How to Share Sensitive Data in a Generalist Repository

By Dr. Zubair Khalid, DVM, MS, PhD · 2026-11-11

A generalist repository accepts data from any discipline, while a domain repository is purpose-built for one data type, such as genome sequences in a sequence archive or brain imaging in a neuroimaging archive. The working rule for sensitive data is simple: publish the metadata openly so your study stays discoverable, and match file access to how identifiable the data are. Open deposit suits genuinely deidentified data, controlled or tiered access suits anything that could point back to a participant, and federated hosting suits files that should never leave your institution.

This guide explains the main options for sharing sensitive data in a generalist repository, compares them side by side, and walks through a deposit workflow you can adapt to your own project. The stakes are practical rather than abstract. Research data sharing has moved from a courtesy to a funder expectation, and the NIH Data Management and Sharing Policy, in effect since January 25, 2023, expects NIH-funded data to be shared while permitting restricted-access release for data that cannot go out openly [1]. Investigator attitudes point the same way. In a survey of 397 principal investigators holding NIH human-subjects grants in the neurosciences, 84 percent supported efforts to increase sharing of deidentified individual-level data, although the same investigators named cost, time, loss of interpretive context, and missing standards as the largest barriers [2].

What Makes Data Sensitive in a Generalist Repository

Sensitive data are any data that could identify a person directly or through combination with other information, or that could cause harm, stigma, or legal exposure if disclosed. Direct identifiers include names, medical record numbers, email addresses, and full home addresses. Quasi-identifiers are details that look harmless alone but identify someone in combination, such as ZIP code, exact birth date, sex, occupation, and rare diagnoses. Combinations of just a few quasi-identifiers are enough to single out many individuals, a result long established in the record-linkage literature.

Sensitive categories also include health conditions, genetic information, sexual behavior, substance use, immigration status, and precise location. Qualitative material counts too. Interview quotes, field notes, and even the fact that someone participated in a study about a stigmatized topic can identify a person in a small community.

Two realities make careful planning necessary before any deposit:

Re-identification tools keep improving. Ethical and regulatory analysis of neuroimaging data sharing finds that rapid advances in artificial intelligence and machine learning have heightened privacy risks, while regulation has not kept pace with the technical threats [4].
Anonymization is not a binary state. Research on mobile phone signaling data shows that records stripped of personal information still carry space-time traces that can reveal a person's home, workplace, and routines, which makes simple anonymity rules insufficient for location data [5].

There is also an ethics gap around secondary data. Analyses of big data research note that uses of public datasets often fall outside human-subjects regulation even though the potential harms to the people described in those datasets are real [6]. A repository's terms of service are not a substitute for your own risk judgment.

Your Options for Sharing Sensitive Data in a Generalist Repository

Generalist repositories such as Zenodo, Dryad, figshare, and OSF accept data across disciplines, and their privacy tooling differs. Treat the five options below as a menu, and confirm which ones your target repository supports before you promise anything in a grant application or consent form.

Option 1: De-identify and Deposit Openly

De-identification removes or transforms direct identifiers and manages quasi-identifiers so that re-identification becomes unlikely. Open deposit then makes the files public under a license with a persistent identifier.

Work on a spectrum rather than a checklist. Guidance developed with the Qualitative Data Repository describes a range of choices from light-touch de-identification to full access controls, and it names the core tradeoff directly: every edit that protects a participant also erodes some analytic value [3]. A transcript with every place name and employer removed is safer but harder to interpret.

Open deposit fits when consent covers public sharing, the topic is not stigmatizing, and the remaining quasi-identifiers are coarse. It fits poorly for small samples, rare conditions, spatiotemporal data, and anything a motivated reader could link to public registries or commercial datasets.

Option 2: Deposit Under Controlled Access

Controlled access means the repository or a linked system holds the files and releases them only to requesters who meet defined conditions, usually identity verification plus a signed agreement. The biomedical model for this is mature. Researchers are vetted along with their hypotheses, explicit legal agreements are signed with consequences for misuse, institutions provide training, and each project passes a formal approval process.

In genomics and health research, this model runs through Data Access Committees (DACs), which manage Data Access Agreements (DAAs). A review of that landscape found that excessive variation across agreements hinders consistent data protection and proposed a core set of clauses that future agreements could share [7]. Harmonization helps you as a depositor because a clear, standard agreement lowers the burden on every approved user downstream.

On the platform side, the Datatags system developed for the Dataverse generalist repository lets depositors label datasets with sensitivity tags and aligns access with those tags, so a single archive can host open, restricted, and heavily restricted files under one roof [8].

Controlled access fits identifiable data, stigmatizing topics, and genetic data. Its costs are slower reuse and the ongoing committee work of reviewing requests.

Option 3: Use Tiered Access

Tiered access splits a dataset into a public tier and a protected tier. Metadata, documentation, and non-sensitive files go out openly, while sensitive files sit behind terms that qualified users must accept.

