Examples
Worked examples
- Is an instance
A DMP recording pseudonymised special-category health data under GDPR Article 9(2)(j) with deposit only in a controlled-access repository.
- Is an instance
A DMP committing to indigenous data governance via co-authored sharing protocols with community partners.
Counter-examples
Looks similar, but isn't
- Not an instance
A blanket statement 'no sensitive data involved' on a project that collects identifiable interview transcripts.
- Not an instance
A general security policy of the institution copied verbatim.
Editorial commentary
Sensitive-data handling in a data management plan (DMP) is the section documenting how personal, confidential, or culturally sensitive data generated or used by a project will be classified, secured, and governed across the research lifecycle — from collection, through storage and analysis, to sharing, retention, and eventual disposal or archiving. It is where a DMP moves from describing data generally to specifying concrete controls for the subset of data that carries privacy, confidentiality, or cultural-governance risk.
Structure and standard elements
In machine-actionable DMPs (maDMPs), this content typically sits in the “security_and_privacy” entity of the RDA Common Standard, using controlled vocabularies for data category and legal basis rather than free text, which is what allows the statement to be checked programmatically by an institution or funder. Common elements include: the data category (e.g., special-category personal data, commercially confidential data, culturally sensitive data); the legal or ethical basis for processing it; the anonymisation or pseudonymisation approach, if any; access controls and storage location; and retention and disposal timelines.
Legal and governance cross-references
Where the GDPR applies, this section should cross-reference the project’s Data Protection Impact Assessment (DPIA) and state the lawful basis relied on for processing special-category personal data under GDPR Article 9, rather than restating the analysis inline. For research involving Indigenous data, the CARE Principles for Indigenous Data Governance frame the commitments that belong here — Collective Benefit, Authority to Control, Responsibility, and Ethics — in addition to, not instead of, whatever applicable data-protection law requires; see also community-controlled research and Indigenous community review for the governance processes that typically inform what this section commits to.
In practice
A weak sensitive-data section restates general principles (“data will be kept secure”) without naming a concrete legal basis, storage control, or retention period; a strong one is specific enough that an ethics reviewer, data protection officer, or Indigenous governance body could check the commitment against what actually happens. The resulting commitments should be consistent with, and are typically summarised by, the project’s later data availability statement at publication.
References
- GDPR (EU 2016/679); CARE Principles for Indigenous Data Governance (GIDA, 2019); UK Anonymisation Network Anonymisation Decision-Making Framework.
Also known as
DMP sensitive data section · DMP privacy and security
Machine-readable encodings
Use in your systems
<role vocab="credit"
vocab-identifier="https://casrai.org/dictionary/"
vocab-term="Sensitive-data handling (in DMP)"
vocab-term-identifier="https://casrai.org/dictionary/term/sensitive-data-handling-in-dmp" />{
"@context": "https://schema.org",
"@type": "DefinedTerm",
"@id": "https://casrai.org/dictionary/term/sensitive-data-handling-in-dmp",
"name": "Sensitive-data handling (in DMP)",
"identifier": "https://casrai.org/dictionary/term/sensitive-data-handling-in-dmp",
"description": "Sensitive-data handling in a data management plan is the section documenting how personal, confidential, or culturally sensitive data will be classified, secured, and governed across the research lifecycle, including its legal basis and any Indigenous data governance commitments.",
"inDefinedTermSet": "https://casrai.org/dictionary/domain/machine-actionable-dmps#set",
"url": "https://casrai.org/dictionary/term/sensitive-data-handling-in-dmp",
"sameAs": [
"DMP sensitive data section",
"DMP privacy and security"
],
"license": "https://creativecommons.org/licenses/by/4.0/",
"publisher": {
"@id": "https://casrai.org/#organization"
},
"author": {
"@id": "https://casrai.org/#editorial-team"
},
"datePublished": "2026-05-21T02:22:49",
"dateModified": "2026-08-22T15:51:32",
"inLanguage": "en-GB",
"isAccessibleForFree": true
}
