# Data Management Plan Components A [data management](/blog/guides/data-management-basics-principles-processes-and-best-practices) plan (DMP) is a written document that describes how a research project will collect, organize, store, protect, share, and preserve its data from the first day of the study to long after publication. The core data management plan components are data description, collection and organization, metadata and documentation, storage and security, access and sharing, ethics and governance, roles and responsibilities, budget, and long-term preservation. This guide explains each component in plain language, shows how a plan fits into research project management, and works through examples from real life science settings, including clinical machine learning studies, hospital surveillance programs, and register-based research. ## What Is a Data Management Plan? A data management plan is the data chapter of a research project plan. It states what data the project will generate or reuse, in what formats, where the data will live, who can access them, which ethical rules apply, and what happens to them after the grant ends. Most components map onto stages of the research data lifecycle, a standard model that runs from planning through collection, processing, analysis, preservation, and sharing. Funder expectations have made the document routine. Since January 2023, the National Institutes of Health has required a Data Management and Sharing Plan for most grant applications, and the National Science Foundation has required a DMP as part of proposals for years. Universities, journals, and data repositories increasingly ask for the same information even when no funder does. A plan earns its keep in two ways. It satisfies reviewers, and it prevents the most common failure in research data handling, which is discovering too late that data were captured in a form nobody else can understand, validate, or reuse. Writing the plan before collection starts is what makes it useful rather than decorative. ## Why Life Science Data Is Hard to Manage Biology produces some of the messiest data in any research field, and that shapes every component of the plan. Three properties drive the difficulty. First, biological data are high-dimensional, meaning each sample yields thousands to billions of values, from sequencing reads to protein measurements. Second, the meaning of a measurement depends on context that the file itself does not carry: which instrument ran the sample, which reagent lot was used, which tissue, which consent applied. That context is metadata, and without it a raw file is close to worthless. Third, many biological measurements cannot be recreated. A blood draw from a specific patient on a specific day cannot be repeated if the sample degrades or the label is wrong. These properties explain why plans in this field emphasize documentation, identifiers, and preservation more heavily than plans in many other disciplines. A lost metadata file in physics may mean rerunning a simulation. A lost metadata file in a clinical study can mean a cohort you can never reassemble. ## Data Management Plan Components Explained Funder templates differ in wording and order, but nearly every DMP contains the nine components below. Knowing what each one asks, and what a strong answer looks like, is most of the work of writing one. ### 1. Data Description This component answers a simple question: what data will exist? List every data type the project will generate or reuse. Life science projects typically combine several kinds: - Observational data, such as survey responses, clinical measurements, images, or sensor readings. - Experimental data, such as sequencing runs, assay plate readings, or microscopy files. - Derived data, such as cleaned tables, statistical models, and analysis outputs. - Reused or secondary data, such as electronic health records (EHRs), public databases, or registry extracts. For each type, name the format and estimate the volume. Sequencing produces FASTQ files for raw reads, BAM files for alignments, and VCF files for variant calls. Clinical imaging produces DICOM files. Tabular results belong in open formats such as CSV. Reviewers use your volume estimates to judge whether the storage plan is realistic, so base them on a pilot run or on published file sizes rather than on a guess. Multimodal projects need extra care here. A machine learning study of transfusion management in acute myeloid leukemia drew on EHRs together with genomic, proteomic, and other high-dimensional datasets, and the authors identified data standardization across sources as a persistent challenge [1]. A plan for that kind of project must describe each source separately, state its structure, and explain how the sources will be linked. ### 2. Data Collection and Organization This component describes how data enter the project and how they stay organized. Cover four things: collection methods (instruments, forms, apps, device exports, manual entry), identifiers (how samples, participants, and files receive unique IDs), naming and versioning (file naming conventions, folder structures, version control for code and