the prime awardee or coordinating center) answers the question, "What do we promised the funder?" It writes the data management and sharing plan, signs the award terms, and is accountable to the sponsor when the grant ends.
2. Each participating institution answers, "What are our own obligations under our own rules?" Every university, hospital, or company in the collaboration has its own data governance policies, security requirements, and export control rules. A subaward does not erase them.
3. The collaboration itself (a steering committee, data governance committee, or consortium agreement) answers, "How do we coordinate across institutional lines?" This layer decides where data will be deposited, who can access what, and how credit is assigned.
4. Individual researchers and trainees answer, "What do I actually do with this dataset on Tuesday?" They collect, document, format, and deposit data, and they are the layer where policies succeed or fail in practice.

When people ask who is responsible, they usually want one name. The honest answer is that the lead PI is accountable upward to the funder, but accountability is not the same as execution. A lead PI cannot legally force a partner university to restructure its data systems. What a lead PI can do is make data responsibilities explicit in the subaward, the consortium agreement, and the data management plan, so that each institution's own obligations are visible before the first dataset is generated.

Why This Question Matters More Now

Large, distributed research networks have become a standard way of organizing science. Multi-university engineering research centers, multi-site clinical trials, and cross-disciplinary consortia pool expertise, instruments, and datasets in ways no single lab could match. But the structure that makes them productive also creates ethical and operational friction that single-lab research never encounters.

A qualitative case study of a large Engineering Research Center interviewed 26 members, including scientists, engineers, clinicians, and trainees, about the ethical and responsible conduct of research issues arising at the network level. The analysis surfaced five major themes, and data sharing was the first of them. Interviewees reported that differences across laboratories and differences across disciplines were persistent sources of challenge, and that network leadership had to anticipate, monitor, and address these issues to keep the collaboration functioning [1]. That finding is the core of the answer to the responsibility question. Network-level leadership, meaning the people who set norms and policy for the network as a whole, cannot delegate the anticipation of data sharing problems to anyone else, because no one else has a view of the whole network.

The structural problem is not new. Analyses of other multi-institutional policy domains, such as national population policy programs, reached a parallel conclusion decades ago. Formulating and applying policy across institutions is a complex interdisciplinary and multi-institutional task that requires a deliberate organizational structure, typically including a dedicated coordinating unit, an information and communication unit, and research and data processing centers. The same analyses also documented the recurring weakness of such structures, namely that the coordinating units are often given limited authority and inadequate financial and administrative support. Translated into a research setting, this is the classic failure mode of a data governance committee that meets regularly, produces recommendations, and holds no budget and no enforcement power.

So the responsibility question has two parts. First, which structure should hold the pen? Second, does that structure have enough authority and resources to do anything? A policy without either is decoration.

Options for Multi-Institutional Data Sharing Policy Responsibility

There are five recognizable models for assigning responsibility. None is universally best. The right choice depends on the size of the collaboration, the sensitivity of the data, the discipline, and the funder's requirements.

The Five Models at a Glance

Model 1: Centralized Responsibility at the Lead Institution

In the centralized model, the lead institution's PI writes a single data management and sharing plan that covers the whole project. Subawardees are referenced in the plan, and their obligations are written into their subaward agreements. This is the default model for most grants with a prime awardee and subawards, and it is the model that most funders implicitly expect.

Its strength is clarity. There is one plan, one repository list, one metadata standard, one set of timelines. When the funder asks a question, there is one person to ask. Its weakness is the authority gap described above. The lead PI can write whatever the plan says, but the plan binds partner institutions only through the subaward, and subaward language is negotiated by sponsored programs offices, not scientists. If the subaward is silent on data, the lead PI's policy is a request, not a rule. The ERC interview study captures this dynamic indirectly. Interviewees reported that network leadership, norms, and policy were a distinct theme of ethical concern, and that anticipating and addressing cross-laboratory differences was a leadership responsibility, not something that emerged spontaneously from individual labs [1].

Centralization works best when the lead institution actually invests in the coordinating function, with real staff time and a real budget line, rather than treating data coordination as an unfunded afterthought.

