7. Research Data Governance and Lifecycle Management

Introduction and Context

Research data are not merely inputs to analysis. They are evidence, intellectual assets, records of scholarly activity, and, in many projects, representations of people, communities, environments, or institutional operations. Their value and risk change over time. A dataset that is exploratory during data collection may become legally sensitive when linked with identifiers, scientifically valuable when deposited in a repository, and a liability when retained without purpose or protection. For this reason, responsible research requires governance across the entire data lifecycle.

Research data governance concerns the authority, rules, responsibilities, and controls used to make decisions about data. Lifecycle management concerns the movement of data from planning and collection through processing, analysis, sharing, preservation, reuse, and eventual deletion or continued retention. Together, they connect research ethics with information management, cybersecurity, records management, reproducibility, and institutional accountability.

At doctoral level, data governance should be understood critically rather than as a checklist. A data management plan may satisfy a funder yet fail to address Indigenous data sovereignty, algorithmic bias, metadata quality, or the practical realities of long-term preservation. Conversely, strict controls may protect confidentiality while unnecessarily preventing legitimate scientific reuse. Good governance therefore involves justified, proportionate, and revisable decisions.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Explain research data governance and the principal stages of a data lifecycle.

2. Design a defensible data management plan covering provenance, metadata, quality, security, sharing, retention, and deletion.

3. Apply FAIR and CARE principles while recognising their different purposes and possible tensions.

4. Evaluate data sovereignty, stewardship, access rights, and ethical responsibilities.

5. Select appropriate repositories, controls, and technologies for different types of research data.

6. Critically assess risks, limitations, and emerging issues in research data management.

Data Governance as an Ethical and Institutional Responsibility

Data governance is the system through which an organisation determines who may collect, access, modify, share, retain, or destroy data, under what conditions, and with what accountability. It includes policies, roles, standards, workflows, technical safeguards, documentation, and oversight. Governance is broader than security. Security protects confidentiality, integrity, and availability; governance determines why data should exist, who is entitled to use it, and what constitutes legitimate use.

Research governance must distinguish several related concepts. Data ownership refers to legal or institutional claims over data, but ownership alone does not settle ethical questions. Data control concerns the power to make operational decisions. Data stewardship is the responsible care of data on behalf of participants, communities, institutions, and future users. Custodianship commonly refers to maintaining and protecting data without necessarily claiming ownership. These distinctions are especially important where participants, universities, sponsors, governments, and Indigenous communities hold different interests.

A lifecycle perspective prevents a common error: treating ethics approval as the end of ethical reasoning. Consent obtained at collection may not automatically authorise future linkage, artificial-intelligence training, public release, or transfer to another jurisdiction. Governance must therefore include change management, continuing review, incident response, and mechanisms for correcting records or withdrawing data where feasible.

The Research Data Lifecycle

A lifecycle is a conceptual model rather than a single universal sequence. A practical research lifecycle contains the following connected stages:

Planning and classification. Before collection, researchers identify data types, sensitivity, expected volume, legal and ethical constraints, ownership or control arrangements, anticipated users, costs, and preservation needs. Classification may distinguish public, internal, confidential, personal, sensitive, or highly restricted data. Classification should be based on consequences of misuse, not merely on the researcher's intuition.

Collection or creation. Researchers define instruments, sampling procedures, consent conditions, file formats, identifiers, and quality controls. Provenance begins here. A provenance record documents where data came from, when and how they were generated, which instruments or software were used, and what transformations occurred. In computational research, code versions, configuration files, random seeds, and dependency information may be as important as the observations themselves.

Processing and documentation. Raw data are cleaned, coded, harmonised, pseudonymised, or transformed. Original raw data should normally be preserved as a read-only master, while derived versions are given new identifiers and processing histories. Documentation explains variables, missing values, coding decisions, exclusions, and changes. Without this layer, a technically accurate dataset may remain scientifically uninterpretable.

Storage, backup, and security. Working data require controlled storage, authentication, encryption where appropriate, backup, recovery testing, and monitoring. A backup is not automatically an archive: backups support recovery from loss, whereas archives support long-term intelligibility and evidential value. Critical projects should consider geographically separate copies, version control, integrity checks, and documented recovery priorities.

