This guide is about the storage of research data and documentation during active research. Information on how to archive data is available here.

Faculty Storage Recommendations for Research Data

There are a variety of data storage options available at the VU which can get a bit confusing. FGB recommends three primary options for the storage of research data: YODA, Research Drive, and SciStor. Additionally, Teams/SharePoint has been approved for the storage of research data, but FGB recommends only using it if the three primary options are not feasible. This is because Teams suffers from various functionality issues that limit its use for research data. You can always discuss your options with the FGB Research Data Stewards if you are unsure which option to use.


YODA Research Drive SciStor (Teams/SharePoint)
Recommended Uses/Benefits ➢ Storage of large volumes of data that don’t require frequent access for processing/analysis
➢ Storage is free up to 500 GB
➢ Creation of structured metadata to describe your research and the associated datasets
➢ Option to “lock” data as read-only
➢ Data can be shared with external (non-VU) collaborators
➢ Doubles as an archive
➢ Additional benefits described in the FGB YODA manual and in the VU Storage Finder		 ➢ Storage of large volumes of data that are regularly accessed for processing/analysis
➢ Storage is free up to 500 GB
➢ Similar to SURFdrive, but data storage is linked to a project not an individual
➢ Has a desktop sync client for easy management of locally copied data
➢ User access management possible at the (sub)folder level
➢ Easy collaboration and sharing with external collaborators
➢ Additional information found in the VU RDM Handbook & the VU Storage Finder		 ➢ Storage of very large volumes of data that are regularly accessed for processing/analysis
➢ Data are accessed directly from SciStor; no local copying required prior to processing/analysis
➢ Best option for high-performance computing
➢ User access management possible at the (sub)folder level
➢ Additional information found in the VU RDM Handbook & the VU Storage Finder		 ➢ Only use if YODA, Research Drive or SciStor are not feasible options
➢ Replaces G-drive
➢ Similar to OneDrive, but data storage is linked to a project not an individual
➢ User access management possible at the (sub)folder level
➢ Easy collaboration and sharing with external collaborators
➢ Can record and generate transcripts for interviews conducted via Teams depending on the “sensitivity” of the data; contact for guidance
➢ Additional information found in the VU Storage Finder
Limitations ➢ Not efficient for data that need to be accessed regularly for processing/analysis
➢ Slow data access when connecting directly to YODA disk; often data must be locally copied prior to data processing/analysis
➢ Lacks a desktop sync client for easy management of locally copied data
➢ No user access management at the (sub)folder level; all users in YODA group have access to all (sub)folders
➢ The limitations are described further in the FGB YODA manual		 ➢ Requires encryption for higher risk data
➢ Not possible to interact directly with the Research Drive disk; data must be synced locally before processing/analysis
➢ Does not offer structured metadata documentation to make data FAIR
➢ No option to “lock” data as read-only
➢ Does not serve as an archive		 ➢ Cannot be used for collaboration with external (non-VU) users
➢ Fast data access advantages are not available if accessing SciStor off of campus
➢ No threshold below which storage is free
➢ Does not offer structured metadata documentation to make data FAIR
➢ User access rights managed by IT for Research; changes only possible upon request		 ➢ Requires encryption for higher risk data
➢ Can be too easy to share data inappropriately
➢ Difficult to maintain an overview of user access rights
➢ Non-Microsoft files cannot be opened and modified directly within Teams/SharePoint environment; these require an appropriate local application
➢ Does not offer structured metadata documentation to make data FAIR
➢ No option to “lock” data as read-only
➢ Does not serve as an archive
➢ Back-up notifications are not always accurate; triple check that back-ups are complete before deletion
➢ Does not work well with files managed by git or other version control software, particularly when pushing files to remote repositories; do not store such files on Teams/Sharepoint
Storage of “Sensitive” Data:
  ➢ Red Data ~ * ~ * ~ * ~ *
  ➢ Orange Data ✓ ✓ ** ✓ ** ✓ **
  ➢ Yellow Data ✓ ✓ ✓ ✓
  ➢ Green Data ✓ ✓ ✓ ✓
  ➢ Blue Data ✓ *** ✓ *** ✓ *** ✓ ***