Model 2: Committee-Based Data Governance

In the committee model, the collaboration creates a data governance committee, often a subgroup of an existing steering committee, with one representative from each participating institution. The committee writes the project's data sharing policy, approves repository choices, sets access rules, and adjudicates disputes.

This model directly answers the two structural requirements identified in multi-institutional policy research. It provides the dedicated coordinating structure that complex multi-institutional tasks require, and, if funded, it provides the information and communication function that keeps partners aligned [2]. Its great advantage in scientific networks is that it can absorb disciplinary differences. A committee with a clinical researcher, a field ecologist, and a computational scientist at the table will anticipate disagreements about metadata and timelines that a single-PI policy would paper over. The ERC study found that data sharing and cross-disciplinary norm conflicts were among the most persistent ethical challenges in a large network, which is exactly the kind of problem a representative committee is built to surface early [1].

The cons are speed and authority. Committees are slow, and many are constituted without any budget or enforcement mechanism, repeating the pattern of under-resourced coordinating units documented in other multi-institutional policy domains. If you adopt this model, give the committee three things at founding: a charter that says what its decisions bind, a small budget for curation and coordination work, and a standing agenda item for reporting noncompliance.

Model 3: Contract-Based Responsibility

In the contract model, responsibility is fixed in signed documents before any data moves. The most common instruments are consortium agreements, data use agreements (DUAs), and material transfer agreements extended to cover data. Legal counsel at each institution negotiates terms covering ownership, permitted uses, security safeguards, publication timing, and deposit obligations.

This model has the strongest enforcement of any option, because breach of contract has institutional consequences. It also handles questions scientists are poorly positioned to negotiate, such as liability for data breaches and intellectual property ownership. Its cons are the mirror image. Negotiation is slow, sometimes taking months. The resulting documents are written by lawyers, in language scientists do not read closely, and they usually say nothing about the questions that actually cause day-to-day conflict, such as which metadata standard to use or who curates a shared database. Contracts also age poorly when the project scope changes.

The practical pattern in well-run collaborations is hybrid. Contracts fix the legal skeleton, ownership, liability, and the obligation to comply with the funder's data policy. A committee or lead PI fills in the technical and cultural details.

Model 4: Funder-Driven Compliance

Every major US funder now has a data policy. The National Institutes of Health implemented its Data Management and Sharing Policy in January 2023, requiring most extramural awards to include an approved Data Management and Sharing Plan and to deposit the underlying data in a repository at the end of the project. The National Science Foundation has long required data management plans in most proposals. These policies establish a uniform floor: every institution in a collaboration, regardless of its own internal rules, must satisfy the terms of the award.

The pro is external accountability. When a partner institution drags its feet, the lead PI can point to a funder requirement rather than to a personal preference, which changes the conversation entirely. The con is that funder policies are deliberately generic. They specify what must be shared and roughly when, but they cannot specify who on a five-campus project formats the imaging data, or how two labs reconcile conflicting labeling conventions. Funder-driven compliance is best understood as the floor every other model builds on, never as the complete answer.

Model 5: Repository-Anchored Stewardship

The fifth model assigns responsibility to the destination. When the collaboration selects repositories early and writes them into the data management plan, the repository's own policies, deposit agreements, curation standards, and access controls take over a large share of the responsibility burden. This model works because a deposit is a checkable event. Either the dataset exists in the repository with a persistent identifier, or it does not.

The cons are that repositories differ widely, and that repository policies govern only the public release stage, not the months of internal sharing during data collection and analysis. A repository-anchored model therefore complements, rather than replaces, the other four.

A Data Repository Comparison for Planning Responsibility

Choosing where data will live is itself a responsibility decision, and it should be made at the proposal stage, not at the end of the grant. The FAIR principles, meaning data that are Findable, Accessible, Interoperable, and Reusable, provide the standard evaluation framework, and the practical choice usually reduces to three options.

Community-recognized disciplinary repositories are the default where they exist. Examples include GenBank for nucleic acid sequences, the Sequence Read Archive for high-throughput sequencing data, and dbGaP for genotype-phenotype datasets that require controlled access for human subjects data. These repositories impose community metadata standards, guarantee long-term maintenance, and are the destinations funders and journals expect for their data types. Depositing here minimizes the responsibility your collaboration must shoulder, because the repository absorbs curation and preservation duties.

