Data Sharing Policy

The Centre’s Collaboration Agreement provides the framework for access and use of data between participating research organisations (ROs). It distinguishes between Background (pre-existing or outside-project data used in connection with the Project (defined as all research activities delivered to fulfil the objectives of the Centre) and Results (data and other outputs generated during the Project).

• Background: There is no general requirement to provide all pre-existing or outside-Project data to another RO within the Centre. However, where another Centre organisation needs particular Background to carry out its part of the Project, sufficient access should be provided where the RO holding the data is able to do so. Background transferred or accessed under the Collaboration Agreement can be used for carrying out the Project, but not for unrelated purposes.
  • Other funders: Funding conditions and any agreements associated with the research should be checked for restrictions on sharing or use. Funders do not normally own the data resulting from research they have funded.
  • Collaborative research (including in partnership with or funded by industry): Additional restrictions may apply, particularly around confidentiality, access, use or commercial exploitation.
  • Ethical and statutory requirements:  Access to, or transfers of data must be allowed by the ethical approval and consent, and any other statutory requirements must be met. The need, under GDPR, for a data transfer agreement (DTA) for personal data is covered by the Collaboration Agreement.
• Results: Data generated during the lifetime of the Centre can be used by the other Centre organisations to carry out their parts of the Project, so sufficient access should be provided where needed for this purpose. Results can also be used for academic teaching, academic research and publication, including academic research funded by third parties.

Individuals receiving Background or Results from another organisation within the Centre must ensure that other members of their organisation who access these data are aware of and comply with the requirements set out in Section 13 of the Collaboration Agreement (including around appropriate safeguarding of data).

The Centre’s policy is consistent with the UKRI Research Data Policy (published 
14 October 2026), from where we adopt the following scope:

“This policy applies to research data (or ‘data’), defined as recorded information that is collected, created, generated, observed or derived from existing sources through any research method, and used to support, validate or inform research findings.
This policy does not apply to the management and sharing of physical samples, specimens and objects. However, due consideration should be given to their documentation and retention, as appropriate to the research and any applicable policies.
This policy also applies to the following research-relevant digital objects:

• algorithms, code, models and software resulting from research and needed to understand and validate research data or findings
• metadata about data and other research-relevant digital objects
• supporting documentation about data and other research-relevant digital objects (for example, workflows, interview and survey questions, README files and other descriptive or contextual documentation)”

UKRI also specifies that data and research-relevant digital objects include artificial intelligence artefacts arising from in-scope research activities. Where ‘data’ is used in this document, it also covers the additional research-relevant digital objects, as described above.

‘Data sharing’ is any activity where data is provided, or made available, beyond primary research purposes. The activities of accessing and transferring data between the Centre’s component research organisations are considered primary research purposes and therefore do not fall under this definition.

A ‘dataset’ is an identifiable collection of research data and research-relevant digital objects, together with the metadata and documentation needed to understand and use it.

‘Metadata’ is information that describes a dataset and enables it to be found, understood and used, such as its title, creators, description of its content, methods, dates, format, provenance, and any conditions or restrictions on access and reuse.

A ‘Trusted Research Environment (TRE)’ is a secure, controlled computing environment that enables approved researchers to access and analyse sensitive data without the data being downloaded or transferred to them. Access, use and removal of outputs are controlled and monitored to protect the data.

A ‘Machine-actionable licence’ is a licence that has standardised terms that a computer program could read and identify limitations to use and adaptation.
 

The Centre recognises and supports UKRI’s commitment to the FAIR Data Principles (generating and organising data and outputs that are Findable, Accessible, Interoperable and Reusable).

The guiding principle for the sharing of data (in line with all major research funders in the UK) is for it to be made as open as possible, but as closed as necessary.

As a result, dataset categories range from those appropriate to be shared under an open licence in an open repository, to those not suitable for sharing. The valid reasons for sharing restrictions are:

• ethics (including consent or lack thereof)
• statutory regulations (e.g. GDPR, Trusted Research & Innovation)
• contractual obligations associated with industrial partnerships
• contractual obligations associated with other funding bodies
• preservation of background or foreground intellectual property (IP), in particular IP deemed to have potential for patenting
• technical reasons, such as dataset size

To maintain an exhaustive directory of dataset outputs of the Centre, all datasets that underlie publications which acknowledge the Centre’s primary UKRI award and/or studentship award  will have at least an index entry on Cambium, our data sharing web platform. If the metadata is stored in Cambium, then it will be allocated a DOI that resolves to this. If the metadata is in another repository, a link to it will be listed on Cambium.