VU Storage Finder

You can also use the VU Storage Finder for guidance, but note that the storage finder also includes some storage options that are not recommended for the storage of research data. The reasons for this are explained below. The VU storage finder is still a good resource for information on the technical uses of the various storage options, any costs associated with each and how to request access to a storage option once you’ve made a choice. To use the VU storage guide effectively, first determine your privacy risk categorization (and, if applicable, your confidentiality risk categorization). These privacy/confidentiality risks can be mapped onto the “data classification” levels listed in the VU Storage Finder as follows:

  • Red data = Very high risk
  • Orange data = High risk
  • Yellow data & Green data* = Medium risk
  • Blue data = Low risk


Secure Use of Preferred Storage Solutions

Storage of Very High-Risk Data

If your data are “Red” (a.k.a. “very high risk” according to the privacy risks page), you may require a custom storage solution to be built by IT. This can be an intensive process, so a good first step is investigate how the risks posed by the data can be lowered. Start by contacting the FGB REPS data stewards: they can help you determine if the risks posed by your data can be lowered and if this isn’t possible, they will get you into contact with other experts for additional support.

NB: If “Red” data are stored on a VU storage solution, they will require additional data protection measures. This is discussed further below and the FGB REPS data stewards can also provide guidance on this.


Security Guidance per Storage Solution

Research Drive

Secure use of Research Drive

Research Drive does not have standard approval for the storage of “Red” or “Orange” data. If you want to store “Red” data on Research Drive, contact the FGB REPS data stewards for assistance, as discussed above.

If you are storing “Orange” data (or “Red” data after you’ve spoken to the FGB REPS data stewards) on Research Drive, you will need to encrypt the data at the file level. If file-level data encryption is not feasible for you, contact the FGB REPS data stewards for further assistance.

Regardless of the risk-level of your data, you (and everyone who has access to the Research Drive workspace) are required to activate multi-factor authentication (MFA).


Secure Syncing of Data

If you use Research Drive, you will need to determine your method of accessing the data and whether or not to sync the data to your local hard drive. Most users use the desktop client to access the data. This syncs a copy of the data stored in Research Drive onto your local hard drive. There are additional measures you must apply to keep the locally synced data as secure as possible:

  • If the data are “Red” or “Orange”, you must use your work computer. Do not use your personal device. If your personal device is absolutely your only option for accessing the data, you must:
    • Ensure you are following all of the basic security measures required by the faculty
    • Obtain a hardware-encrypted external hard drive and protect it with a strong password. Any data you need to work with locally must sync to this external hard drive. Once the data on this hard drive are no longer needed, the data must be permanently removed from the external hard drive or the external hard drive must be destroyed.
      • NB: This hard drive must be dedicated to this single research project and must be kept safe and secure at all times. This external hard drive should not be used for any other purpose and it should only be physically transported from one location to another when it is absolutely necessary. The reason for using an encrypted external hard drive when using your personal computer is to partition the “Red” or “Orange” data from all the other data on your personal hard drive and to make it easier to delete later on. The hard-drive is not intended for day-to-day physical transport of the data.
      • If this option is not feasible, contact the FGB REPS data stewards for further guidance.
  • In all cases, always turn off automatic syncing, and instead manage which files and folders sync to your local device.
    • This is especially important if you are syncing files to a personal (private) computer. In that case, you should only sync the data files that absolutely need to be temporarily stored on your personal computer. Once again, if the data are “Red” or “Orange” and you absolutely need to use a personal device, ensure that the files always sync to the dedicated, encrypted external hard drive, as discussed in the previous point.
  • In all cases, always activate Full Disk Encryption on your computer.
  • In all cases, take extra security measures if your computer is a laptop.
  • In all cases, delete the synced files from your local hard drive when you no longer need to access them regularly.


