# How to Create a Data Impact Report for Your CV or Promotion Package By the end of this article you will be able to build a one- to two-page data impact report that documents what happened to the research data you produced, shared, or curated. The report answers three questions a promotion committee or hiring panel actually cares about: where the data lives, who reused it, and what came out of that reuse. You will walk through a complete workflow, from inventorying your datasets to pulling citation and download metrics with a short Python script, and you will finish with a reusable template. What you need on hand before you start: - A list of the datasets you have published or deposited, with their [persistent identifiers](/knowledge/bioinformatics/persistent-identifiers-in-bioinformatics-selection-criteria-and-implementation-workflow) (DOIs or accession numbers) - Access to a web browser and, optionally, Python 3.8 or later with the `requests` library installed (`pip install requests`) - Your CV, dossier, or promotion package in the format your institution requires - Publication records for any papers that reused your data, gathered from Web of Science, Scopus, or Google Scholar No special software is mandatory. The script in the walkthrough simply saves you manual counting, and every step has a manual fallback. ## What a Data Impact Report Is and Why Committees Ask for One A data impact report is a structured, verifiable account of the downstream use of your research data. It sits between a plain data availability statement and a full narrative portfolio. A data availability statement says where data lives. A data impact report documents what the community did with it. Promotion and hiring committees increasingly ask about data outputs because funder and journal policies now require data sharing as a condition of publication. The National Institutes of Health [Data Management](/blog/guides/data-management-basics-principles-processes-and-best-practices) and Sharing (DMS) policy, for example, requires researchers submitting head imaging data to address privacy controls such as facial anonymization and whether datasets are placed under open or controlled access [1]. If you have shared data under such policies, the impact report is where you demonstrate that the obligation produced scholarly value, not just compliance paperwork. The report also protects you from a common scoring problem. Data sharing effort is invisible when the only CV line reads "Deposited dataset in repository X." A structured report converts that line into evidence: datasets released, reuse events, citing publications, downstream findings, and infrastructure contributions. ## The Evidence That Data Reuse Counts as Scholarship Before you write the report, anchor your expectations in what the literature shows data reuse actually produces. The strongest available evidence comes from a cross-sectional study of the Yale University Open Data Access (YODA) Project, which manages individual participant level data (IPD, meaning deidentified record-level data from each participant in a trial) from Johnson & Johnson sponsored clinical trials. Among 336 eligible trials with IPD available for external sharing, 265 trials, or 79%, had at least one associated secondary publication, and those trials generated 1,167 secondary publications in total. Of these, 209 publications, or 17.9%, were external, meaning no original trial investigator was an author. When external publications reported a data access mechanism, 85% obtained the data through data sharing platforms, primarily the YODA Project itself. The study measured scholarly impact using journal impact factor, annual citation count, and annual Altmetric Attention Score [2]. Two lessons follow for your report. First, reuse is common and documentable. Second, the method the study used, namely citation searches of primary publications in Web of Science traced forward through June 2025, is a defensible, repeatable method you can copy at individual scale. Reuse also extends beyond clinical trials. A Tanzanian genomic surveillance study of Plasmodium falciparum, the parasite that causes the most severe form of malaria, sequenced 7,199 positive samples out of 12,875 collected as dried blood spots across 100 health facilities and used the resulting dataset to compute genetic metrics such as complexity of infection, the average number of parasite strains co-infecting a host, which came out at 1.5 countrywide [3]. Datasets like this become inputs for other groups studying parasite connectivity and transmission intensity, which is exactly the kind of downstream use your report should capture. Data-centered work also produces operational impact you can report. A quality improvement study in an emergency medicine residency shared individualized throughput metrics with ten residents over three months, after which 70% rated the metrics as somewhat useful or better and half reported making changes to their clinical practice [4]. In a health system setting, centralizing cardiovascular registry abstraction across 5 facilities, 8 registries, and 11.5 full-time equivalents reduced abstraction time and improved data quality, and those gains are themselves