Analysis and use. Access should follow the principle of least privilege: each person receives only the access needed for an authorised task. Researchers should record analytical decisions, maintain reproducible computational environments where feasible, and prevent accidental disclosure through tables, maps, quotations, model outputs, or small-cell reporting. Data-use permissions should be reviewed when the purpose, dataset, personnel, or analytical method changes.

Sharing and publication. Sharing may involve open publication, controlled access, data enclaves, trusted intermediaries, contractual exchange, or sharing only metadata. The appropriate option depends on identifiability, consent, security, intellectual property, community authority, and public interest. A statement that data are “available on request” is not a complete access policy; it should specify the repository or custodian, eligibility, application process, review criteria, and expected response.

Preservation, retention, and deletion. At project closure, researchers determine which data, documentation, code, consent records, and audit logs should be retained. Retention should reflect scientific value, legal obligations, institutional schedules, contractual conditions, and participant expectations. Secure deletion must address active systems, backups, temporary files, portable devices, and cloud replicas. Where deletion is impossible or disproportionate, the limitation should be disclosed and residual risk reduced.

These stages overlap. Decisions made during planning determine whether meaningful preservation or lawful sharing will be possible later. Lifecycle governance is consequently front-loaded: the cheapest time to fix missing metadata, ambiguous consent, or weak identifiers is before collection begins.

The Data Management Plan as a Governance Instrument

A data management plan (DMP) is a living document that translates research intentions into operational commitments. It should be updated when methods, personnel, platforms, data categories, or sharing arrangements change. A doctoral DMP should normally answer the following questions:

• What data will be collected, generated, acquired, or reused, and in what formats and quantities?
• What ethical, legal, cultural, contractual, or security restrictions apply?
• Who is responsible for data quality, access approval, documentation, security, and preservation?
• How will provenance, metadata, versioning, identifiers, and quality assurance be maintained?
• Where will data be stored, backed up, and processed, and in which jurisdictions?
• What will be shared, with whom, when, and under what licence or access conditions?
• What repository is suitable, and what persistent identifier will be assigned?
• How long will data be retained, and how will deletion or continued preservation be authorised?
• What resources, training, and costs are necessary?

A DMP should identify decision rights, not merely name technologies. “Data will be stored securely” is weak because it does not identify the platform, access roles, encryption, backup frequency, monitoring, or incident procedure. A stronger statement links the risk to a control: identifiable interview files will be stored in an institutionally managed encrypted environment; access will use named accounts and multifactor authentication; the data manager will review permissions quarterly; and disclosure incidents will be reported through the institutional procedure.

Provenance, Metadata, and Data Quality

Provenance is the history of origin, custody, processing, and modification of a data object. It supports reproducibility, accountability, error investigation, and interpretation. Provenance may be captured through human-readable logs, workflow systems, version-control repositories, database audit trails, or machine-readable standards such as provenance graphs. It should distinguish original observations from imputations, transformations, synthetic data, and analytical outputs.

Metadata are structured information about data. Descriptive metadata identify subject, creator, title, date, keywords, and abstract. Structural metadata explain relationships among files, tables, variables, and instruments. Administrative metadata describe rights, access conditions, formats, preservation actions, and technical requirements. Domain metadata use field-specific vocabularies and measurement conventions. A spreadsheet with column headings is not necessarily adequately documented; terms such as “score,” “case,” or “status” require definitions, units, allowable values, and collection context.

Data quality is fitness for an intended purpose, not an absolute property. Relevant dimensions include accuracy, completeness, consistency, timeliness, validity, uniqueness, and representativeness. Quality assurance may include instrument calibration, double entry, range checks, duplicate detection, missing-data analysis, inter-rater assessment, schema validation, anomaly detection, and independent review. Automated checks are useful but cannot determine whether a variable measures the intended construct or whether a sample excludes a marginalised population.

A mature governance process records quality limitations rather than hiding them. Missing observations, sampling bias, measurement error, changes in instruments, and failed collection periods should be documented. Transparent limitations often increase the value of a dataset because users can judge whether reuse is appropriate.

FAIR, CARE, and Data Sovereignty

The FAIR principles encourage data to be Findable, Accessible, Interoperable, and Reusable. Findability requires persistent identifiers, searchable descriptions, and indexing. Accessibility requires a clear method of obtaining data, although it does not mean unrestricted public access. Interoperability depends on standard formats, shared vocabularies, and machine-readable structures. Reusability requires sufficient provenance, metadata, licensing, and explanation of limitations.