Access Management in Research Drive

Information on how to provide access to data in Research Drive is found in the Digital Data Transfer Guide. It is important to remember that when someone is given access to a folder in Research Drive (or SURFdrive) they have access to all of that folder’s subfolders. Keep this in mind when structuring your folders so that you don’t accidentally give someone access to data or documentation that they should not see.

YODA

Secure Use of YODA

Secure use of YODA is described in detail in the FGB YODA Manual.

SciStor

Secure use of SciStor

SciStor does not have standard approval for the storage of “Red” data. It is approved for the storage or “Orange” data with appropriate precautions. If you want to store “Red” data on SciStor, contact the FGB REPS data stewards for assistance, as discussed above.

If you are storing “Orange” data (or “Red” data after you’ve spoken to the FGB REPS data stewards) on SciStor, inform the IT for Research engineers who will set up your SciStor workspace that your data are high risk (if they are “Orange”) or very high risk (if they are “Red”). This will allow the engineers to ensure appropriate measures are in place. They may determine that a custom solution is needed if the data are very high risk, as discussed above.

Teams/SharePoint

Secure use of Teams

If you have determined (ideally in discussion with an FGB Research Data Steward) that Teams/SharePoint is your only option for research data storage, then ensure that you are using Teams and not OneDrive. They are not the same: data stored in Teams is accessible to an entire research team and will remain accessible even if one team member leaves. OneDrive is linked entirely to you as an individual and when your contract ends, all data in your OneDrive will be deleted. OneDrive and the arguments against using it for research are explained further below.

All of the security guidance described for Research Drive also applies to Teams/SharePoint. The primary difference is that Teams does not use a sync client like Research Drive. If you are working with any non-Microsoft files, start by selecting the option to open these with an applicable app (e.g. RStudio if you are opening an R script). If that is not feasible, the data may need to be downloaded and saved locally. In both cases, all of the same protections on your computer that apply when using Research Drive, also apply to Teams. In short:

  • If you are storing “Orange” data (or “Red” data, if appropriate) on Teams the data must be encrypted.
  • If you need to work with “Red” or “Orange” data locally, you must used your work computer and in all cases when copying data to your computer:
    • Always have Full Disk Encryption active on your computer.
    • Take extra security measures if your computer is a laptop.
    • Delete the locally copied files from your local hard drive when you no longer need to access them regularly.


Access Management in Temas

  • If someone has access to a folder, they have access to all of the subfolders in that folder. Make sure this is appropriate for anyone given access to a folder in Teams, and also ensure that they have appropriate access rights (e.g. read-only vs. full editing rights).

  • Teams makes granting access very easy which means, it’s very easy to accidentally share data with the wrong person. Always check that the access rights are set up correctly before sharing. You should also set an expiration date on any files or folders shared with anyone outside of your Teams “Team”. You can find more information on how to set expiration dates here.

Non-preferred Data Storage Options

There are several other options for storage listed in VU Storage Finder. FGB strongly discourages the use of these other options for the storage of research data.

SURFdrive

SURFdrive is primarily discouraged because the data stored there is linked to you as an individual instead of to your research project like with Research Drive. If you store research data on SURFdrive and then you become unavailable, your colleagues will eventually lose access to the data. In such a case, your colleagues will also be limited in how they can manage access to the data. The use of SURFdrive for the storage of research data is therefore generally discouraged. It can be used to share “Yellow”, “Green” or “Blue” data with students, for example if they are doing an internship under your supervision, but in most cases Research Drive is still preferable to SURFdrive for this purpose. This is discussed further in the Security For Students Guide. You may also use SURFdrive to share data digitally with a research collaborator, but again, Research Drive is preferred over SURFdrive for this purpose. In all cases, SURFdrive should not be used for “Red” or “Orange” data.