UKRI’s Research Data Policy 2026 states that:

“The following research data must be shared in a timely and responsible manner, with as few restrictions on access and reuse as possible:

• data necessary to understand and validate published findings or other research outputs
• data with potential long-term reuse value for research and innovation

Domain-specific best practices and standards should be used to determine which data, and which versions of those data, are needed to support published findings or may have long-term value.”

Where a data type is normally pre-processed into a smaller derived format before analysis, and when this pre-processing is described in detail in metadata, it is valid to openly share the pre-processed format data, rather than the raw data, and provide access to the raw data on request. See Appendix 2 for a detailed example.

For example, a very large dataset of high channel-count electrophysiological recordings from the brain might be tens of terabytes. If it is expected that most analyses of the dataset would require only spike timings and the accompanying low-sampling-rate local field potentials, the relevant data could be provided in a processed dataset of only a few gigabytes. Metadata records in a repository would be made for both the summary dataset, and the raw dataset, but only the summary dataset would need to be uploaded and made publicly downloadable. The raw dataset metadata would include how to apply for access, and would suggest ways by which the large data transfer could take place.

UKRI’s Research Data Policy 2026 states that:

“Research data and associated metadata must be shared using an appropriate repository that supports data curation, discovery and access, and enables appropriate preservation arrangements for the type of data. This includes using repositories that provide managed access or trusted research environments, where necessary.
Where available, data should be deposited in a domain-specific repository. Where no suitable domain-specific repository exists, an institutional repository should be used. If neither is available, a generalist repository should be used.”

Examples of suitable repositories where Centre datasets might be deposited include: Zenodo, FigShare, GitHub, ORA-Data, ModelDB, and Cambium.
 

Data Availability Statements

Publications arising from the Centre must include a Data Availability (or Accessibility) Statement, and use persistent identifiers for the underlying dataset(s), such as DOIs. These identifiers must link to metadata records in a repository. The metadata must describe the formats of the dataset, and include any information needed to fully utilise it. It is not permissible to substitute this with a statement that ‘data are available upon request’.

The repository records should describe how to obtain the data (if not under an open license and publicly downloadable), and usage restrictions. Where possible, an open and machine-actionable license (e.g. CC BY-SA) should be assigned in the repository record.

In cases where data has been generated externally (by an individual or organisation beyond the Centre’s participating ROs) the generators of the data should submit to an appropriate repository and assign a persistent identifier. If this is not possible, a dataset record can be made on Cambium with metadata, with a contact at the organisation that controls the dataset, and with detailed conditions for access and use.
For publications where no new data were generated (e.g. reviews or book chapters), this must be stated in the Data Availability Statement.

Repository visibility

All repositories used will allow metadata to be publicly viewable (unless the metadata itself is sensitive). This metadata will include the data formats, key details of how data were acquired, and descriptions of file naming rules that have been followed. Also described are the conditions required before access will be granted, and conditions that must be followed when it is reused.

Cambium will maintain metadata compatibility with the major indexing systems by providing it in compatible schemata (currently DataCite XML and JSON-LD). Its metadata is indexed in Google Dataset Search. Cambium datasets can also be found through general-purpose web search engines. Access to dataset web pages (and the metadata in their headers) by large language models is permitted.

The publication pages on the Centre’s website include links to source datasets in Cambium.

Principles

Data deposited in a community or institutional repository will in most cases lead to data being publicly available.

Data shared from Cambium requires users to register for an account to download datasets. Account creation does not require approval. Most datasets are available for all users with an account, but some may require an access request be made to the dataset’s manager (typically the Principal Investigator (PI) of the group that generated it). This request will be assessed against the conditions for access (stated on the dataset page) that were agreed upon by the PIs involved and the Centre’s Data Steward (Head of Operations). PIs are expected to review and respond to access requests promptly. 

In the case of a rejection of an application, the dataset manager will email the requester explaining how the conditions were not met, and offering an opportunity to refine the request or to appeal the decision. An appeal would be considered by the Centre’s Open and Responsible Research Enabling Group (ORREG) with input from the Data Steward and PI(s) concerned, but neither would have a deciding vote in the appeal.
The Centre does not retain an exclusive access period to datasets after first publication.