FAIR primarily addresses the technical and scholarly conditions that make data useful. It does not by itself determine whether sharing is ethical, whether a community agrees with reuse, or whether data reflect unequal power relationships. A dataset can be FAIR but harmful if it exposes vulnerable people or treats culturally significant knowledge as an ordinary public resource.

The CARE principles—Collective benefit, Authority to control, Responsibility, and Ethics—respond to these concerns, particularly in relation to Indigenous data governance. Collective benefit asks whether data activities produce meaningful benefit for communities. Authority to control recognises community rights to determine how data are represented and used. Responsibility requires respectful, accountable relationships and capacity building. Ethics requires attention to harm, context, and relational obligations rather than relying only on individual consent.

FAIR and CARE are complementary but can create tensions. Maximising discoverability may conflict with cultural restrictions. Interoperability may encourage standardisation that strips away local meaning. Reuse may be scientifically attractive but inconsistent with community authority. The appropriate response is not to abandon either framework but to apply them together, using graduated access, community review, contextual metadata, data-use agreements, and culturally appropriate governance.

Data sovereignty concerns the authority of a people, community, organisation, or state to govern data according to its laws, values, and jurisdiction. Indigenous data sovereignty is distinct from national data localisation: it centres the rights and self-determination of Indigenous peoples, including collective interests not reducible to individual consent. Researchers must examine who defines permissible use, where servers are located, which law applies, and whether a community has meaningful decision-making power.

Repositories, Access, and Preservation

Repository selection should follow research requirements rather than convenience. An institutional repository may be suitable for many datasets; a disciplinary repository may provide richer domain metadata and community standards; a national or governmental repository may be appropriate for regulated or publicly funded data. Sensitive data may require a controlled-access repository, secure data enclave, or trusted research environment. Researchers should assess persistence, governance, identifiers, format support, access review, auditability, preservation policy, licensing, and exit options.

A repository deposit should include more than a data file. It may require a readme, codebook, methodology, licence, consent or access statement, provenance record, software environment, version information, and citation guidance. Persistent identifiers support citation and tracking, but they do not guarantee long-term preservation or ethical legitimacy.

Access models form a spectrum: open access; registration-based access; reviewed access; mediated access; secure analysis without download; and no external access. De-identification reduces risk but does not guarantee anonymity. Re-identification can arise from combinations of quasi-identifiers, linkage with external datasets, distinctive narratives, geolocation, facial images, genomic information, or model outputs. Disclosure review should consider realistic attack pathways, not merely removal of names.

Roles, Accountability, and Technical Controls

Responsibilities should be assigned explicitly. The principal investigator is accountable for scholarly and ethical compliance; a data steward manages documentation and operational controls; an information-security specialist advises on threats and safeguards; a repository or records manager supports preservation; and an ethics committee or governance board provides oversight within its mandate. Participants and communities are not merely data subjects: where appropriate, they should have voice in use, representation, benefit, and correction.

Technical controls may include role-based access, multifactor authentication, encryption in transit and at rest, key management, pseudonymisation, secure transfer, network segmentation, immutable audit logs, malware protection, vulnerability management, and tested backups. Privacy-enhancing technologies—such as differential privacy, secure multiparty computation, federated analysis, or synthetic data—can reduce exposure, but each introduces utility, implementation, and disclosure risks. Synthetic data are not automatically anonymous; their similarity to source records must be assessed.

Automation and artificial intelligence can assist metadata extraction, anomaly detection, classification, de-identification, and policy enforcement. However, automated classification may mislabel sensitive material, and generative systems may retain, infer, or reproduce confidential content. Research data should not be uploaded to an external AI service unless contractual, ethical, security, and jurisdictional requirements permit it. Human review remains necessary for high-impact decisions and culturally sensitive interpretation.

An Illustrative Case: Community Health Data Across Borders

Background

The fictional Northbridge University collaborates with a regional health service and an Indigenous community organisation to study patterns of diabetes prevention. The project combines clinical records, wearable-device measurements, interviews, and community-generated maps. A commercial analytics provider offers cloud processing in another country.