reportable outcomes [5]. If your contribution was infrastructure or data operations rather than a deposited dataset, the same report structure applies with operational metrics in place of citations. ## Choosing What to Report From: A Data Repository Comparison Your impact evidence depends on where the data sits, because repositories differ in what they track and expose. The table below summarizes the main options. | Repository type | Typical examples | Access model | Metrics you can usually report | Best suited for | |--|--|--|--|--| | Generalist repository | Zenodo, Figshare, institutional repositories | Open by default, some embargoed | Downloads, views, citations via DataCite, version history | Code, small datasets, negative results, datasets without a domain home | | Domain-specific repository | Sequence Read Archive, dbGaP, Immunology Database and Analysis Portal, subject archives | Open or controlled access | Accession requests, approved project counts, citing publications | Large, standardized domain data with community curation | | Controlled-access platform | Institutional data enclaves, sponsor platforms such as the YODA Project | Data use agreements, review committees | Number of approved requests, external secondary publications, data access mechanism | Human subjects data, IPD from trials, sensitive records | | Federated or in-place access | Secure multi-party computation setups, federated analysis networks | Data stays local, queries or models move | Number of participating sites, federated model performance, privacy guarantees | Data that cannot legally or ethically be centralized | The controlled-access row deserves attention. In the YODA analysis, most external secondary publications that reported an access mechanism obtained data through platforms rather than informal requests, which means platform-mediated sharing concentrates and reveals reuse in a way that ad hoc email-based sharing does not [2]. If you are deciding where to deposit data you expect to be reused, that visibility is a genuine factor in the data repository comparison, alongside curation quality and domain fit. Privacy engineering changes the comparison too. One methodological case study of k-anonymity, a privacy model requiring that every combination of quasi-identifiers (indirect identifiers such as age, sex, and postal code) appear in at least k records, analyzed 719,387 inpatient encounters from University Hospital Mannheim covering 2010 to 2024. The researchers anonymized the data at k values of 5, 10, and 15 using the ARX tool and found that record suppression and microaggregation introduced distributional and inferential distortions that the anonymization tool's internal information-loss values did not flag [6]. In imaging, a separate evaluation tested three facial defacing algorithms on MRI and CT data from 600 subjects across three institutions and quantified the effect on downstream AI tasks such as brain segmentation, motivated in part by recent NIH DMS policy updates on controlled-access head imaging [1]. When you write your report, these tradeoffs are not weaknesses to hide. Documenting that you chose a privacy mechanism, understood its analytical footprint, and validated that key findings remained reproducible is a substantive scholarly contribution. ## The Data Impact Report Format Use a consistent format across all your datasets so the report reads as one document with repeated blocks. The format below has eight sections and fits on one to two pages per dataset, or one page total for a portfolio summary. ### Section 1: Header and Summary One paragraph. Dataset title, persistent identifier, repository, release date, access model, and a two-sentence statement of reuse to date. Committees read this paragraph and stop here if they are skimming. ### Section 2: Dataset Description What the data contains, how it was generated, sample or record counts, and any version history. State the version you are reporting on. If the data underlies a primary publication, cite it. ### Section 3: Availability and Access Statement Where the data lives, how access is obtained, and any governance constraints. For commercial or routinely collected data such as supermarket transaction records, a governance paragraph is expected, because such data requires secure data environments, transparent processes, and formal industry-academic partnership before analysis [7]. Name the approval route explicitly. ### Section 4: Access and Usage Metrics Downloads, views, unique users, or approved data access requests, with the date you pulled them and the source of the numbers. Always date the snapshot. A download count without a date is unverifiable within a month. ### Section 5: Secondary Publications and Citations Publications that used your data, split into internal (any author is an original data producer) and external (no overlap). This split mirrors the classification used in the YODA portfolio study, where 1,167 secondary publications were traced and 209, or 17.9%, were external [2]. For each entry give the citation, a one-line statement of what the secondary study asked, and whether it was a reanalysis, replication, or new method development. ### Section 6: Reuse Cases