documents), and quality control at the point of entry. Large projects benefit from an electronic [lab notebook](/knowledge/molecular-biology/lab-notebook) or a [laboratory information management system](/knowledge/bioinformatics/lims-explained-lab-information-management-systems) (LIMS), software that tracks samples, procedures, and results in one place. Clinical and implementation studies often combine human record-keeping with automated capture. The IMP2ART asthma implementation trial in UK primary care monitored its delivery through team logs alongside automated data such as patient use of online resources and uptake of practice education modules [2]. Hospital surveillance programs organize the same principle at larger scale. The SPIDAAR partnership built antimicrobial resistance surveillance at Queen Elizabeth Central Hospital in Malawi by establishing standardized data flows and training healthcare workers to sustain them [3]. ### 3. Metadata and Documentation Metadata is data about data: the descriptions that let someone else understand a file years later. Documentation is the broader set of materials explaining how the data were produced. Plan for at least: - A README file in every dataset folder, describing contents, provenance, and contact points. - A data dictionary defining every variable and its allowed values. - A codebook for coded or categorized data. - Protocols and standard operating procedures (SOPs), written step-by-step instructions for repeated tasks. The value of a codebook is easy to see in systematic reviews. One review of adult weight management trials used a project-specific codebook to code 84 delivery features and 89 intervention strategies across eligible trials, and trial investigators then verified the coding [4]. Verification was only possible because the codebook made every decision explicit. Protocols serve the same role for the analysis itself. A realist review of the primary-secondary care interface pre-specified its five steps, from locating existing theories through data extraction and organization of evidence [5]. A scoping review protocol on holistic health approaches in alcohol use disorder fixed its databases and methodological framework before searching began [6]. Quality systems in clinical programs apply the same discipline, using process mapping, SOPs, documented change control, and product traceability so that every modification can be traced [7]. ### 4. Storage, Backup, and Security This component states where data live and how they survive disaster. A widely taught baseline is the 3-2-1 rule: keep three copies, on two different types of media, with one copy offsite. Name the actual systems, whether an institutional server, an approved cloud service, or both. Describe encryption for data at rest and in transit, and say who holds access permissions and how they are granted and revoked. Sensitive human data need stronger controls, such as role-based access and audit logs. Privacy protection is a recognized challenge for multimodal clinical datasets, because combining health records with genomic and proteomic data raises re-identification risks that a single source would not [1]. Your plan should identify which datasets are sensitive, which protections apply, and who approves access. Test the backup. A backup that has never been restored is a hypothesis, not a plan. ### 5. Access, Sharing, and Reuse This component describes who can use the data, when, and under what terms. Cover access levels (open, controlled, or restricted to the study team), the repositories where data will be deposited, timing relative to publication, and licenses or data use agreements. Domain repositories exist for most major data classes, including raw sequencing reads, [gene expression](/blog/guides/gene-expression) results, and protein structures, and institutional repositories cover material with no natural disciplinary home. The FAIR principles, a community standard holding that data should be findable, accessible, interoperable, and reusable, are the usual yardstick for these decisions. Reuse deserves explicit attention. A London study of text message reminders for cervical screening was a retrospective secondary analysis of routinely collected data, drawing on records from a text message provider and the national cervical screening management system [8]. Secondary projects live or die on provenance, the documented history of where data came from and what permissions allow, so a plan for reused data should record sources, extraction dates, and agreements. Registers show the long-term version of the same idea. Arthroplasty registers, coordinated internationally through bodies such as the International Society of Arthroplasty Registries, curate joint replacement outcomes across hospitals and years so that clinicians, researchers, and quality improvement programs can reuse them [9]. ### 6. Ethics, Privacy, and Governance This component maps the legal and ethical rules that apply to the data. For human-subject research, describe informed consent (including whether the consent language permits sharing and reuse), de-identification procedures, and institutional review board (IRB) oversight. For