Data management planning

Start creating your DMP by providing background information on your research project. On this page, you can also add the project’s research plan as an attachment to the DMP. Research plan makes the commenting on the DMP easier, as the research plan may contain information crucial to the project's data management that has not been mentioned in the DMP. While Data Support aims to help researchers identify issues relevant to research risk management, the ultimate responsibility for identifying risks in their own field lies with the researchers themselves.

The research project uses or produces research data or material

In the vast majority of research projects, some form of research data is used or generated. In this context, 'data' refers to any material or information on which the analyses and results of the research are based. Sometimes, however, research can be entirely theoretical, such as the development of mathematical models, theories or proofs, or research in formal logic. In these cases, it is not necessary to prepare a data management plan. However, it is more common for research to involve data management. 

In order to continue filling out the form, you must select either 'Yes' or 'Not sure' for this question. If you select 'No', a text field will appear on the form asking you to explain why it is not necessary to create a data management plan. 

This section describes how the integrity and accuracy of the research data will be ensured. Data integrity and accuracy refer to the various methods used to manage risks related to data quality. Depending on the research context, ensuring the integrity and accuracy of research data may mean that the data has remained unchanged and traceable throughout its lifecycle, is free from errors and can be relied upon to produce accurate results. Paying attention to the consistency and quality of the data ensures that it serves the research in the best possible way.

The integrity and accuracy of the project's research data are ensured in the following ways

The data management plan template outlines the most common methods of ensuring the integrity and accuracy of research data. Select the options that are relevant and necessary for your research. In the open text field, you can describe your data quality assurance practices in more detail and make notes for yourself. 

• Using standardised data collection methods and protocols. Depending on the field of study, these can involve a variety of different approaches with which one should familiarise oneself before beginning data collection. When preparing to collect interview data, for example, one must determine which tool is recommended for data collection, which file format is most suitable for the purpose and which data collection method provides adequate security.
• Documenting data collection and processing stages. In research, this involves systematically recording the stages of data collection, pre-processing, cleaning, editing and analysis, as well as the methods, tools and parameters used and the decisions made. This makes the process transparent, reproducible and evaluable.
• Organising data files and folders systematically. Consistent file-naming conventions and an easy-to-navigate folder structure benefit any research project. This is especially important in research groups, where members need to collaborate on the same files and folders.
• Backing up the data. Backing up the data involves copying files to a separate location so that they can be restored in the event of damage, an error or hardware failure. For example, the University of Helsinki’s home and group directories include automatic backup.
• Using data or code version control. Version control enables a previous version of a file to be restored within a specified time window. It is recommended that research data is stored in a location with automatic version control, such as the University of Helsinki's home or group directories, or Umpio and GitLab.
• Monitoring data quality during data collection by using quality indicators and metrics. Project-specific quality indicators may include response rate, number of measurement errors, proportion of missing observations, variation in repeat measurements, signal-to-noise ratio and how frequently these indicators are monitored. Monitoring tables and automatic checks can be used to track whether threshold values are exceeded.
• Reporting discrepancies. Depending on the project, a discrepancy may refer to a hardware error, protocol violation, security breach or missing data. Consistently recorded anomalies can be referenced during the data analysis phase.
• Cross-checking the results with colleagues. For example, if a researcher transcribes interview data themselves, they should ask a colleague to review the transcripts. The same applies to other self-generated data that is prone to human error.
• Reviewing the data files before analysis or publishing (e.g., missing values, range of expected values). A systematic review of the data is important to ensure that the study’s analyses are as reliable as possible, so it is important to set aside sufficient time for this. If the dataset is large, the review process should be planned carefully.
• Using checksum functions to ensure integrity of the data during storage and after transfer. A checksum based on a mathematical algorithm can be used to determine whether changes have occurred in a file at the bit level.
• Educating researchers about data quality practices relevant to the project. Researchers are responsible for familiarising themselves with the research data management guidelines and keeping their skills up to date. The research project leader must also ensure that other researchers have the opportunity to develop their skills. This can be achieved by participating in and utilising the support services offered by Data Support, for example.
• At this stage of the research, methods for ensuring the integrity and accuracy of the research data have not yet been agreed upon. At the start of a research project, many questions might remain unanswered. Once it becomes clear what kind of data the research will be analysing, the accuracy and integrity of the data can be examined more closely.

Ethical and legal issues related to your data management should be addressed early, as they may require significant time. These may include e.g., ethical review, cross‑organisational collaboration practices (especially outside the EU), drafting a privacy documents for personal data, and obtaining required research permits. 

The data management plan template lists a number of options relating to compliance with ethical principles and legislation. There is no need to be confused if many of them are not relevant to your own research. 

Please note that creating a data management plan is also an effective way of managing and preparing for legal and ethical risks. The plan can serve as documentation of how these issues have been addressed.