In the unlikely instance that significant portions of funding are halted or are not renewed, datasets that have been generated – but not shared a repository – will be assessed by the ORREG. If this group judges that data will not contribute to a publication by the originators, it will be deposited into a suitable open community repository by the Centre’s Operations Team, following the required processes of the research organisation that generated the data.

Data Transfer Agreements (DTAs)

DTAs will be required in the following circumstances:

• When sharing a dataset could reduce the impact of ongoing research.
• When a dataset has IP value and/or is linked to a partnership that requires it.
• When a dataset has been classified as dual-use (having both civilian and military/security applications).
• When the dataset contains personal data that requires with compliance with GDPR.

The DTA would be established between the research organisation(s) within the Centre that generated the data, and the party(ies) receiving it. It might include a clause to state that relevant researchers from the Centre would have to approve the final manuscript to which their data contributed before submission for publication. This would ensure that data reuse can occur as efficiently as possible, but that external users would not be permitted to use it for purposes that would compromise the novelty of ongoing research at the Centre.
Applications for access to datasets under the terms of a DTA would come via the same mechanism as other datasets that require approval for access - from the approval system of the repository that holds the metadata record. Where this repository is Cambium, the Centre’s Operations Team will have oversight over the approval and appeal process.

Responsibility for drafting and agreeing the terms of a DTA remains with the relevant research or legal services teams within the Centre’s participating ROs.
 

The following steps must be taken to reduce delays to sharing:

• Participant Information Sheets and other relevant materials must include permission to share fully anonymised data, including in open repositories.
•  Initial ethical approval for a study should include permission to share fully anonymised data, including in open repositories.
• Human data must have direct identifiers removed at point of acquisition.
• File formats should be selected to be the most open, and used as close as practical to the point of acquisition. These formats should be fully described and widely adopted in the field.
• Naming and directory structure of files must follow standards and be consistent across a project (e.g. dates follow ISO 8601, use of animal unique identifiers) to enable the data to be machine-actionable.
• When Centre publications include data from external collaborators, sharing conditions – including anticipated need for DTAs and the identification of innovations that may be suitable for patent protection – must be discussed and agreed at the beginning of the collaboration. The UKRI Research Data Policy states:

“Where research data will be collected or derived from secondary or third-party sources (for example, data collected from human research participants, or data that needs to be licensed from another organisation), anticipated data sharing should be discussed as early as possible. Consent or data sharing rights that enable sharing in line with this policy should be sought, although we recognise that rights may not always be granted.”

• Data management workflows should aim to have datasets finalised and uploaded to a repository by the date of publication, even if, due to on-going projects, access to these will be under a DTA.

As a Centre requirement, all licences and transfer agreements for datasets to which this policy applies must require attribution when datasets are reused. The Centre therefore does not use CC0 or similar licences for these datasets, because they do not make attribution a condition of reuse. To give appropriate credit to data-sharers, advice given by the UK Digital Curation Centre for citing datasets must be followed. A citation should include the following information at a minimum:

•  Creators’ names (in the article publisher’s standard format)
• Year of publication of the dataset
• Title of the dataset
• Publisher of the dataset
• Persistent identifier (usually a DOI).

An example in the Oxford referencing style:
Mancini, V., Grennan, I., Sharott, A., Stagg, C.J. (2025) EMG and accelerometer recordings during closed-loop TMS for tremor in Essential tremor and Parkinson's disease [dataset] (University of Oxford), doi:10.60964/rnd-0qp8-9458
 

Where a dataset is to be published under an open license on Cambium, the ORREG must first undertake a due diligence exercise to satisfy Trusted Research & Innovation (TR&I) considerations. The decision outcome will be that the dataset either is or is not suitable for open publishing. This decision must be reassessed if the sensitivity or applications of the data change.

Access to these openly shared datasets on Cambium does not constitute a formal research collaboration or partnership with the data provider. Open datasets are licensed on terms permitting onward redistribution; consequently, individual recipients of the shared data are not subject to TR&I partner due diligence.
When a dataset is to be shared under a DTA, the organisation initiating the sharing (i.e. one of the Centre’s participating ROs) is responsible for undertaking relevant TR&I assessments specific to the transfer.