protected health information in the United States, describe HIPAA safeguards. Governance also covers community authority over data. A partnership between the First Nations Health and Social Secretariat of Manitoba and the University of Manitoba developed a community-led COVID-19 modeling platform under First Nations data sovereignty principles, meaning the communities themselves govern data about them and control access decisions [10]. A plan for collaborative or Indigenous data should name the governance body, the approval process, and the agreements that bind them. ### 7. Roles and Responsibilities This component names the people accountable for each data task. Assign a data steward who owns the plan day to day. State who trains new team members, who approves access requests, who performs deposits, and who inherits the data when someone leaves. Students graduate and staff rotate, and undocumented knowledge leaves with them. Multi-team projects need this in writing most of all. The Manitoba modeling platform required coordination among model developers, dashboard designers, and information technology staff responsible for infrastructure, and competing priorities repeatedly delayed that collaboration [10]. Hospital surveillance capacity building depends on defined staff roles alongside training and competency assessments [3]. Quality systems in cell therapy programs make personnel competency a formal, documented requirement for the same reason [7]. ### 8. Budget and Resources This component shows the money and time behind the plan. Typical line items include storage beyond institutional quotas, computing for large analyses, repository deposit fees where they apply, software licenses, and personnel time for curation and documentation. Curation is labor, and reviewers read this section to check whether the rest of the plan is funded or aspirational. If a component of the plan has no budget line, either fund it or simplify the plan. ### 9. Preservation and Long-Term Stewardship This component describes what happens after the grant ends. State the retention period, the final archive or repository, the file formats chosen for long-term readability, and who is responsible for maintenance. Open, non-proprietary formats age better than vendor-specific ones. Format migration, the scheduled movement of data into current formats as technology changes, should be planned rather than hoped for. Registers again provide the model. Arthroplasty registers have maintained patient outcome data for decades and function as long-term infrastructure for evidence-based medicine and value-based health care [9]. Clinical quality programs formalize the same duty through data submission obligations with traceability requirements [7]. ## Data Management Plan Components Examples The table below summarizes the nine components and shows what each looks like in real life science research. | Component | What it specifies | Example from life science research | |--|--|--| | Data description | Data types, formats, and estimated volume | Multimodal EHR, genomic, and proteomic inputs for a leukemia transfusion model [1] | | Collection and organization | Capture methods, identifiers, naming, quality checks | Team logs plus automated resource-usage data in a primary care implementation trial [2] | | Metadata and documentation | Data dictionaries, codebooks, protocols, SOPs | A trial-review codebook standardizing coding of intervention features [4] | | Storage and security | Systems, backup, encryption, access control | Tiered access for re-identifiable clinical and genomic data [1] | | Access and sharing | Repositories, timing, licenses, reuse terms | Secondary analysis of routinely collected screening records [8] | | Ethics and governance | Consent, de-identification, community authority | First Nations data sovereignty in a pandemic modeling partnership [10] | | Roles and responsibilities | Named steward, training, turnover planning | Coordination across modeling, dashboard, and IT teams [10] | | Budget and resources | Storage, computing, curation personnel time | Storage and curation line items in a grant budget | | Preservation | Retention period, archive, format migration | Decades-long arthroplasty register stewardship [9] | Four patterns run through strong plans. They name concrete formats and systems instead of promising appropriate ones. They capture decisions in codebooks, protocols, and SOPs so another person could repeat the work,. They treat privacy and governance as design inputs rather than afterthoughts,. They assign every task to a named role,. Three worked examples show how the components combine. **A clinical machine learning project.** A study planning machine learning models for precision transfusion in acute myeloid leukemia would describe each multimodal input, define how EHR, genomic, and proteomic features are standardized and linked, specify privacy controls for re-identifiable data, and budget for the computing the models require [1]. **A [qualitative interview](/blog/guides/conducting-qualitative-interviews-a-guide-for-life-science-researchers) study.