The following legal and ethical issues are to be considered in project's research data management

•  Agreeing on access rights, publication, archiving, and destruction of datasets among the participating researchers. If multiple researchers are collaborating, it’s advisable to discuss and agree on how the data will be handled to avoid misunderstandings. You can use this  for that purpose.
• Ethical review of research. If needed, an ethical review should always be conducted prior to launching a study. The University of Helsinki has four committees that carry out ethical reviews: 1) Research Ethics Committee in the Humanities and Social and Behavioural Sciences; 2) Research Ethics Committee of the Faculty of Medicine; 3) Research Ethics Committee on Animal Research; 4) Research Ethics Committee in the Natural, Biological and Environmental Sciences and Engineering. In medical research, the researcher must request a statutory statement from the ethics committee of wellbeing services county or from the National Committee on Medical Research Ethics. See more information on ethical review .
• Research secrets. Examples of research secrets include unpublished results and hypotheses, unique methods and algorithms, details of experimental setups, inventions intended for patenting and contractually protected information regarding corporate collaborations. Also included are data that is not anonymised, data that can be re-identified due to its rarity and data collection sites or strategies whose disclosure would endanger the research or participants' protection.
• Trade secrets and patents. Research may involve confidential or financially valuable information belonging to companies. It may also result in inventions or ideas with commercial value, in which case they should be patented or protected in some other way. You can find more information about commercialising research on .
• Permits and obligations (e.g., research permits). For example, a research permit may be required if the research involves an organisation’s premises, operations, personnel or materials (e.g. the University of Helsinki’s Training Schools). Similarly, a data access permit may be required if the research uses registry or patient data, or other protected data (e.g. Findata).
• The data used in the research requires the acceptance of the terms of use defined by the original producer. If you are using data collected or managed by another party, find out what conditions apply to its use.
• The data used in the research are subject to copyright owned by other organisations or individuals. For instance, the research data may comprise works created by third parties or licensed content. Additionally, copyrighted material may be produced during the collection of data (e.g. if the researcher takes photos as part of the research process). For more information on copyright and licences, please visit the .
• The use of artificial intelligence is a significant part of the research. If artificial intelligence is used extensively or experimentally, the research raises a wide range of ethical issues. Some research designs utilising AI may also require prior ethical review, for example if data is combined in ways whose consequences cannot be predicted. It is important to document how AI has been utilised in the research processes, as the principles of good scientific practice also apply to more conventional uses of AI in research (e.g. text processing).
• Animal experiments. The ethical issues surrounding the use of laboratory animals relate to various factors, including whether the animals in question are vertebrates or cephalopods. The Act on the Protection of Animals Used for Scientific or Educational Purposes determines whether ethical approval is required for research projects.
• Information regarding protected species and habitats. Precise distribution data for some animal and plant species found in Finland must be generalized or withheld entirely. Finnish Biodiversity Information Facility maintains a list of sensitive species data. In the list, you will find species for which the availability of occurrence data must be restricted, along with the appropriate level of confidentiality. You can find the list in the .
• Information regarding national security and emergency supply. This may include details of critical infrastructure vulnerabilities and locations, information security architecture vulnerabilities, government contingency plans, biosecurity and strategic supply chains.
• Information that can be used for dual-use items and technology. Dual-use items and technology are information, products, and technologies that can be used not only for research but also for military purposes.
• Multinational cooperation. A research collaboration agreement is always required for research collaboration across organisational boundaries. In multinational and cross-border EU cooperation, particular attention must be paid to issues such as data ownership and the need for agreements to transfer data or materials. Further information on agreements is available on . 

The research uses data originating from humans

If your research involves data originating from humans, select the 'Yes' option to view additional questions. Data originating from humans might be, for example survey and interview data; observation data; biological samples and data derived from them (e.g. genomics and proteomics); health and patient data; register and administrative data; measurement data collected with the help of sensors and other equipment (e.g. with from wearable devices); behavioural and usage data (e.g. from online services); image, audio and video material; and location and background information. 

Please note that you may also process personal information as supplementary material for your research (e.g. people visible in wildlife camera traps or the contact details of pet owners). If you are unsure whether you are processing personal data, you can take the . 

The information originating from humans in the research data is (select all that apply to you data)

•  Information belonging to special categories of personal data or otherwise sensitive information. Under the EU General Data Protection Regulation (GDPR), special categories of personal data include information revealing: racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; health data; sexual orientation or behaviour; genetic and biometric data when the purpose is to identify a person using them. In addition, information such as criminal convictions and details of criminal activity, or personal diary entries, may be sensitive. You can find more information about the processing of special categories of personal data on the .
• At some stage of the research project the data is identifiable, i.e., contains information by which a person can be identified. If you are collecting or processing personal data, select this option. You should select this option even if you intend to anonymise or pseudonymise the data, since these measures do not change the fact that the data was identifiable at some stage of the research project.
• Pre-pseudonymised data (strong direct identifiers have been removed and replaced with a code). Data is considered pseudonymised if an individual cannot be identified without additional information that is stored separately. Either a third party has pseudonymised the data and manages the raw data containing direct personal identifiers and the pseudonymisation key codes, or the data has been pseudonymised in a previous research project. Please note that pseudonymised data is still personal data and must be handled in accordance with the requirements of the General Data Protection Regulation (GDPR). Do not share the data publicly or store it in an inappropriate location. For more information on identifiability, please visit the .
• Only anonymous data, or information that cannot be connected to a specific individual by anyone (no identifiable information is collected at any stage of the project). Data is defined as anonymous if a person cannot be identified by reasonable means through the combination of identifiers. Note that merely refraining from collecting direct identifiers such as names or social security numbers does not necessarily render data anonymous. For more information on identifiability, please visit the .

