What to do when you receive an access request to your Restricted Access Data Sharing Collection (DSC)? Below we provide a workflow image, tips, practical advice, and best practices in the shape of a step-by-step manual. However, each access request is unique and the workflow might therefore differ depending on your collection. Contact your research administrator or data steward if you need help.
Step 0: A request is made
When a potential user of your collection requests access to your collection, they must fill out a request form. The filled in form will be sent via email to you, the applicant, and your Organisational Unit’s research administrator. It provides you with information about the applicant and their affiliation, about the research project and intended use of the data, and -if applicable- about any other persons/collaborators that require access to the data.
Step 1: Assess the request
The request then needs to be assessed by a person. That person can be the collection manager or a committee that is responsible for handling data access requests (a so-called Data Access Committee). They need to decide if access can be granted or not. The decision should for example be based on whether your data collection can usefully contribute to answering the data applicant's research question, whether that research question is in line with what you told your participants their data will be used for, and that the data applicant has a relevant position or function to perform their research.
When you need more information, contact the applicant and ask for more details.
If you decide to deny access, the friendly thing to do is to reply via email and explain your decision to deny access. You do not need to take further steps in the RDR itself. Otherwise, continue.
Step 2: Contact your data steward
Because of the nature of the data in Restricted access data sharing collections and the legal complexity of Data Use Agreements, it is highly recommended to contact the data steward (often the research admin) of your research institute before you continue. They can help you with the following steps or put you in contact with someone who can.
Step 3: Prepare the Data Use Agreement
Each separate access request requires a Data Use Agreement (DUA) that suits the specific request. That is why the selected DUA in the metadata of your restricted access collection is a template; there is no one-size-fits-all DUA for these collection types. Depending on the applicant, the template might need changes before it can be signed. Cooperate with the research administrator, the applicant, and if needed the legal department, to prepare a DUA that all parties agree with.
Never change or set up a Data Use Agreement by yourself without the involvement of legal experts. You can contact Radboud University’s legal department or the RadboudUMC legal department (Valorisation) if you need help.
If you want to share data with a party outside of the European Union or countries that offer an adequate level of data protection according to the European Union (see the list of non-EU countries with an adequate protection level), you cannot use a standard DUA (nor the RDR templates). Instead, you must make specific agreements with the data access applicant. You should contact the the university’s legal department or the RadboudUMC legal department (Valorisation) to see if granting access is allowed and if so, to have an agreement drawn up.
Step 4: Sign the Data Use Agreement
The DUA must then be signed by an authorized person of both parties. At Radboud University, in line with Radboud University's guidelines on control of research data, this is the research director.
The data steward may have access to ValidSign to allow both parties to electronically sign the DUA.
Step 5: Save the Data Use Agreement
Store the signed DUA in a safe place for as long as the agreement is in place. The RDR is not suited for storage of legal documents. The recommended storage solution for the signed DUA depends on your research institute. Ask your data steward for help if you are not sure what the recommended solution is at your institute.
Step 6: Grant access
Go to your collection, click on ‘edit metadata’, next to 'viewers' click ‘Add viewer’, and select the account with the same email address that was used to request access (step 0). Do not add them as contributor or manager!
The workflow overview