** A qualitative study such as key informant interviews on economic evaluation in outbreak management would list interview guides, recordings, and transcripts as data, plan transcription and secure storage, name the analysis framework, and state how transcripts are de-identified before any sharing [11]. **A secondary analysis of routine data.** A project reusing routinely collected screening records would document the data sources, the date ranges, the permissions obtained, and the exact extracts received, so the analysis can be audited later [8]. ## How a Data Management Plan Fits Into Research Project Management ![Two columns set out how a research project plan and a data management plan differ in scope, contents, who reads them, and when they change.](/article-images/illustrations/data-management-plan-components-dmp-vs-project-plan.webp) Research project management is the discipline of planning a study's objectives, timeline, budget, team, and risks so the work finishes on schedule and answers the question it set out to ask. A DMP is the data portion of that effort, and a research project plan template almost always reserves a section for it alongside the aims, methods, timeline, and budget. The connection is practical rather than bureaucratic. Interviews with senior nursing students about their undergraduate research projects found that data collection, time management, and research planning were the challenges students felt most, while mentor support was the key facilitator [12]. Those are exactly the risks a written data plan reduces, because it forces decisions about capture, cleaning, and storage before deadlines compress them. Build data milestones into the project timeline: - A defined data collection window with an end date. - A cleaning and quality control window before analysis begins. - A documentation sprint while memory is still fresh. - A deposit and preservation step before the final report. Treat the DMP as a scheduling input. If sequencing data will arrive in month six, the analysis milestone cannot sit in month five. ## Writing Your Plan: A Practical Workflow ![Flow of steps for writing a data management plan, from listing data sources through standards, storage, drafting, review, and revision.](/article-images/illustrations/data-management-plan-components-dmp-writing-workflow.webp) 1. **Inventory the data.** List every source, generated or reused, with formats and rough volumes. 2. **Choose standards.** Pick file formats, identifiers, naming conventions, and any community reporting standards that apply. 3. **Choose the storage and access model.** Name systems, backup strategy, and who decides on access. 4. **Draft the plan.** Start from your funder's template, or use free planning tools such as DMPTool or DMPOnline, which walk through the standard components. 5. **Get it reviewed.** Institutional libraries, IT security, and ethics offices catch problems early. 6. **Revisit it.** Reopen the plan at every project milestone. That last step mirrors how mature quality systems stay alive. Cell therapy programs preparing for JACIE inspection organize their quality management around the Plan-Do-Check-Act cycle, checking whether documented procedures match practice and acting on the gaps [7]. A DMP benefits from the same loop. Version the document, date each revision, and record what changed. ## Common Myths About Data Management Plans **"My dataset is small, so I do not need a plan."** Small datasets fail in the same ways large ones do, through lost context and broken consent. A two-page plan for a small study costs an afternoon. **"The IT department handles data management."** IT provides storage and security tools. Decisions about formats, metadata, consent, and sharing belong to the research team. **"I will organize the data after collection."** Post hoc organization is where identifiers get confused and metadata gets lost. Organization is a collection-stage task. **"Sharing data means losing control or being scooped."** Controlled access, embargoes, and data use agreements let you share while retaining oversight. Repositories are built for exactly this. ## Common Mistakes and Limitations Ten mistakes account for most failed data plans: 1. **Writing the plan only for the funder.** A DMP nobody opens again is compliance theater. The plan should match what the team actually does. 2. **Vague data descriptions.** "Survey data" is not a description. Name the instrument, the variables, the format, and the volume. 3. **No naming convention or version control.** Files called final_v3_REAL.xlsx are a data management failure in progress. 4. **Underestimating volume.** Raw instrument files are often far larger than processed ones. Estimate from a pilot run. 5. **Consent that blocks sharing.** If participants were never asked, data cannot be deposited. Write consent language before collection starts. 6. **Ignoring governance requirements.** Community and national rules can determine who may access data and how fast. The Manitoba partnership faced a six-month reporting lag on administrative data access, which shaped what the platform could deliver during an emergency [10]. 7. **Single-copy storage.** One copy on one drive is not a backup. Follow the 3-2-1 rule and test a restore. 