If a Centre researcher plans to make a dataset (including code) publicly available via another platform (e.g. Figshare, GitHub, Zenodo), the PIs involved in the project(s) that generated the dataset are responsible for carrying out the appropriate due diligence to satisfy the relevant institutional requirements of their RO(s) including, where relevant, TR&I assessment. This is because in these cases (unlike when applying for a DTA), there is no automatic involvement of TR&I specialist staff. If the PIs consider that the dataset might raise export or dual-use concerns, they must either:

• not make the dataset publicly available (instead create a metadata entry in the chosen repository stating the need for a DTA due to TR&I concerns), or
• engage with the Research Services team (or equivalent) of the PIs’ research organisation(s), and proceed to share data only if approved by this team.

If PIs have general queries or specific questions about TR&I, the ORREG is available to provide advice, or directions to authoritative sources of guidance.
 

i. Project setup

A Centre PI collaborates with a German university to study an experimental non-invasive medical device in a research project necessitating human participants (patients). The project is funded by BigCorp, DFG, Wellcome and UKRI/MRC CoRE RND.

• Germany: human EEG, behavioural task data, and medical histories.
• UK: the same data types, plus structural MRI.

The research ethics approvals of both UK and German teams permit anonymised data to be shared openly. UK consent also permits identifiable data to be accessed in a Trusted Research Environment (TRE) for research into the participants' condition.

Before the project starts, the researchers establish the data protection arrangements:

• The UK and German organisations are separate data controllers for the participant data that each university records.
• For the UK organisation, the UK GDPR Article 6 lawful basis is ‘public task’: processing is necessary for research carried out in the public interest as part of the organisation's functions. The appropriate Article 9 / Data Protection Act 2018 condition for processing special-category data for research is also documented.
• The study has ethical approval, supporting the assessment that the research is undertaken in the public interest.

• A Data Protection Impact Assessment (DPIA) is completed before the project starts, covering collection, transfer, analysis and proposed sharing of personal and special-category data, together with the safeguards used to manage identified risks.

   

ii. Account for the industry partner

BigCorp's contractual agreements require the device design, control software and optimisation parameters to remain confidential. EEG periods that reveal the device's activity cannot be released.

• Remaining anonymised EEG data may be shared under a non-commercial licence, such as CC BY-SA-NC.
• BigCorp can check the manuscript and proposed dataset for breaches of confidentiality before publication.

iii. Decide what can be shared

Before data collection commences, the collaborators review each data type and agree the appropriate sharing route.

Structural MRI: Remains personal data even after de-facing; restricted access.

Medical history: Too sensitive in full; share only summarised information.

EEG: Can be anonymised, but periods which reveal information about the stimulation given by the device must be removed.

Behavioural data: Can be anonymised and shared openly.

A formal Data Transfer Agreement between the UK and German organisations is put in place before data collection.

iv. Collect, transfer and process the data

Participants are pseudonymised rather than directly identified in the research data. German data are transferred in an encrypted archive via institutional OneDrive to secure UK storage; the German identification key is not transferred.

During analysis, the researchers:

• remove EEG periods revealing the device stimulation pattern;
• summarise medical histories;
• de-face MRI scans;
• replace subject identifiers across the combined dataset; and
• review whether the EEG, behavioural and summary medical-history dataset is sufficiently anonymised for open release.

v. Check before release

BigCorp reviews the paper and proposed open EEG data and confirms that they do not disclose confidential information. The researchers also consider IP, commercial sensitivity, Trusted Research and dual-use risks, and conclude that no additional restrictions are required.

vi. Share each output appropriately

Open dataset

The anonymised EEG, behavioural data and summarised medical histories are deposited in Cambium with a DOI, detailed metadata, funder and contributor identifiers, and a CC BY-SA-NC licence.

Restricted dataset

The structural MRI remains in secure university storage. A Cambium metadata record and DOI make it discoverable. The record states the permitted use and access requirements; access requires ethical approval and takes place through a Trusted Research Environment.