• Data originating from deceased persons. Data originating from deceased persons. While the EU General Data Protection Regulation does not, in principle, apply to deceased persons, consider whether processing personal data could significantly impact the deceased's living relatives. Note also the Act on the Medical Use of Human Organs, Tissues and Cells, and the Act on the Secondary Use of Health and Social Data, neither of which lapses upon a person’s death. 

   

Since the research uses personal data originating from humans, the following documents will be prepared or the following measures taken

When you select any of these options, a question about preparing a privacy notice and other privacy documents will appear in the 'Data management responsibilities and resources' section of the form. 

• Privacy notice. The purpose of the privacy notice is to provide research participants with information about how their personal data will be processed in the study. You can find the University of Helsinki’s privacy notice template on .
• Informing research participants. The research subject must receive sufficient information about the study and their rights as a participant before taking part in the research. You can find the University of Helsinki’s template information sheet on .
• Self-assessment form for Data Protection Impact Assessment (DPIA). The purpose of the form is to determine whether a data protection impact assessment required by legislation is necessary for the research project. You can find the form on .
• Data Protection Impact Assessment (DPIA). A Data Protection Impact Assessment must be conducted if processing personal data poses a high risk to the rights and freedoms of data subjects. You can find the form for preparing the impact assessment on .
• Ethical review of research on humans. University of Helsinki has two committees reviewing the ethics of research on humans: the Research Ethics Committee in the Humanities and Social and Behavioural Sciences and the Research Ethics Committee of the Faculty of Medicine. More information on ethical review of research on humans is available on the . 

Legal Services assist UH employees in data protection issues related to research. Please explore for answers to general questions about data protection before contacting the lawyers at .

It is important to make all the necessary agreements at the very beginning of a research project. This is particularly crucial in projects involving multiple data rights holders, cross-organisational research collaboration or situations where data is to be transferred to another organisation. Additionally, care must be taken regarding the terms under which material owned or managed by another party may be used. 

Contact the university's legal counsellors () before drafting an agreement with your partners. Allow plenty of time for handling agreement matters. Ensure that all essential agreements are in place before you begin collecting data. 

See more information on .

The right of use of the research data produced in the project will be agreed as follows: 

• Everyone conducting research in the project will be required to provide an undertaking on the transfer of rights. Since the beginning of 2022, a general undertaking on the transfer of rights has been included as an appendix in all the University’s employment contracts. In addition to the general undertaking on the transfer of rights, a project-specific undertaking on the transfer of rights is used for researchers who are not employed by the University (e.g., many doctoral researchers, or visiting scholars). An undertaking on the transfer of rights is a document with which the researcher transfers rights related to the results of their research to the University and undertakes to keep secret any confidential information of the University and its partners that was obtained in connection with the research. An undertaking on the transfer of rights is required to ensure the University can fulfil its obligations to its partners and external research funders. This applies also to projects involving a single researcher. Many research funders (including the Research Council of Finland) require providing an undertaking on the transfer of rights.
• The authorship of the data, its retention, or its openness will be agreed on using the template provided by the university. The research group should plan how to utilise the research data at the very beginning of the project. For example, disagreements regarding data ownership and storage can be difficult to resolve if the matter has only been discussed informally. The provided by the university helps the group to consider its practices.
• At this stage of the research project, it has not yet been decided how the rights of use of the research data will be agreed among the researchers. If it is not yet time to agree on guidelines for using the research data, this can be considered at a later date. In the meantime, you can contact Data Support for advice. 

The project will transfer research data or material to another party

Ticking ‘Yes’ or ‘Not yet determined’ will open a box where you can provide more details about your plans. In this context, 'other party' refers to any entity outside the University of Helsinki, such as a researcher at another university, Helsinki University Hospital, a data repository or an archive. Transferring both digital data and physical research materials will likely require agreements to be drafted. Particular care must be taken if data or materials are transferred outside the EU. 

The project will use research data or material obtained from another party:

Ticking ‘Yes’ or ‘Not yet determined’ will open a box where you can provide more details about your plans. In this context, 'other party' refers to any entity outside the University of Helsinki, such as a researcher at another university, Helsinki University Hospital, a data repository or an archive. It is the other party that determines the terms under which you may use the data. 

Since the research project will transfer or obtain data/material outside the University of Helsinki, the following actions will be taken