8. **Unnamed responsibilities.** When nobody owns the data, documentation stops the week a student graduates. 9. **Treating the plan as static.** Projects change. An out-of-date DMP misleads everyone who relies on it. 10. **Skipping standardization planning.** Combining data from multiple sources fails without agreed variable definitions and linkage keys. A few limitations deserve one honest paragraph. A DMP is a plan, not a guarantee. Writing one does not by itself improve data quality, and following one does not remove the need for institutional review of ethics, security, and compliance. Requirements differ across funders, institutions, journals, and jurisdictions, so check current guidance from your program officer, institutional library, or research office before you finalize. Individual projects, especially those involving human participants or community-governed data, need review by the responsible bodies at your institution. ## Frequently Asked Questions ### What are the main components of a data management plan? The main components are data description, collection and organization, metadata and documentation, storage and security, access and sharing, ethics and governance, roles and responsibilities, budget, and long-term preservation. Funder templates group these under slightly different names but ask the same questions. ### What is a data management plan in research? It is a short document describing how a project will handle data across the research lifecycle, from collection through sharing and preservation. Funders such as the NIH and NSF require one with most applications. ### Do I need a DMP if my funder does not require one? Yes. A plan still prevents lost files, broken consent agreements, and unpublishable datasets, and many journals and repositories ask for the same information at submission. ### How long should a data management plan be? Most plans run two to six pages. Reviewers want specific answers rather than length, so name formats, systems, and responsible people instead of padding. ### How is a DMP different from a research project plan? A research project plan covers the whole study, including aims, methods, timeline, and budget. The DMP is the data-focused section of that plan, and the two should reference each other. ### What file formats should I list in a DMP? List the formats you will actually produce, and prefer open, non-proprietary ones such as CSV, FASTQ, VCF, or DICOM for anything meant to be preserved and reused. ### How do I protect participant privacy in a DMP? Describe consent language that permits sharing, de-identification steps, encryption, and controlled access through a repository or data use agreement. ### Can I revise my DMP after the project starts? Yes. A DMP is a living document. Update it when data sources, tools, or personnel change, and keep dated versions so the history stays clear. ## Sources 1. [Research and application of machine learning models based on multimodal big data for precise transfusion management in acute myeloid leukaemia.](https://pubmed.ncbi.nlm.nih.gov/42498511/) 2. [IMPlementing IMProved Asthma self-management as RouTine (IMP2ART) in UK primary care: An internal pilot for a cluster randomised controlled trial.](https://pubmed.ncbi.nlm.nih.gov/41860818/) 3. [Implementing AMR surveillance at a tertiary hospital in a low-income country: results from the Surveillance Partnership to Improve Data for Action on AMR (SPIDAAR) in Malawi.](https://pubmed.ncbi.nlm.nih.gov/42920193/) 4. [Unpacking weight management interventions measuring eating disorder risk in adults: coding of components of interventions in a systematic review.](https://pubmed.ncbi.nlm.nih.gov/42310783/) 5. [Understanding the primary-secondary care interface and its impact on workforce sustainability: a realist review protocol.](https://pubmed.ncbi.nlm.nih.gov/42230113/) 6. [Holistic Health Approaches for People With Alcohol Use Disorder: Protocol for a Scoping Review.](https://pubmed.ncbi.nlm.nih.gov/42456156/) 7. [Preparing HSCT and CAR-T therapy programmes for JACIE inspection: a structured methodological approach to implementing a quality management system.](https://pubmed.ncbi.nlm.nih.gov/42836712/) 8. [SMS text message reminders versus usual care for cervical screening attendance in London, UK: a retrospective secondary analysis of routinely collected data.](https://pubmed.ncbi.nlm.nih.gov/42877070/) 9. [The "symbiosis" between high-quality register data and value-based health care and the role of local, national, and international registers in the development and promotion of value-based healthcare projects.](https://pubmed.ncbi.nlm.nih.gov/42920135/) 10. [Implementing a First Nation data-sovereign and agile modelling platform for pandemic management: lessons from Manitoba.](https://pubmed.ncbi.nlm.nih.gov/42912129/) 11. [The role of economic evaluation in public health emergency management of disease outbreaks in Africa: a qualitative research.](https://pubmed.ncbi.nlm.nih.gov/42440240/) 12. [Nursing students' experiences of undergraduate research projects: a qualitative descriptive study.](https://pubmed.ncbi.nlm.nih.gov/42986058/)