Generalist repositories such as Zenodo, Dryad, and the ICPSR data archive for social science accept any data type. They are the right choice when no disciplinary repository covers your data, and they issue persistent identifiers (DOIs) that make datasets citable. The tradeoff is that generalist repositories enforce fewer domain-specific standards, so your collaboration bears more responsibility for documentation quality.

Institutional repositories run by a university library are a third option, often useful for data products that do not fit elsewhere or for institutional compliance needs. Their long-term commitment and reuse infrastructure vary by institution, so verify preservation guarantees before committing a shared dataset to one.

For a multi-institutional project, the repository comparison should be done once, jointly, and written into the data management plan, with a named person at each site responsible for deposits from that site. The single most common timing error in research data sharing is postponing this decision until the final year of the grant, when the data are already heterogeneous and the responsible personnel are dispersing.

Comparing the Options on the Criteria That Decide Real Choices

Five criteria separate the models when the stakes are real.

Enforceability. Contracts win, committees with charters come second, centralized policies bind only as far as the subaward language carries them, and unfunded committees bind no one. If enforceability is your top concern, because the data are sensitive or a partner has already been unreliable, lead with a contract.

Speed. Centralized models decide fastest. Committees and contract negotiations are slow. If you need a decision this month, for example a repository choice for a submission deadline, route it through the lead PI and ratify it later through the formal structure.

Handling disciplinary and cross-lab differences. Committee models win here, clearly. The ERC interview evidence showed that cross-laboratory and cross-disciplinary differences are the sources of challenge that surprise networks most often, and a representative body is the only structure designed to surface them before they become disputes [1].

Trainee oversight. Trainees generate much of the data in collaborative science, and they move between institutions with different norms. A distributed team where each lab applies its own informal data practices produces datasets that no one can integrate later. Whichever model you adopt, write down the documentation standards so that a first-year graduate student on any campus produces compatible files.

Administrative burden. Contracts impose the highest upfront burden and the lowest ongoing burden. Committees spread the burden but require sustained facilitation. Centralized models concentrate the burden on the lead institution, which is fair only if the lead institution has the staff to carry it. Under-resourcing the coordinating function is the documented historical failure pattern for multi-institutional policy structures of every kind.

Worked Scenarios

Scenario 1: A Five-University Engineering Research Center

An ERC-style center links five universities, three disciplinary cultures, and dozens of labs sharing instruments, simulation code, and experimental datasets. The interview evidence from such a center showed that data sharing, credit, and network norms were the dominant ethical themes, and that members expected network leadership to actively manage them [1].

Best-fit responsibility model: a hybrid. The lead institution writes the funder-facing data management and sharing plan. A data governance committee with representatives from each campus writes the operational policy, meaning file formats, metadata, the shared data platform, and access tiers. Subaward language at each campus incorporates the committee's policy by reference. The center director, not each lab PI, is accountable to the funder for the network's overall compliance.

The critical failure to avoid is letting the committee become advisory only. Assign it a budget line for a data coordinator, and require each campus to report deposit status annually.

Scenario 2: A Multi-Site Clinical Study

Six hospitals enroll patients into a shared study. The data include protected health information, so public repositories are not an option and controlled-access arrangements are mandatory. Here the contract model dominates. A data use agreement among all six sites, plus business associate agreements where required, fixes ownership, security, permissible uses, and the controlled-access repository (such as dbGaP for genotype-phenotype data) before enrollment begins. The lead institution's IRB and privacy board coordinate, but each site's own human subjects protections still apply to its own participants. Responsibility for de-identification and quality control sits with each site, because only the site generating the data can perform those steps defensibly.

The lesson from this scenario generalizes: the more regulated the data, the earlier the contracts must be signed and the smaller the role of informal committee consensus.