• All the necessary agreements will be made following the instructions and by the help of University of Helsinki lawyers. Examples of common agreements include non-disclosure agreements, material transfer agreements, research collaboration agreements, and agreements on the processing of personal data. The provides guidance on coordinating the agreement process and on which templates must be reviewed by Legal Services.
• The terms of use of the service/material to be used will be accepted. Please read the terms of use carefully to ensure that you do not inadvertently violate them. For example, check whether the terms apply only to you or to other members of the research project as well.
• A research permit will be applied for to obtain the data. The following situations may require a research or data permit: 1) use of registers held by social and health authorities (e.g. Findata); 2) data from other authorities (e.g. individual-level data from Statistics Finland, Kela, the Tax Administration or the Finnish Centre for Pensions that is not publicly available); 3) research within an organisation (e.g. a school, day care centre or educational institution); 4) internal company research (e.g. research targeting company staff, customers or internal confidential documents); 5) archival materials that are confidential under the Act on the Openness of Government Activities (e.g. the National Archives or municipal archives); 6) animal experiments (a statutory permit is granted by the Project Authorisation Board); 7) nature conservation areas (permission to collect samples or take measurements must be sought from organisations such as Metsähallitus or the regional ELY Centre); 8) clinical drug trials (in addition to official authorisation, a prior ethical review is required).
• The data will be transferred by depositing it in a repository and licensing it appropriately. Depositing data in a repository is also a form of data transfer. Therefore, ensure that the repository and the terms of use are suitable for the data's requirements and level of confidentiality. For instance, pseudonymised data cannot be made available to everyone, but it can be stored in a restricted archive with limited terms of use. Consider what terms of use are appropriate for the different datasets in your research project. While the University of Helsinki recommends the most open possible licence for research data, in some cases a more restricted licence may be necessary. You can read more about copyright and licences on the . 

Legal Services assist UH employees in research-related agreement issues. Please explore  for answers to general questions about agreements before contacting the lawyers at .

Well-documented research data and metadata ensure that the data is understandable and usable during and after the research process. Thorough documentation acts as a user guide for the data, making the research transparent and reproducible. It answers key questions such as who collected the data, when and where it was collected, and what methods were used. It also provides a detailed description of how the data was processed. This may include information on variable naming, reclassifications, handling missing values or combining different datasets, for example. Documentation may also cover details of the experimental design, hardware and software versions used, and analysis steps. 

Thorough documentation primarily benefits the researcher by making it easy to revisit the data later without having to remember every detail. It is also essential if the data is to be shared with other researchers, since without a clear description, the data will often appear as nothing more than a meaningless string of numbers or a fragment of text.  

Please note that even if the data itself cannot be shared with others — for example, due to its sensitive nature — it is usually possible to publish the metadata associated with the data, such as information on the methods used for data collection and/or analysis (e.g. an interview guide). Therefore, it is worth carefully documenting the data, even if you do not intend to share it and plan to dispose of it once the research project is complete. The metadata, or descriptive information, for the data can be published in . 

Documentation practices vary by discipline and project needs. The list below presents some common methods.

The research project will use the following data documentation practices

• Naming files and file folders in a systematic manner. Consistent practices facilitate the smooth running of a research project. Clear, machine-readable names are recommended (e.g. ProjectX_Interviews_RawData_2026-12-31_v01). Avoid using special characters or spaces; use underscores or hyphens instead.
• Marking different versions. Systematically numbering files (e.g. v01, v02, v03) helps you to keep track of the latest version. If necessary, you can record the date of the change and a brief changelog in a separate file or at the beginning of the file itself. Old versions can be archived in a clearly labelled folder or deleted if they are no longer needed.
• Creating a README file. A README file is a free-form text file that describes the content, purpose and usage instructions of the research data. While a README file is useful for the researcher, it is particularly important when the data is made publicly available or shared with others.
• Describing and recording variables and their abbreviations. You can use, for example, a data dictionary to describe variables and abbreviations. A data dictionary is a kind of table of contents that is used to ensure data quality and consistency across systems.
• Documentation of the codes and algorithms used. For this purpose, you can use a codebook, which explains the meanings of variable names, codes and classifications, for example. A codebook is a type of user guide that ensures all researchers understand and handle the data consistently.
• Documentation of the research and analysis methods used. This supports the scientific quality of the study and enables the reader or reviewer to understand the methodological choices made. You can, for example, describe how, where and when the data was collected, the sampling criteria used, and the measures, instruments or software employed.
• Documentation of how artificial intelligence is used at different stages of the research project. The fundamental principles of good scientific practice are reliability, integrity, respect and accountability. Transparent documentation of the use of AI is part of good scientific practice. Research projects should record 1) which stages of the research process AI was used for (e.g. data collection, cleaning, analysis, interpretation of results and writing), which tools and models were used (including name, version and provider), the settings and inputs used, and 2) whether new data or derivatives were generated using AI. If new data or derivatives were generated using AI, documentation should also cover how quality control was performed and how any potential biases or limitations were addressed. If the AI service transmits data externally, it is advisable to document the relevant data protection measures, terms of use and permissions.
• At this stage of the research, guidelines or practices for documenting data have not yet been agreed upon. Many questions might remain unanswered at the outset of the research project. Data documentation practices can be considered in greater detail once it is clear what kind of data the study will involve. 

Data Support assists UH researchers in planning the guidelines and practices for documenting data. You can submit a request for assistance at the end of the form. See also the .

Storage solutions used during a research project are selected based on the specific needs and requirements associated with the research data. When choosing a storage solution, it is important to consider factors such as the size and sensitivity of the data, the backup and versioning capabilities offered, whether collaboration is required, and the potential cost.  

During a research project, multiple storage solutions may be used. For example, the raw data containing sensitive information can be stored separately from the pseudonymised version, to streamline active processing. 