Secure Syncing of Data

If you use SURFdrive, you will need to determine your method of accessing the data and whether or not to sync the data to your local device. Most users use the desktop client to access the data. This syncs a copy of the data stored in SURFdrive onto your local hard drive. To keep the locally synced data as secure as possible:

  • Turn off automatic syncing, and instead manage which files and folders sync to your local device.
    • This is especially important if you are syncing files to a personal (private) computer. In that case, you should only sync the data files that absolutely need to be temporarily stored on your personal computer.
  • Activate Full Disk Encryption on your computer.
  • Take extra security measures if your computer is a laptop.
  • Delete the synced files from your local hard drive when you no longer need to access them regularly.


Access Management

Information on how to provide access to data in SURFdrive is found in the Digital Data Transfer Guide. It is important to remember that when someone is given access to a folder in SURFdrive they have access to all of that folder’s subfolders. Keep this in mind when structuring your folders so that you don’t accidentally give someone access to data or documentation that they should not see.

OneDrive

OneDrive is generally discouraged for the storage of research data and related materials because like SURFdrive, it is tied entirely to you as an individual. If something happens to you or you stop working at the VU, all access to the materials stored on your OneDrive will be lost, even if you shared some folders with colleagues. In all cases, OneDrive should not be used for “Red” or “Orange” data. OneDrive should also not be used for storing files managed by git or other version control software, such as your research code. The syncing functionalities of OneDrive do not work well with version control, especially when pushing to remote repositories, such as GitHub.

OSF

OSF is no longer an option for storing data or any related research materials because the service will cease to provide data storage at the start of 2027.

Google Drive VU

The VU Google Drive account is only recommended for collaboration purposes, such as shared work documents or presentations. It should not be used for the storage of research data unless you are certain that the data are “Blue”, and even then, there are better alternatives that allow you more control over your data.

Encrypted Portable Storage

Encrypted portable storage is always a temporary solution. Its primary use is for the physical transport of data from a data collection site.

Storage of Anonymous/Anonymized Data

If your data are “Blue” or anonymous, you can use whichever storage option you wish from the list mentioned in the VU Storage Finder, however YODA, Research Drive and SciStor remain the preferred and recommended options, particularly for research data.

Be aware: very little research data collected at FGB are anonymous and, more often than not, the data cannot be anonymized fully. This is discussed in the Privacy Risks Guide. Even if your data are anonymous there may be confidentiality concerns that require you to choose a more secure storage option. If you believe that your data are “Blue”, you should check with the FGB Privacy Champion to ensure that your assessment is correct.


Additional Tips for Data Storage

  • You will often have several data assets each with its own privacy risk categorization. If you are storing all of these files in one storage location, choose the storage option that protects the data with the highest privacy risk. If a higher-risk data asset can be used to re-identify the research subjects in a lower-risk de-identified dataset (e.g. a key file (higher-risk) that can identify subjects in your pseudonymized questionnaires(lower-risk)) you should:
    • Store the higher risk data in a separate storage location from the lower risk data, or
    • If the higher risk data must be stored in the same location as the lower risk data, encrypt the higher risk dataset. Also store the higher risk data in a folder that is separate from the other lower-risk data and ensure that this folder can only be accessed by those who absolutely need to view the higher-risk data.
  • Make use of data de-identification methods to lower the privacy risks of your processed data. Your raw data will probably still need to be stored at a higher level of security, but if you lower the privacy risks of your processed data by de-identifying it, you will have more storage options for the processed data.


Data Clean-up at the End of Research

When you have completed your active research, you must archive your data and remove the data from the storage solution(s) you have been using. The only exception is if you are using YODA for active data storage: when it is time to archive your data, move the data from active YODA storage to the YODA vault.

To help you clean-up your data effectively at the end of your research, review the RDM Offboarding Guide. Additionally, if you were using YODA or Research Drive for active data storage, use this form to request that the data be deleted. Make sure you’ve archived your data first!!!!