Beyond Publications Policy inputs, guidelines, theses, teaching materials, software, and reproductions. Not all impact is citable, but all of it is describable. ### Section 7: Privacy, Utility, and Governance Notes What protection mechanisms you applied, what you know about their analytical cost, and how you verified utility. This is where the k-anonymity and defacing literature becomes your evidence base rather than your burden [6]. ### Section 8: Narrative Statement Three to five sentences in your own voice connecting the data work to your research program. This is the part reviewers quote when they write their assessment. ## Step-by-Step Walkthrough With Worked Examples ![Flow of steps from inventorying datasets through pulling metrics, tracing citations, computing numbers, and assembling the report.](/article-images/illustrations/data-impact-report-for-cv-report-workflow.webp) ### Step 1: Inventory Your Datasets Create a plain text file, `datasets.md`, with one entry per dataset: ```text # Dataset inventory 1. ID: 10.5281/zenodo.0000001 Title: Longitudinal CGM traces, type 1 diabetes cohort Repository: Zenodo Released: 2023-04-12 Access: open Primary publication: DOI 10.xxxx/example 2. ID: phs000000.v1.p1 Title: Controlled-access genotypes, cardiovascular substudy Repository: dbGaP Released: 2022-09-01 Access: controlled Primary publication: DOI 10.xxxx/example2 ``` Common error at this step: forgetting embargoed or superseded versions. Check each repository record for a version history before you write the release date. ### Step 2: Pull Usage Metrics Programmatically For datasets registered with DataCite (Zenodo, Figshare, and many institutional repositories use DataCite DOIs), the DataCite API exposes usage counts. Run this script, replacing the DOI with yours: ```python import requests doi = "10.5281/zenodo.0000001" url = f"https://api.datacite.org/dois/{doi}" response = requests.get(url, timeout=30) response.raise_for_status() attrs = response.json()["data"]["attributes"] print(f"DOI: {doi}") print(f"Citations: {attrs.get('citationCount', 'not reported')}") print(f"Views: {attrs.get('viewCount', 'not reported')}") print(f"Downloads: {attrs.get('downloadCount', 'not reported')}") ``` Expected output, illustrative values: ```text DOI: 10.5281/zenodo.0000001 Citations: 12 Views: 2140 Downloads: 386 ``` Common errors and fixes: - `requests.exceptions.HTTPError: 404 Client Error: Not Found` means the DOI is wrong or the record is not registered with DataCite. Verify the DOI resolves in a browser. Controlled-access clinical repositories often do not use DataCite DOIs, so expect this error there and use the manual method instead. - A `citationCount` of `not reported` or zero does not mean no impact. DataCite citation counts depend on publishers depositing citation metadata. Cross-check manually (Step 3). - `requests.exceptions.ConnectionError` or a timeout usually means a network or proxy issue in an institutional environment. Run the script from a personal network or increase the timeout. To check the result is right, open the DOI in a browser and confirm the landing page statistics are consistent with the API output. Numbers within a few percent are normal because counts update on different schedules. ### Step 3: Trace Secondary Publications For each dataset, search Web of Science or Scopus for publications citing the primary paper, then screen the results for papers that actually analyzed your data. This forward-citation-plus-screening approach is the same one used in the YODA portfolio study, which identified secondary publications through Web of Science citation searches of the primary publications [2]. Record, for each hit, whether at least one author was an original data producer. That determines your internal versus external split. For controlled-access datasets, request the approved-project list from the access committee or, for platform-mediated data, ask the platform administrator for the count of approved requests. Platforms track this precisely, which is one of the practical advantages of platform-mediated sharing noted in the YODA analysis [2]. ### Step 4: Compute Reportable Numbers ![Worked formula dividing 12 citing publications by 3.5 years to give 3.4 citations per year.](/article-images/illustrations/data-impact-report-for-cv-annualized-citation-rate.webp) Two formulas cover most cases. Annualized citation rate: ```text annualized citations = total citing publications / years since first data release ``` Worked example: a dataset released in April 2023 with 12 citing publications, reported in November 2026, spans 3.5 years. ```text annualized citations = 12 / 3.5 = 3.4 per year ``` Reuse penetration, modeled directly on the YODA portfolio result where 79% of eligible trials had at least one secondary publication [2]: ```text reuse penetration = datasets with at least one secondary publication / total datasets shared ``` If you shared 5 datasets and 4 have secondary publications, your reuse penetration is 4/5 = 0.80, which you can report alongside the portfolio-level benchmark of 79%. ### Step 5: Document the Privacy-Utility Tradeoff if You Applied One If your data is anonymized, defaced, or federated, add a short paragraph