You can find more information about storage services and how to use the services listed in the data management template on the . The provides an overview of the storage solutions offered or supported by the university. It also specifies which services can be used to store sensitive data.

The total size of the data managed and stored by the research project

• Less than 100 GB (easily fits on a laptop). Select this option if your research data consists of, for example, standard text files, documents, and a moderate number of images or videos. The typical internal storage capacity of smartphones is 128 GB.
• 100-500 GB (fits on university network drives or a laptop). For example, 500 GB of storage space can hold several hundred short, relatively high-quality videos.
• More than 500 GB, but less than 5 TB (such large amounts are often difficult to transfer). For instance, a behavioural study involving multiple sessions and conducted using a multi-camera system and high-resolution 3D brain imaging will likely generate 1–5 TB of data over the course of several hours. Transferring such large amounts of data requires careful planning.
• More than 5 TB (often requires tailored IT solutions). Please contact the if you estimate that your data will be several terabytes in size.
• Difficult to estimate at this point of the project. If the research project has only just begun, it may be hard to predict how big the dataset will be. However, it is important to be aware that the size of the dataset affects where it can be processed and stored. 

The following solutions are used to store the research data in the project

• Personal directories (Z drive, includes automatic versioning and backup). All university members have access to their personal home directory, also known as the Z drive, at the University of Helsinki. This directory has 100 GB of storage space allocated to it and can be used to store low- and medium-risk data, such as personal information that is not sensitive. You can access your home directory from a university workstation or your home computer; however, the latter option requires a VPN connection. Read more about accessing your home directory remotely from a or .
•  Group disk spaces (P drive, includes automatic versioning and backup). Otherwise comparable to a home directory, group storage offers significantly more space (up to 10 TB) and allows access rights to be granted to multiple users via IAM groups. Therefore, group storage is ideal for internal collaboration at the University of Helsinki. The group directory can be accessed from work or . University of Helsinki staff members can request storage space for their group using the order form in the .
• Centralised storage solutions of the department (e.g. L drive, remember to check if backup is included). The university's departments have purchased various customised storage solutions, some of which offer several terabytes of storage space. However, these solutions may not necessarily be backed up, so be sure to verify this with the person granting you access.
• Umpio (for sensitive data). Umpio is a secure network folder designed for storing high-risk sensitive data, such as special categories of personal data, trade secrets and authoritative information with categorised protection level. If leaking the data to the wrong people would cause significant harm to research subjects, researchers, or the university’s reputation, Umpio is likely to be the most suitable option. Read more about Umpio and how to subscribe to the service on the .
• Services by CSC - IT Center for Science (IDA, Allas, sensitive data services, etc.). CSC’s services are particularly well-suited to high-performance computing and situations where data needs to be shared with external partners (e.g. researchers at other universities). You can learn more about CSC’s services in the .
• Microsoft OneDrive / Microsoft Teams (these do not include backup, so take care of regular backups yourself). OneDrive and Teams are suitable for light collaboration, but they are not backed up. Furthermore, you should not store sensitive or confidential material (e.g. research secrets) in these services, as the security level is not sufficient for handling such data.
• Other. If you are using a storage solution that is not listed above, please describe it here. Please note that your home computer's hard drive, external hard drives and USB flash drives may fail or become corrupted. If you need to back up your data to an external hard drive (for example, if you are collecting data in a location without a network connection), make sure you encrypt the hard drive. 

Special solutions for storing and processing data

The name of the service used as a collaboration platform, (e.g. Microsoft Teams, XWiki, eDuuni)

Services like Microsoft Teams and XWiki are great for teamwork, but they're not suitable for handling sensitive information. 

The name of the service used for the data transfer

In this context, transferring data refers to giving data to partners in other organisations or to a third party that analyses or processes the data as part of collaboration or a paid service. For example, you can use or reliable cloud services (provided the data does not contain sensitive or personal information), or the for sensitive data. You can also make the data openly accessible in a data repository, which allows you to share the data with others via the repository. For more details on making data openly accessible, see the template’s section 'Opening, publishing and archiving of data after the research project has ended'. 

The name of the service used for the computing services

The University of Helsinki provides support for using HPC systems. Find out more about computing clusters on the and take a look at the high-performance computing services provided by . 

The name of the service used as the secure processing environment (e.g. FIMM/FinnGen Sandbox, Kapseli, Fiona, SD Desktop)

Processing environment refers to a secure remote access environment for registry data and databases, within which the data can be viewed and analysed, but typically the original data cannot be exported from the environment. 

Other services used for data processing (please specify the purpose for which the service is used)

If you process your data using a service that is not listed above, please indicate this here. 