Analysis code

The analysis code is released on GitHub under an MIT licence, with an archived release and DOI in Cambium. Confidential device software and parameters are not released.

vii. Publication and availability statements

The paper must comply with the relevant Wellcome, UKRI/MRC, DFG, university and journal sharing requirements. It includes:

• a Data Availability Statement giving the DOI for the openly available dataset, its licence, and the DOI and access conditions for the restricted structural MRI data;
• a Code Availability Statement giving the DOI for the analysis code and explaining that the medical-device software and parameters remain confidential; and
• persistent identifiers and clear information about any usage and access restrictions.

viii. Conclusion

The project makes anonymised data openly available where possible, provides controlled access to the structural MRI where necessary, releases the analysis code, and documents material that cannot be shared. The general principle of sharing data as openly as possible and restricting access where necessary would already have applied under the other relevant funder and institutional requirements. The additional steps required specifically for compliance with the UKRI/MRC CoRE RND policy are the compulsory deposit of research data and analysis code in appropriate repositories and the use of persistent identifiers, such as DOIs. These requirements also make the outputs easier to discover, cite and report.

i. Project set-up

A Centre PI collaborates with another UK university on a project investigating neural circuit activity in mice using Neuropixels probes. The project is funded by UKRI/MRC CoRE RND, a biomedical research charity, and CleverNeuroTech Ltd, which provides prototype recording hardware and contributes funding.

Before the project begins, a funding and Material Transfer Agreement with CleverNeuroTech Ltd is established. It covers the company funding and provision of the prototype hardware, permitted uses of the material and equipment, and the confidentiality requirements applying to commercially sensitive technical information.

The two universities also put a Data Transfer Agreement in place before data are transferred between them. It sets out the data covered, the purposes for which they can be transferred and used, the responsibilities of each institution, and the arrangements for secure transfer and storage.

The study generates:

• raw Neuropixels electrophysiology recordings;
• processed electrophysiology data, including spike times and sorted units;
• behavioural video and derived behavioural tracking data;
• experimental metadata;
• histology images showing probe locations; and
• analysis and preprocessing code.

There are no human participants or personal data, but the electrophysiology recordings and behavioural video generate tens of terabytes of raw data.

ii. Identify stakeholder requirements

Before data collection, the researchers identify the different requirements that need to be reconciled.

• UKRI/MRC requires research data to be shared as openly as possible and as closed as necessary, with repository deposit and persistent identifiers used for research outputs.
• The biomedical research charity expects sufficient underlying data to be available for independent reproduction and future reuse.
• The two universities require research data supporting publications to be retained appropriately and valuable datasets to be preserved for future reuse.
• CleverNeuroTech Ltd permits the biological recordings to be shared, but technical information revealing the design or operation of its prototype hardware must remain confidential.

• The journal requires a Data Availability Statement and expects the data supporting the published findings to be accessible.

   

iii. The practical problem: the raw dataset is enormous

Depositing every raw electrophysiology and video file in the Centre's normal research-data repository would involve tens of terabytes of data. Long-term repository storage and transfer would be expensive and cumbersome, while most researchers wishing to reproduce the published analysis would not need the original raw voltage traces or complete raw video.

However, the raw recordings still have substantial reuse value. A researcher developing a new spike-sorting or signal-processing method may need the original voltage traces rather than the processed outputs. The researchers therefore need to decide which data should be routinely deposited and which should remain available through a more suitable route.

iv. Decide how each output should be shared

The researchers use a tiered approach based on the purpose, size and likely reuse of each output.

Experimental metadata: Open repository.

Processed spike/unit data: Open repository.

Behavioural tracking data: Open repository.

Selected or derived video: Open repository where practical.

Histology / probe-location data: Open repository.

Analysis and preprocessing code: GitHub plus an archived release with a DOI.

Raw Neuropixels recordings: Preserved in suitable high-capacity storage and made available on request through an appropriate high-volume data-transfer mechanism; discoverable through a repository metadata record and persistent identifier.

Behavioural video: Preserved separately because of size; discoverable and available through an appropriate transfer route.

Prototype hardware information: Not shared because it is commercially confidential.

v. Make the open dataset reusable

The researchers do not simply upload the laboratory's working files. The processed electrophysiology and associated metadata are organised in an appropriate community-standard format so that another researcher can understand and reuse the dataset without first reconstructing the laboratory's internal file structure.