describing the mechanism and any validation you performed. Standard practice points to report: - For k-anonymity, the k value used and the suppression rate. The University Hospital Mannheim case study evaluated k values of 5, 10, and 15 and showed that downstream distortion of clinically meaningful distributions deserves explicit checking rather than trusting the tool's internal information-loss metric [6]. - For imaging, the defacing algorithm chosen and the task-level validation. The multi-institution evaluation compared two invasive defacing methods and one facial replacement method across MRI and CT from 600 subjects and measured the effect on clinical AI tasks, framing the result as a privacy-utility tradeoff [1]. - For data that cannot be centralized at all, federated designs. A framework built on secure multi-party computation (SMPC, cryptographic protocols that let parties jointly compute a function without revealing their private inputs) achieved performance within 4% of centralized baselines for cell type classification across six single-cell datasets, reaching 99% of centralized performance within two federated rounds in the tested settings [8]. If you participated in such an analysis, the near-parity result is itself an impact statement: your data contributed without ever leaving its home institution. ### Step 6: Fill the Template Here is a fill-in template matching the eight-section format. Copy it once per dataset. ```text DATA IMPACT REPORT Prepared by: [name, position] Date of this report: [YYYY-MM-DD] 1. SUMMARY Dataset: [title] Persistent ID: [DOI or accession] Repository: [name] Released: [date] Access model: [open / controlled / federated] Reuse to date: [two sentences, e.g. "12 citing publications, 3 external reanalyses, 386 downloads as of 2026-11-01."] 2. DATASET DESCRIPTION Content and generation: [2-4 sentences] Records/samples: [n = ...] Versions: [v1 date, v2 date if applicable] Primary publication: [citation] 3. AVAILABILITY AND ACCESS STATEMENT Location and access route: [URL or access committee name] Governance: [data use agreement, IRB protocol, or none required] 4. ACCESS AND USAGE METRICS (snapshot date: [date]) Downloads: [n] Views: [n] Approved access requests: [n, controlled data only] Source of figures: [repository statistics page / DataCite API] 5. SECONDARY PUBLICATIONS Total: [n] Internal: [n] External: [n] Annualized citation rate: [n] per year [Author year, journal. One line: what the study asked with our data. Internal/external.] 6. OTHER REUSE [Policies, theses, software, teaching uses. One line each.] 7. PRIVACY AND UTILITY NOTES Mechanism applied: [open sharing / k-anonymity k=... / defacing algorithm / federated access] Validation performed: [what you checked and what held] 8. NARRATIVE STATEMENT [3-5 sentences connecting this dataset to your research program and to the benefit others obtained from it.] ``` ### Step 7: Verify and Assemble Read the finished report against three checks. Every number has a stated source and snapshot date. Every claimed reuse event names a verifiable publication or artifact. The narrative makes no claim the numbers above it do not support. Then insert the portfolio summary page into your promotion package directly after your publication list, with per-dataset pages in an appendix. ## Common Mistakes and Limitations **Reporting raw downloads as scholarly impact.** Downloads measure interest, not use. Committees discount them. Report them, but pair them with traced secondary publications, which are the metric the reuse literature itself uses [2]. **Undated metrics.** Every count in your report needs a snapshot date. Undated numbers cannot be checked and get struck from assessments. **Claiming causation from correlation.** A paper that cites your primary publication did not necessarily reuse your data. The YODA study screened citing publications to identify actual secondary use, and so should you [2]. If you cannot confirm reuse from the abstract or methods, either verify or drop the entry. **Confusing internal and external reuse.** Reviewers distinguish reuse by your own group, which shows program continuity, from external reuse, which shows community value. The external share in the YODA portfolio was 17.9% of secondary publications [2]. Report both counts separately. **Ignoring the analytical cost of privacy protections.** Anonymization and defacing change the data. The k-anonymity case study showed distortions in clinically meaningful distributions that the anonymization tool itself did not flag [6], and the imaging evaluation quantified task-level effects of defacing on AI models across 600 subjects from three institutions [1]. If you applied any protection, state it and state what you validated. Silence invites the reviewer to assume the worst. **Overcounting controlled-access data.** For platforms, report approved requests and completed secondary publications, not "potential users." The access mechanism data in the YODA study was itself incomplete, with access mechanisms reported for 190 of 209 external publications, or 91% [2]. Small gaps in the record are normal. Say what you verified. **Presenting operational contributions as second-class.