Sensitive parts of the project's research data are protected in the following ways

• The project will not use any sensitive material. Research data is unlikely to be considered sensitive if it does not pose a significant risk to the privacy or rights of the participants. Such data will neither contain information relating to special categories of personal data, trade secrets, national security or protected environments.
• Identifiable material is stored in a service intended for sensitive material (Umpio, ePouta, etc.). Ensure the secure lifecycle of your data by determining, even before acquiring the data, how you will transfer it to a service intended for sensitive data (e.g., tools suitable for collecting sensitive data, secure data transfer).
• Only encrypted data is transferred. Encryption involves converting data into a ciphered format that can only be restored to a readable format using the correct key. You can encrypt attachments, hard drives and files, for example. You can use software such as for this purpose.
• Paper materials are stored in a lockable metal cabinet or safe. Sensitive paper documents should be stored in a locked cabinet located in a locked office. Also consider who has access to the documents.
• The data is stored in a different location to the pseudonymisation key. To ensure that pseudonymisation is carried out with sufficient data security, the pseudonymisation keys and the pseudonymised data must be stored in separate locations. For example, the pseudonymisation keys and the raw data could be stored in Umpio, while the pseudonymised data could be stored in the researcher’s home directory (Z drive).
• The calculation/analysis is only performed on pseudonymised data. Pseudonymisation reduces the identifiability of the research subjects by replacing direct and combinable indirect identifiers with codes or other identifiers that are stored separately from the actual research data. This mitigates the risks associated with processing personal data and helps to ensure compliance with the General Data Protection Regulation, despite the fact that the data remains personal.
• The calculation/analysis is performed in a service intended for sensitive, identifiable material. The calculation/analysis is performed in a service designed for sensitive and identifiable data. Ensure that sensitive data is processed in an appropriate service. Umpio, for example, can be used to analyse many types of high-risk data, but individual-level data obtained through a data permit should be processed in the provided by Findata rather than in Umpio.
• Data will be collected and processed only using tools suitable for sensitive data (REDCap, aTrain). Ensure that the data is handled securely throughout its entire lifecycle. For example, interview data should be collected using a voice recorder or video camera that is not connected to the internet instead of a smartphone, and transferred to a secure storage service as soon as possible. Keep in mind , which is a secure tool for building surveys and databases as well as collecting data (note that, for example, E-lomake and Webropol are not suitable for collecting sensitive or confidential data). aTrain, on the other hand, is a free AI application developed for transcribing audio files (i.e., speech recognition) based on Whisper. The service is suitable for the automatic transcription of sensitive data and is available in Umpio. 

Who will be responsible for controlling access to data

The rights to access the research material used in the project are granted by

• Principal investigator. The PI should ensure that only authorised individuals have access to the data. For example, raw data containing sensitive personal information should only be handled by the individuals listed in the privacy statement.
• Data manager. The data manager's responsibilities may include granting access to research data to the appropriate individuals.
• Person who produced the data. A research project may involve the collection of several different datasets, in which case an appropriate division of labor might be for each researcher to be responsible for granting access to the data under their purview. 

 assist UH researchers in finding the right IT solutions. If you need assistance, please email You can also submit a request for assistance at the end of the form.

Research data can be made openly available, archived with restricted access terms or securely destroyed. It is advisable to plan the opening, publishing, and archiving of research data carefully from the outset. This ensures that the data is handled responsibly, and its value is utilised to the fullest extent possible. 

The aim of making data accessible is to encourage its reuse and enable it to form the basis of new research. However, not all data can be made open due to concerns such as privacy, trade secrets or other confidential information. Even if the data itself cannot be made open, the principle of openness can still be promoted through other means. For example, the data could be archived in a reliable service with restricted access rights. At a minimum, the metadata (i.e. descriptive information answering the questions 'what', 'why', 'how' and 'when') should always be published. Open metadata makes research and data discoverable, even if the data itself is protected. 

In order to make the data publicly available and archived, the researcher must plan and communicate this properly in the privacy notice, information provided to research participants, and consent forms. It is also important to ensure that agreements regarding the storage and future use of the data have been made with any potential partners.

Key terms

In this context, 'opening' refers to the technical accessibility of data, whereas 'publishing' involves making the data citable as a research output through the use of a permanent identifier. 'Archiving' focuses on the long-term, reliable preservation of data to ensure its integrity, regardless of whether it is open.

Regarding the opening and archiving of the project's data, the following actions will be taken

• Data will be opened, stored for the verification period, and/or archived. Select this option if you do not intend to destroy all the data generated by your research project. You will then be asked additional questions about the datasets to be opened, stored and archived in your research project. Please note that storing data for longer periods, for example in a group disk space, is not the same as archiving it.

• The metadata for the project's data will be made available in the University of Helsinki Data catalogue. If you cannot open, store, or archive your data, please publish the metadata for your research data at least. If you deposit your data in Zenodo, the Finnish Social Science Data Archive (Tietoarkisto), the Language Bank of Finland, or University of Helsinki Data Archive and list the University of Helsinki as your affiliation, the metadata will be automatically harvested into Data Catalogue. If you use a different service to make your data available or archive it, please also describe your data in Data Catalogue to increase the visibility of your research.

   

The following datasets are planned to be opened, stored for the verification, and archived in this research project (add as many as you want)

In this context, a dataset refers to any organised collection of data intended for opening and/or archiving. A single research project can produce several distinct datasets that differ from one another in terms of content, format and sensitivity. For instance, a study examining the impact of an urban park on residents' well-being might generate the following datasets: 1) Anonymised survey data made available in a suitable data repository (e.g. or ); 2) Audio files and transcripts of sensitive in-depth interviews destroyed and/or stored in a restricted-access archive (e.g. ); 3) Anonymised GPS data made available in a repository suitable for geospatial data (e.g. or ). 