Scenario 3: Two Labs, One Collaborative Grant

Two labs at different universities share one R01-style grant, one lab doing the experiments and the other the computational analysis. A five-member committee would be absurd, and a lengthy consortium agreement is overkill. The right model is centralized with two explicit documents. The contact PI writes a one-page data sharing addendum, covering file formats, a named repository for the final datasets, a timeline aligned with the funder's policy, and an agreement on co-authorship and data reuse expectations. Both institutions' sponsored programs offices record those terms in the subaward. Responsibility for deposit is split by data origin, with each lab depositing the datasets it generated, under metadata standards agreed in the addendum.

This scenario is where most collaborations actually live, and it shows the scalable core of every model, write the few decisions that matter into a short document, and assign each dataset to the person who made it.

Common Mistakes and Limitations

• Assuming the lead institution's policy automatically binds everyone. It binds only through the subaward and the consortium agreement. If those documents are silent on data, partner institutions have no enforceable obligation, however detailed the data management plan is.
• Treating the data management plan as the policy. The plan is a promise to the funder. The policy is the internal set of rules that makes the promise achievable. Multi-institutional projects need both, and they are different documents.
• Ignoring disciplinary and cross-lab norm differences until they become disputes. The ERC study found that these differences were a defining challenge of network-level research, spanning data sharing, authorship, and collaboration practices [1]. Raising them in the first six months costs a meeting. Raising them in year four costs a partnership.
• Conflating data responsibility with credit. Authorship and inventorship disputes were a separate major theme in the network ethics study [1], and they poison data sharing when left implicit. Decide authorship criteria and data citation practices in writing at project start, as part of the same governance discussion.
• Postponing the repository decision. Selecting repositories at the proposal stage, based on a genuine data repository comparison, is cheap. Selecting them in the final year, after five labs have produced five incompatible file formats, is expensive and sometimes impossible.
• Creating a committee without authority or resources. Coordinating units across institutions historically struggle when their authority and administrative support are limited. If you charter a data governance body, fund it and define what its decisions bind.
• Assuming one deposit satisfies every obligation. Depositing data in a repository meets the funder's sharing requirement, but it does not resolve ongoing access restrictions, retention schedules under institutional policy, or the terms of a data use agreement. Check each layer separately.

A general limitation applies throughout. Institutional policies, funder terms, and contract language differ from one collaboration to the next, so the specifics of your situation should be confirmed with your institution's sponsored programs or research data office before you commit to a responsibility model in a proposal.

Frequently Asked Questions

Does the lead institution's data sharing policy automatically apply to subawardees?

No. It applies to subawardees only to the extent that the subaward or consortium agreement incorporates it. Make the incorporation explicit in the subaward language, because a data management plan by itself does not create contractual obligations for a partner institution.

Who is responsible if a partner institution fails to deposit its data?

The site that generated the dataset is responsible for depositing it, and the lead institution is accountable to the funder for the project's overall compliance. The lead PI's practical remedy is to assign per-site deposit responsibilities in writing at the start and to track them during annual reporting.

Can data sharing responsibility be delegated to a hired data manager?

Execution can be delegated, accountability cannot. A data coordinator can run the repository workflow, train staff, and check metadata, but the funder-facing accountability remains with the PI and the lead institution, and each partner institution retains its own compliance duties.

What happens to shared data when the grant ends?

The funder's data policy sets the deadline for deposit and the expected retention period, and the data management plan names the repositories. The responsibility model you chose should already assign a named person at each site for end-of-project deposits, because personnel scatter quickly once funding ends.

Do all co-authors have to agree on the repository choice?

They should be consulted, and the decision itself belongs to the governance structure, whether that is the lead PI or a data governance committee. Agreeing on the repository early prevents the late-stage conflicts over data credit and access that commonly accompany authorship disputes in large networks.

Who owns data produced jointly by several institutions?

Ownership is determined by the agreements in force, chiefly the consortium agreement or data use agreement, not by informal expectation. Research data are typically treated as property of the institution whose resources and personnel produced them, with access and use rights allocated by contract, which is why the contract-based elements of your responsibility model matter even in friendly collaborations.

Sources

1. Perceptions of network-level ethics in an engineering research center: Analysis of ethical issues & practices reported by scientific & engineering participants.
2. [[Population policies: complex responsibilities].](https://pubmed.ncbi.nlm.nih.gov/12342899/)