** If you centralized registry abstraction, built shared metrics pipelines, or improved data quality, those outcomes are reportable impact. The Allegheny Health Network centralization project across 5 facilities and 8 registries documented efficiency gains, improved accuracy, and better decision support as primary outcomes [5]. **Trust considerations get skipped.** If your data involves human participants from communities with documented reasons for wariness toward data sharing, a sentence on engagement and consent design belongs in Section 7. Work on AI-mediated health engagement has proposed concrete evaluation metrics for how trust, consent behavior, and participation in data sharing vary across communities, treating demographic dimensions as analytic variables rather than optional covariates [9]. One limitation applies to any report of this kind: a committee evaluates your whole record, and individual judgments rest on evidence quality across all of it, not on data metrics alone. Present the report as one documented strand of that record. ## Frequently Asked Questions ### What exactly is a data impact report for a CV? It is a short, structured document that records where your shared research data lives, who has used it, and what came of that use. It converts a single CV line into verifiable evidence of scholarly contribution. ### Where does a data impact report go in a promotion package? Place a one-page portfolio summary directly after your publication list, with per-dataset detail pages in an appendix. If your institution has a dedicated data or open science section in its dossier template, cross-reference it from there. ### Is there a standard data impact report format I should follow? No single standard exists across institutions. The eight-section format in this article (summary, description, availability, metrics, secondary publications, other reuse, privacy notes, narrative) covers what review committees consistently ask about and adapts to any dossier template. ### Can I see a data impact report for a CV example I can copy? Yes. The template block in the walkthrough above is a complete fill-in example. Work through it once with a single dataset, then duplicate the block for each additional dataset in your portfolio. ### How do I count citations to a dataset rather than a paper? Search Web of Science or Scopus for works citing the dataset's primary publication, then screen those works to confirm they actually analyzed your data. This citation-search-then-screen method is the same one used to trace 1,167 secondary publications in the YODA clinical trial portfolio [2]. ### What if my data cannot be shared openly because it contains sensitive information? Report controlled or federated access as its own impact category. Document the access mechanism, the number of approved external requests, and any privacy-utility validation you performed. Platform-mediated sharing demonstrably generates external secondary publications, with 85% of external publications in the YODA portfolio obtaining data through sharing platforms [2]. ### Do download and view numbers belong in the report? Include them, clearly dated and sourced, but treat them as interest indicators rather than impact. Lead with traced reuse events such as secondary publications, reanalyses, and downstream methods, because those are what review committees weigh. ### How often should I update a data impact report? Refresh the metric snapshot and any new secondary publications at each major career milestone: annual review, mid-tenure, and promotion submission. State the snapshot date in every version so reviewers can see the currency of the numbers. ## Sources 1. [Balancing privacy and performance: the impact of facial defacing on AI in medical imaging.](https://pubmed.ncbi.nlm.nih.gov/42667924/) 2. [Secondary use and scholarly impact of a portfolio of clinical trials with shared individual participant level data: cross sectional study.](https://pubmed.ncbi.nlm.nih.gov/42686366/) 3. [Genetic metrics decode Plasmodium falciparum diversity: complexity of infection, parasite connectivity, and transmission intensity in Mainland Tanzania's diverse regions.](https://pubmed.ncbi.nlm.nih.gov/42137244/) 4. [Emergency Medicine Resident Perceptions of Their Own Throughput Metrics.](https://pubmed.ncbi.nlm.nih.gov/42732276/) 5. [Cardiovascular Data Abstraction Centralization: Impact on Patient Care, Operational Efficiency, and Strategic Decision-Making.](https://pubmed.ncbi.nlm.nih.gov/42752026/) 6. [Quantifying the Impact of Anonymization-Induced Clinical Data Quality Loss: Methodological Quantitative Case Study Using Primary Diagnosis Codes and Hospital Length of Stay.](https://pubmed.ncbi.nlm.nih.gov/42726783/) 7. [Conflict or interest? Using consumer purchase data to support food systems transformation.](https://pubmed.ncbi.nlm.nih.gov/42504032/) 8. [Clifti-GPT: privacy-preserving federated fine-tuning and transferable inference of foundation models on clinical single-cell data.](https://pubmed.ncbi.nlm.nih.gov/42557585/) 9. [Understanding Race as a Key Analytic Dimension in AI-Enabled, Health-Related Social Engagement Online and Its Role and Impact in Health Research.](https://pubmed.ncbi.nlm.nih.gov/43007696/)