Dataset name and brief description

Give the dataset you are opening and/or archiving a simple, descriptive name. Include a brief description of the research or topic for which the data was collected. For example: 

Dataset name: Well-being survey data for residents of the area surrounding Central Park, Helsinki, 2027 

Brief description: This dataset contains anonymised responses to a survey conducted as part of a study on the effects of Helsinki’s Central Park on the well-being of residents in the surrounding area. Data will be collected in May–June 2027, including variables describing respondents' demographic background (age group and education level), frequency of park use, perceived stress levels and overall quality of life. The data is in CSV format, and the package includes a separate file with more detailed explanations of the variables. 

Read more about the metadata description on the . 

The size of the dataset 

• Less than 100 GB (easily fits on a laptop). Select this option if your research data consists of, for example, standard text files, documents, and a moderate number of images or videos. The typical internal storage capacity of smartphones is 128 GB.
• 100-500 GB (fits on university network drives or a laptop). For example, 500 GB of storage space can hold several hundred short, relatively high-quality videos.
• More than 500 GB, but less than 5 TB (such large amounts are often difficult to transfer). For instance, a behavioural study involving multiple sessions and conducted using a multi-camera system and high-resolution 3D brain imaging will likely generate 1–5 TB of data over the course of several hours. Transferring such large amounts of data requires careful planning.
• More than 5 TB. Transferring such a large amount of data can be problematic due to timeouts, as the transfer takes so long that the connection is lost. However, you can submit large datasets to for archiving and public access.

• Difficult to estimate at this point of the project. If the research project is in its early stages, it may be difficult to estimate the size of the dataset. However, it is important to be aware that the size of the dataset affects where it can be published, the potential publication costs and the technical feasibility of transfer. 

   

Dataset will be

• Opened. Give preference to discipline-specific data repositories, as the data in these services is, so to speak, 'among its own kind' and therefore easier to find. You can use artificial intelligence to find a suitable repository for your data. If you cannot find a discipline-specific service, use publication platforms suitable for all disciplines, such as , and . If your dataset is too large for the above platforms, you can store it in and grant access upon request.
• Archived. Please consider the University of Helsinki's own services for preserving research data:  for retention periods ranging between 5 and 15 years and  for long-term preservation (25 years or more). The and the are also suitable for both open access and more restricted archiving. 

Name of the service where the dataset is opened, stored for verification, or archived

Please indicate here which storage service you think would be most suitable for your dataset. 

Web address of the service where the dataset is deposited

Enter the web address of the service here if you know it. This will help to avoid any confusion, given that service names can be similar. 

Planned storage period in years

The storage period varies by dataset and field of science. Take into account any recommendations on the storage period that are specific to the funder or field. Check also how long the publisher requires data related to publications to be preserved for.

Remember to agree on the storage period with the relevant parties well in advance. 

• 1 to 3 years. In some cases, the data has been obtained under a research permit that requires it to be destroyed as soon as possible after the research is completed. In this case, no special preservation or archiving measures are required; the data can simply be stored on the university’s network drive until it is destroyed (computing servers excluded).
• 3 to 5 years. If data is retained for several years after a study is completed, some members of the research team may have left the organisation. This could lead to issues regarding access rights to the data. To ensure the data remains accessible, it can be stored in .
• 5 to 15 years. Data should be preserved for this period using a suitable preservation service, such as , or a data repository, such as . Please note that group disk space, for example, is not suitable for long-term data preservation.
• Over 15 years. Make sure you archive your data using a curated storage service that will take care of it and ensure its usability for many years to come. 

Add another dataset

You can include several datasets in your data management plan. Describe any datasets that you intend to open, store, or archive. 

Research data to be destroyed after the research project

• Extra copies and outdated versions. We are constantly generating digital waste, and as this accumulates it takes up a huge amount of space. Storage solutions consume natural resources such as water and electricity, so sustainable data management also involves destroying unnecessary data. It is a good idea to set aside regular time for data clean-up, depending on the amount of data — for example, twice a year or even weekly.
• Incompletely documented datasets that are no longer usable. Inadequately documented data is scientifically unreliable and should therefore be destroyed. To ensure that the data you collect and produce remains usable, adopt documentation practices appropriate for your research.
• Datasets agreed for destruction in (usage) agreements. Agreements are legally binding and must be adhered to, unless the parties involved mutually agree to draft a new agreement regarding the continued use of the data.
• Sensitive datasets after the verification period. Sensitive raw data is usually destroyed. However, in some cases, it may be archived, but this must be carefully planned at the outset of the study.
• Direct identifiers, in accordance with the privacy notice and participant information. Direct identifiers must be destroyed in accordance with the privacy notice and participant information. Under the General Data Protection Regulation, personal data must be destroyed as soon as its processing is no longer justified. Direct identifiers may be retained for a longer period if processing personal data is scientifically justified, even at a later date, provided that the research participants are properly informed. If the privacy notice promises to destroy personal data by a certain date, this must be done, unless it is possible to re-inform the research participants and request their consent to continue processing their personal data. Be careful about what you promise in the privacy notice, bearing in mind that you may need to leave sufficient flexibility for further research.
• Files containing pseudonymisation keys. If you wish to publish the data in an anonymised form, you must first destroy all raw data relating to the dataset and the pseudonymisation key codes. In longitudinal studies, it may be necessary to store pseudonymisation key codes long term, but research participants must be informed about the retention of their personal data.
• Completed consent forms. As consent forms contain direct identifiers, they must be destroyed once there is no longer a scientific reason to process personal data.
• Data destruction has not yet been planned. Planning for data destruction can be challenging if the research is still in its early stages. This issue can be revisited when data collection begins or when agreements regarding data access rights are being made.

