Most departments within the FGB take on students for research internships or as temporary research assistants. When students work with research data, the confidentiality of the information, the privacy of the research subjects and the overall security of the data are at risk if students are not taught how to correctly manage and protect this research data. To determine the best methods for your student(s) to safely manage and work with research data, start by determining the privacy risks (and where applicable the confidentiality risks) for the data asset(s) that the student(s) will have access to.
All students are expected to read, understand and apply the Security Basics.
Students that are working with “Red”, “Orange”, “Yellow”, or “Green” data must sign a nondisclosure agreement (sometimes called a confidentiality agreement) before starting their research. For students conducting research solely under the supervision of FGB, a template agreement can be obtained from your section/department head, who will also sign it on behalf of the FGB director of business operations. If the student is working at another institution where all data collection and storage will take place, and the role of FGB is solely supervision of the research internship, then the other institution is responsible for setting up such an agreement with the student.
If FGB and another institution are both responsible for the data that the student will work with (e.g. data collection and/or storage happen at both FGB and the other institution) then the student must sign agreements with both FGB and the other institution. The FGB supervisor should review the FGB template agreement in such a situation to ensure that there aren’t any issues impacting collaboration with the other institution; if there seems to be a problem, contact Legal Affairs for advice.
Ensure that you use an appropriate method, based on the privacy and/or confidentiality risks, to provide data to your students. You can either digitally share the data (which is discussed in further detail below) or physically provide the data (for example, with an encrypted USB-stick).
Although VU Amsterdam offers many data storage options, not all of these options are available to students. The following section provides guidance on data storage options for students with consideration for the privacy and confidentiality risks posed by the data. The focus of this section is to describe solutions for data storage while a student is processing and/or analysing data. If students are involved in data collection, see the relevant section below.
NB: The research data used in a research project can have a variety of risk categories: the raw data may be “Red” data, but the processed data may be “Yellow” or “Green”. It is recommended, where appropriate, to first de-identify the data as much as possible to help reduce the risks before providing data to the student.
Very often, “Red” data needs to be stored on a custom storage solution that is developed with the support of IT. If this applies to your research, you should discuss the need for student access with the IT developers who set up your custom storage solution.
If your “Red” data have been approved for storage in YODA, you can add the student(s) to the YODA “group” you manage
It is strongly recommended that students working with “Red” data work on campus on VU workstations under the supervision of their supervisor. If they absolutely need to use their personal computer they must:
Whenever a student must work with “Red” data from home, they must also:
If none of the above options are feasible, contact the RDM Support Desk for advice.
The recommendations for “Red” data should be applied to “Orange” data whenever possible, except for the recommendation that the student should work onsite at the VU. They are allowed to work remotely and on their own device with the precautions listed for the use of personal computers.
If you are already storing “Orange” data in YODA, you can add the student(s) to the YODA “group” you manage to provide them access to “Orange” data.
If you are already using Research Drive, SciStor or Teams/SharePoint for the storage of “Orange” data, it is possible to provide students access to the data stored there. However there are some caveats:
If YODA, Research Drive or SciStor are not feasible, the data can be sent to the student using ZIVVER or SURFFileSender. Follow the instructions for “Orange” data in the Digital Data Transfer Guide on how to safely use these tools to send data to students.
Whenever a student must work with “Orange” data on their own device, they must also:
Whenever a student must work with “Orange” data from home, they must also:
If none of the above options are feasible, contact the RDM Support Desk for advice.
When providing students with “Yellow” data, any of the options listed for “Orange” data (i.e. YODA, Research Drive, SciStor, ZIVVER and SurfFileSender) can be used. SURF Drive may be used to provide students with data, however, the options listed under “Orange” data are preferred (see the Secure Storage Guide for more information).
If you are already storing “Yellow” data in YODA, you can add the student(s) to the YODA “group” you manage to provide them access to “Yellow” data.
You can also share “Yellow” data with students via Research Drive, SciStor, SURF Drive, Teams/SharePoint, ZIVVER or SURFFileSender. There are a few important things to be aware of however:
Students working with “Yellow” data may store the data directly on the hard drives of their own computers. However, they should still follow good practices when working with their personal computers:
Whenever a student must work with “Yellow” data from home/offsite, they must also:
If none of the above options are feasible, contact the RDM Support Desk for advice.
Any of the data storage options listed under “Yellow” data may be used for “Green” and “Blue” data.
If none of the above options are feasible, contact the RDM Support Desk for advice.
If a student cannot be given access to a VU storage option (e.g. YODA, Research Drive, SciStor) and they must, therefore, store the data on an encrypted external hard drive or on their computer’s hard drive, there will be an increased risk of data loss. The supervisor should make a back-up plan with the student in this case. The data should be securely transferred to the supervisor in a similar method to how the data was provided to the student, and the supervisor should store the backed-up data on an appropriate VU storage option. It is up to the supervisor as to how often the data need to be backed up (at a minimum, once per month); back-ups should happen more frequently for data that will be used for research publications and for data that are extremely valuable and not easily replaced.
When the student has completed working with the data, they need to return the data to their supervisor via an appropriate method and then delete the data from the external hard drive or their computer’s local hard drive. This applies to all data regardless of the privacy/confidentiality risk.
Students may also be tasked with collecting raw data at an offsite location and then physically transporting the data back to the VU campus for storage. These students require guidance from their supervisors on how to securely transport these data. Advice on how to securely transport data can be found in this guide; students are expected to read the relevant sections of this guide, particularly the general tips. The researchers responsible for these students should also provide the students with clear instructions specific to the research project so that they know exactly what is expected of them. If a data collection process is particularly complex and/or there are many people responsible for data collection, it is recommended to create a data collection protocol that everyone on the research team can refer to as needed.
Regardless of the privacy or confidentiality risks posed by the research data, students are expected to document all of their work, particularly any code (a.k.a. SPSS syntax, R script etc.) that is used to process and analyse the data. Students involved with data collection should be instructed on any relevant information that should be documented about the data collection process, for example in logbooks or lab journals.
Documentation is important for ensuring the integrity and quality of the research data, which is especially important if the students are working with data that will be used for future research publications. At a minimum, good documentation by students will assist their supervisors in understanding and reviewing the data at the end of their internships.
For IT support on setting up (remote) access to VU networks for students, contact the IT Service Desk .
For faculty-level support, contact the Technical Support for Research (TO3) Helpdesk. They can provide equipment for short-term data collection and storage, such as encrypted external hard drives, and if given sufficient notice, they can develop solutions for more complex research projects.
If the recommendations of this guide are not feasible, contact the RDM Support Desk. They will bring you into contact with the relevant specialists in IT who can develop an alternative solution.