The Human Connectome Project's ConnectomeDB shows the design in practice. Imaging data and much of the behavioral data are publicly available subject to accepted data use terms, while some sensitive behavioral measures are restricted to qualified investigators under a more stringent set of terms [9]. A generalist repository can host the public tier while the restricted tier lives in the same system or in a linked institutional service.

Tiered access fits mixed datasets, for example imaging plus sensitive behavioral measures, or surveys where aggregate tables can be open but record-level microdata cannot.

Option 4: Host Federated and Publish a Discovery Record

Federated sharing keeps the files at your institution and exposes only a discovery record, so users find the dataset in a catalog and then request access from the holding node. Work driven by the EU General Data Protection Regulation (GDPR) documents the shift from centralized archives to federated models, in which a central node supports data discovery while distributed nodes handle access requests, conclude agreements with users, and provide secure access to the data [10]. The open-source DS-PACK middleware semi-automates that end-to-end flow and is in production use at the ELIXIR Luxembourg data hosting platform [10].

For a single lab, the lightweight version is to deposit a metadata record and data dictionary in a generalist repository, state that access requests go through your institution, and name a contact point. The data never move, which is the strongest privacy posture available, at the price of more work for you and for every approved user.

Option 5: Transform the Data Statistically

Statistical protection alters the data themselves so that release leaks less. Options include publishing aggregates instead of record-level data, coarsening values, and differential privacy, which adds calibrated noise so that published results barely change whether or not any one person is in the dataset. Local differential privacy applies the perturbation at the individual level before data ever reach the collector.

Communication matters as much as the mathematics. In four online experiments set in a health app data collection scenario, participants who read plain descriptions of what differential privacy meant for them showed better comprehension of the techniques, and they judged local differential privacy, the stronger guarantee, more favorably than centralized differential privacy. If you use these techniques, explain them in the deposit's readme in exactly those plain terms.

Side-by-Side Comparison of the Options

A useful data repository comparison for sensitive data comes down to four criteria: how well the model protects participants, how much analytic value survives, how much ongoing work it creates, and whether it matches your consent language.

Option	How it works	Privacy protection	Analytic value retained	Ongoing workload	Best fit
Open deposit after de-identification	Remove identifiers, manage quasi-identifiers, publish openly	Moderate, depends entirely on your de-identification pass	High for numeric data, lower if heavily redacted	Low after deposit	Low-risk deidentified data with permissive consent
Controlled access deposit	Repository holds files, vets requesters, requires a signed agreement	High, access is gated person by person	High, files stay intact	Request review and agreement handling	Identifiable or re-identifiable data with consent for controlled sharing
Tiered access	Public metadata and non-sensitive files, sensitive files restricted	High for the restricted tier	High	Maintaining two tiers and clear tagging	Mixed datasets, such as imaging plus sensitive behavioral measures
Federated or institutional hosting	Files stay at your institution, generalist record points to them	Highest, data never move	High for approved users	Running a local access service	Legal constraints on transfer or very large files
Statistical protection	Aggregate, coarsen, or noise-add before deposit	High if tuned correctly	Reduced, especially for record-level analysis	Statistical expertise	Location, mobile sensing, or any high-linkage data

Two patterns stand out. First, privacy protection and convenience trade off in a predictable direction, so the best approach to sharing sensitive data in a generalist repository is the least restrictive option that still honors your consent language and keeps re-identification risk acceptably low. Second, documentation quality matters in every row. A deidentified open dataset with a thorough codebook often serves reuse better than a poorly documented controlled-access archive.

How to Share Sensitive Data in a Generalist Repository, Step by Step

Recheck consent and IRB conditions. Read what participants actually agreed to and what your IRB approval allows. Guidance on data management plans and IRBs recommends treating the plan and the protocol as one package, so the protections promised in the plan match the protections the protocol enforces [11]. If consent is silent on sharing, you usually need either a new consent or a restricted model.

Build a sensitivity profile. List direct identifiers, quasi-identifiers, sample size, topic sensitivity, and linkage risk against public and commercial datasets. Flag file-level metadata too, such as device identifiers in imaging headers or timestamps in GPS logs.

Match the access model to the risk. Use the comparison table above. When two options both fit, choose the less restrictive one and strengthen documentation instead.

Prepare the files. Apply the de-identification pass to a copy, keep an unmodified master in a secure location, and record every transformation in a readme. For qualitative material, decide element by element whether to redact, generalize, or withhold, and document the rule you applied.

Draft the access terms. For restricted tiers, write a short agreement covering who may use the data, permitted purposes, security duties, a ban on re-identification attempts and unauthorized redistribution, and end-of-project disposal. Borrow structure from harmonized DAA clause sets rather than drafting from scratch [7]. Because data cross borders, align your terms with emerging international governance principles, which scholars have argued should rest on a human rights framework pairing the right to share in scientific progress with the right to protection of persons [12].

