Sensitive-data repository

A sensitive-data repository is a repository purpose-built to hold sensitive research data — typically identifiable or re-identifiable human-subjects data, health data, criminal-justice data, commercially confidential data, or culturally sensitive Indigenous data — using controlled-access deposit rather than open download. Access to a specific dataset normally requires an application, an ethics/data-access-committee review, and a signed data use agreement, with audit logging of who accessed what and when.

Two distinct control models — and why this term is not the same as “data safe haven”

It is worth being precise about a real, easily blurred distinction. A sensitive-data repository, in the sense used here, is fundamentally a controlled-access deposit and retrieval model: an approved researcher applies for access and, once approved, typically downloads the requested files under the terms of the data use agreement — the repository’s job is gatekeeping who gets a copy, and of what, not preventing the data from ever leaving. A data safe haven (near-synonymous internationally with a trusted research environment) is a different, stricter control model built around the Five Safes framework, where the data structurally never leaves a controlled analysis environment at all — the researcher’s analysis code goes to the data, not the reverse, and only disclosure-checked outputs are released. In practice these models are often combined (a sensitive-data repository may require analysis to happen inside an attached secure environment rather than permitting bulk download), but they are answering different questions and a page or policy that uses the two terms interchangeably is eliding a real operational difference researchers need to plan around.

Real examples

The European Genome-phenome Archive (EGA) holds consented human-subject genomic and phenotypic data under a controlled-access application model. dbGaP, operated by NCBI, holds sensitive genotype-phenotype data under a comparable application-and-approval process, with data made available to approved investigators at approved institutions. Both are commonly cited alongside safe-haven-style national health-data services (see the data safe haven entry for examples of that model specifically), and a single national data ecosystem may operate both a controlled-access repository and a safe haven side by side for different data-sensitivity tiers.

Worked example / counter-example

A consortium depositing consented rare-disease genomic data in EGA, with each approved external researcher signing a data use agreement before download, is a sensitive-data repository in operation. An open repository such as Zenodo, with no access-approval step, is not a sensitive-data repository regardless of what is deposited in it — and a clinical electronic health-record system used only for direct patient care, with no research-access governance layer at all, is not a research-purpose sensitive-data repository either.

References

• Lappalainen, I. et al., “The European Genome-phenome Archive of human data consented for biomedical research,” Nature Genetics 47(7), 2015.