The repository metadata describes:

• experimental conditions and animal information;
• probe and recording information and sampling parameters;
• relationships between electrophysiology, behavioural data and histology;
• preprocessing and spike-sorting methods and software versions;
• links to the analysis code; and

• identifiers linking processed data to the corresponding raw recordings.

   

vi. Provide an efficient route to the massive raw data

The complete raw Neuropixels recordings and raw behavioural video are retained in suitable institutional high-capacity research storage rather than duplicated in the normal repository. A repository metadata record and persistent identifier describe the raw dataset, including its size, formats and contents, and explain how it can be obtained.

Researchers who genuinely need the raw signals can request them. The files are then supplied using an appropriate high-volume data-transfer mechanism rather than email, ordinary web download or ad hoc file sharing. This keeps the raw data discoverable and available for specialist reuse without making routine access to the smaller processed dataset unnecessarily difficult or expensive.

vii. Publication and availability statements

The paper distinguishes clearly between data that are openly deposited, very large raw data that are preserved and available through a separate route, and information that cannot be released. It includes:

• a Data Availability Statement giving the DOI for the openly available processed dataset, and the persistent identifier and access route for the raw recordings and raw behavioural video;
• a Code Availability Statement giving the DOI for the archived version of the preprocessing and analysis code; and
• an explanation that technical information relating to the prototype hardware is not available because it is commercially confidential.

viii. Conclusion

The project already needed to make its research data appropriately available under the requirements of the other funders and institutions. The additional steps required for UKRI/MRC CoRE RND compliance are to use an appropriate repository and ensure the research outputs have persistent identifiers, such as DOIs.

For the very large raw Neuropixels recordings and behavioural video, this means using repository records and persistent identifiers to make the datasets discoverable, while the underlying files can be retained and transferred using storage and transfer arrangements appropriate to their size.

i. Project set-up

A US university leads an NIH-funded study involving human participants. A Centre PI contributes specialist expertise and analysis to the project and is the second-to-last author on the resulting publication.

The project is funded by:

• NIH, which funds the main US-led study; and
• UKRI/MRC CoRE RND, which contributes research and professional support to the Centre PI 

The Centre PI did not design the study, recruit the participants or determine the project's data-sharing arrangements.

Before the study began, the US research team submitted a Data Management and Sharing Plan to NIH, which was approved before the project started. The plan specified that the human research dataset would be retained in the US university's institutional repository and made available to eligible researchers under a Data Transfer Agreement (DTA), rather than being made openly available.

ii. Follow the approved NIH sharing arrangements

The study proceeds under the approved NIH Data Management and Sharing Plan. The US university remains responsible for managing the dataset and requests for secondary access.

Researchers wishing to reuse the data apply through the US institution and, where access is approved, receive the data under the specified DTA.

The Centre PI therefore does not create a separate copy of the dataset for deposit in a UK repository or establish an alternative UK access procedure. The existing NIH-approved sharing arrangements are followed.

iii. Check what is needed for UKRI/MRC CoRE RND

When preparing the publication, the Centre PI checks whether the existing NIH sharing arrangements also allow the Centre's UKRI/MRC requirements to be met.

The underlying requirement to make the research data appropriately available is already addressed by the NIH Data Management and Sharing Plan. The Centre PI therefore needs to ensure that:

• the dataset held by the US institutional repository has a persistent identifier that can be cited; and
• the paper contains a Data Availability Statement identifying the dataset and explaining that access is available through the US university under a DTA.

The Centre PI contacts the US project team and confirms that the institutional repository can assign a persistent identifier to the dataset record.

iv. Publication and Data Availability Statement

The dataset remains in the US university repository and continues to be managed according to the NIH-approved plan. No additional copy is deposited by the Centre PI.

The paper includes a Data Availability Statement, for example:

“The data supporting this study are held in the institutional research data repository of [US University] and are available for research reuse subject to approval and a Data Transfer Agreement, in accordance with the NIH-approved Data Management and Sharing Plan. Further information and details of how to request access are available at: DOI: XXXXX.”

v. Conclusion

The NIH-approved Data Management and Sharing Plan remains the basis for sharing the dataset; the Centre PI does not need to establish a separate sharing route or duplicate the data in a UK repository.

The additional steps for UKRI/MRC CoRE RND compliance are to ensure that the existing US repository record has a persistent identifier and that the publication includes an appropriate Data Availability Statement linking to it.