Deposit with complete documentation. Include study design, instruments, variable codebooks, collection dates at the precision you can disclose, and processing steps. Curation programs for sensitive archives show the payoff of this investment. The National Addiction and HIV Data Archive Program has curated highly sensitive addiction and HIV data since 2009, maintaining curation standards that make datasets usable and providing technical assistance for both depositors and users [1].

Run the access process. Decide who reviews requests, how quickly you will respond, and how approvals are logged. If your institution cannot sustain this, prefer a repository-native controlled access option or a federated arrangement with tooling such as DS-PACK that automates agreements and access enforcement [10].

Pros and Cons of Generalist Repositories for Sensitive Data

Strengths

Discoverability. One persistent identifier and rich metadata make your dataset citable and findable alongside the literature.
Funder alignment. A documented deposit, open or restricted, satisfies the sharing expectations of policies such as the NIH Data Management and Sharing Policy [1].
No bespoke portal. You avoid building and maintaining your own access system, which is exactly the burden federated middleware like DS-PACK was designed to reduce [10].
Curation support. Some repositories and archive programs improve submitted datasets and help users, which raises reuse quality [1].

Drawbacks

Variable access tooling. Not every generalist repository supports controlled access, so verify the mechanism before you commit.
The risk judgment stays with you. The repository stores and distributes files, but assessing re-identification risk and vetting requesters usually remain the depositor's job.
Less domain-specific review. A field-specific archive is built around the sensitivities of its discipline, while generalist staff may not recognize why a particular measure is sensitive.
Reuse friction. Every access gate slows secondary analysis, which is a real cost when the goal is to maximize the scientific value of the data.

Worked Scenarios

Scenario 1: Qualitative Interview Study

You ran 30 interviews about caregiving for a stigmatized condition. Full transcripts are identifying because participants recount neighborhoods, employers, and family details. A workable split is to deposit study metadata, instruments, and a codebook openly, prepare deidentified excerpt files for open or restricted release using a documented redaction rule, and keep full transcripts in controlled access or off the repository entirely. Because the fact of participation may itself be sensitive, check whether even a participant-facing description in the codebook is safe to publish.

Scenario 2: Neuroimaging With Sensitive Behavioral Measures

Your study pairs MRI sessions with questionnaires on substance use. Follow the tiered pattern proven by ConnectomeDB: release imaging data and non-sensitive measures publicly under accepted data use terms, and restrict the sensitive behavioral files to qualified investigators [9]. Because automated tools can raise re-identification risk for imaging data, bar re-identification attempts explicitly in the data use terms [4].

Scenario 3: Location and Mobile Sensing Data

You collected GPS traces and app-usage logs. Treat the raw traces as re-identifiable even after identifier removal. Prefer one of two routes: publish only aggregates or differentially private summaries, or keep raw traces in an institutional enclave and publish a discovery record that routes requests to you. If you use differential privacy, describe it in plain language in the readme so future users understand what the noise means for their analyses.

Common Mistakes and Limitations

Treating name removal as de-identification. Quasi-identifiers and free-text fields carry most of the re-identification risk.
Assuming the repository will assess privacy for you. Generalist repositories store and distribute, but the risk judgment belongs to the depositor.
Depositing without checking consent scope. Consent that is silent on sharing usually blocks open release.
Publishing quotes or transcripts openly. Verbatim text is one of the hardest formats to de-identify.
Scrubbing until the data are useless. Over-redaction destroys the collection context that secondary analysts need, which is itself a documented barrier to reuse [2].
Ignoring file metadata. Headers, timestamps, and device identifiers can leak identifiers after the visible content is clean.
Treating the deposit as one-and-done. Plan for who will answer access requests after the grant ends, or choose a repository-native access system that outlives your project.

One limitation applies to everything above. This guide describes general practice, not legal advice, and individual projects need review by your IRB, institutional counsel, and the repository's own policies before any sensitive files move.

Frequently Asked Questions

Can human subjects data go into a generalist repository at all?

Yes, provided consent and applicable law allow it and you match the access model to the identifiability of the files, from open deposit for deidentified data to controlled access for anything that could identify a participant.

What is the difference between deidentified and anonymized data?

Deidentified data have direct identifiers removed but may still be re-identifiable through combinations of remaining details, while anonymized data have been transformed so that re-identification is not reasonably possible, a much higher and harder-to-verify standard.

Do generalist repositories support controlled access?

Some do, either natively or through linked institutional systems, but support varies widely, so confirm how a repository handles permissions, agreements, and request vetting before you deposit.

What belongs in a data access agreement?

At minimum, who may use the data, for which purposes, what security safeguards apply, a prohibition on re-identification attempts and unauthorized redistribution, and terms for returning or destroying the data at the end of the project.

How do I decide whether my deidentified data are safe for open deposit?

List every remaining quasi-identifier, consider who else could link the files to public or commercial datasets, and if you cannot rule out plausible re-identification, choose controlled access instead.

Does funder policy allow restricted-access sharing?

Yes. Restricted or controlled access is an accepted sharing method for data that cannot be released openly, as long as your data management plan describes the protections and the access process.