Data Support assists UH researchers in planning the opening, publishing, preservation, or destruction of the research data. If you need assistance, please email . You can also submit a request for assistance at the end of the form.

In this section of the form, please specify who will be responsible for the various data management tasks and what resources will be required to manage the research data. These resources could include necessary training and expert support, for example. You should also estimate how much time and financial resources will be allocated to data management tasks. Try to assess the need for data management expert services and potential salary costs already when applying for research funding.

The person responsible for creating, following, and updating the DMP in the project is

• Principal investigator. You can also select this option if you are conducting the research on your own rather than as part of a group.
• Data manager. A data manager is a specialist responsible for managing research data. Their duties may include supporting data collection and quality control, pseudonymisation and anonymisation, generating metadata, maintaining databases and coordinating data distribution and archiving practices.

• Research coordinator. A research coordinator is responsible for the practical planning of research projects, coordinating their implementation, and ensuring that administrative processes run smoothly. They also act as a liaison between researchers, funders, and the organisation. Duties may include monitoring schedules and budgets, producing reports, arranging research permits and agreements, and assisting with research data management and communication.

   

Data management skills will be introduced to the project by

• Principal investigator. It is the researcher’s responsibility to ensure that they familiarize themselves with the guidelines related to research data management and keep their skills up to date. The principal investigator must also ensure that other researchers on the project have the opportunity to develop their skills. This can be achieved by participating in and utilising the support services provided by Data Support, for example.
• Data manager. A data manager is a specialist responsible for managing research data. Their duties may include supporting data collection and quality control, pseudonymisation and anonymisation, generating metadata, maintaining databases and coordinating data distribution and archiving practices. They may also ensure that the research team’s data management skills are up to date.
• Senior researchers. Experienced researchers and colleagues who are involved in research projects may have in-depth knowledge of their field and of the organisation's practices. They can also ensure that early-career researchers have the opportunity to develop their data management skills.

The privacy notice and other privacy documents for the research project will be prepared by 

This question will only appear if section 3 of the form indicates that data protection documents are being prepared for the study.

• Principal investigator. You can also select this option if you are conducting the research on your own rather than as part of a group.
• The collector of each dataset. If a research project involves collecting several different datasets, an appropriate division of labour might be for each researcher to prepare the data protection documents for their own dataset.
• Research coordinator. In a research project, the duties of the research coordinator may include addressing data protection issues related to the research and drafting the necessary documents. 

The following financial costs or personnel work are associated with the project's research data management

• No special costs or personnel work. If a study involves minimal data management and produces few files, managing the study data may not incur significant financial or time-related costs.
• Training and skills development. Set aside time to familiarise yourself with any relevant data management issues (e.g. the General Data Protection Regulation if your research involves processing personal data). You can participate in organised by Data Support and take advantage of their other support services.
• Acquiring register data. Please note the time required for the data retrieval process, as well as the acquisition and usage costs. For more information, see the .
• Transcribing material. Take the cost of transcription into account in your budget, or allow time for it if you are doing it yourself. If you are outsourcing the transcription, draw up the necessary agreements (e.g. confidentiality agreements).
• Digitising the data. Be sure to factor in the costs of digitising the material, either in your budget or in terms of time, if you are digitising the material yourself. For example, digitising archival material and preparing it for use can be very time-consuming.
• Anonymising data. Be sure to factor in the costs of anonymising the data, either in your budget or in terms of time, if you are anonymising the data yourself. Please note that successfully anonymising data is a time-consuming process that requires careful planning and execution to ensure that no identifying information remains. You can read more about identifiability and anonymisation on the .
• Tools and software. This may include electronic laboratory notebooks purchased for use in a research project, for example.
• Data cleaning and organising. It’s a good idea to set aside regular time for organising and cleaning your data, depending on the amount of data. For example, this could be twice a year or even weekly. Read more data cleaning tips on the .
• Salary costs of a data management expert (e.g. data manager). Assess the need for a data management expert’s services and the potential salary costs when applying for research funding.
• Publishing data (e.g. paid data repositories, data papers). Some data repositories are free by default (for example, Zenodo allows you to upload a single publication containing up to 100 files, totalling up to 50 GB, free of charge). However, if you find a reliable, discipline-specific repository that better suits your data and requires a fee, make sure you account for the costs in your research budget.

A rough estimate of the total personnel work load when combining all the options selected above (in person-months)

You can include the person-months worked by the data manager or research coordinator, as well as the time researchers need for data management tasks.

A rough estimate of the total costs when combining all the options selected above (in euros)

Estimate what proportion of the research budget will be required to cover data management costs (e.g. transcription services and the data manager’s fee).