Situation and Problem

The investigators initially propose depositing a fully anonymised dataset in an open repository. The community organisation objects that the maps may identify sacred places and that the proposed consent form does not explain international cloud processing or future commercial reuse. The clinical partner is concerned about re-identification through rare diagnoses and geographic combinations. The funder expects a public data-access statement.

Analysis

The project contains multiple data classes with different risks. Clinical records and wearable data are personal and potentially sensitive. Community maps may carry collective cultural restrictions. The original consent language does not clearly support all proposed secondary uses. “Anonymised” is an unsupported conclusion until linkage risk is assessed. Open access would satisfy a narrow interpretation of FAIR but could violate CARE, community authority, and participant expectations.

Approach and Strategy

The team revises the DMP and establishes a joint governance group including the community organisation. It separates direct identifiers, research data, and linkage keys; stores the key under independent custodianship; and uses a controlled research environment rather than unrestricted cloud processing. The provider is permitted only after contractual review establishes security, deletion, audit, and jurisdictional requirements.

The team deposits a rich metadata record and non-sensitive aggregate outputs in a repository, while the underlying dataset is placed under reviewed access. Community maps are retained under community-controlled access, with contextual metadata explaining restrictions. The access committee includes community representation and evaluates proposed uses against consent, scientific purpose, privacy risk, and collective authority. The consent process explains future research, international processing, withdrawal limitations, and governance arrangements. A re-identification assessment, access log, annual review, and incident-response plan are added.

Outcome

The project does not achieve unrestricted release of the complete dataset, but it achieves responsible discoverability and controlled reuse. Other researchers can find the dataset, understand its structure, request access, and use aggregate outputs. The community gains a formal role in decisions and receives capacity-building support and results in an agreed format.

Learning Points

The case demonstrates that openness is not identical to responsibility; metadata can be public while data remain restricted; consent, sovereignty, and technical security must be considered together; and governance is strongest when affected communities participate in decision-making rather than being consulted only after the design is complete.

Challenges, Limitations, and Common Errors

Research data governance is difficult because data cross organisational and national boundaries, systems change, funding ends, and future uses cannot always be predicted. Common errors include collecting excessive data, treating de-identification as a guarantee, using personal storage for sensitive files, failing to preserve raw data, relying on undocumented spreadsheets, granting shared accounts, neglecting backup restoration tests, and promising deletion that cannot be achieved in replicated systems.

Another limitation is the tension between standardisation and context. Common schemas improve interoperability but may encode assumptions from dominant institutions. Data-quality metrics can reward completeness while overlooking systematic exclusion. Repository policies may prioritise public access without adequately recognising collective rights. Governance frameworks should therefore be evaluated for whose interests they represent and whose risks they externalise.

Researchers should also avoid “ethics by document.” A signed DMP, consent form, or access agreement is not evidence that practice is safe. Controls must be implemented, monitored, reviewed, and revised. Incidents, near misses, unexpected findings, and participant concerns should trigger learning rather than concealment.

Current Developments and Best Practice

Current practice is moving toward machine-actionable DMPs, automated provenance capture, persistent identifiers for people and organisations, trusted research environments, privacy-enhancing computation, and reproducible research packaging. Data spaces and federated analysis may enable researchers to compute across distributed datasets without centralising raw records. These approaches are promising but depend on reliable metadata, interoperable policies, skilled personnel, and sustainable funding.

Good practice can be expressed as a disciplined sequence: classify data before collection; minimise what is gathered; obtain consent that reflects realistic uses; assign accountable roles; preserve provenance and documentation; separate identifiers; use proportionate access controls; test backups and recovery; choose repositories early; publish metadata and access conditions; involve affected communities; review permissions throughout the project; and document retention or destruction decisions.

The central professional judgement is proportionality. The strongest control is not always the most restrictive control. Governance should protect people and communities while preserving legitimate scientific value, reproducibility, and public benefit. That balance requires technical competence, ethical reasoning, legal awareness, and humility about what researchers do not know.

Chapter Summary

Research data governance coordinates authority, responsibility, policy, technology, and oversight across the data lifecycle. Lifecycle management begins with planning and classification, continues through collection, provenance, processing, quality assurance, storage, analysis, sharing, preservation, and retention or deletion. A living data management plan makes these decisions explicit and assigns responsibilities.

Provenance and metadata support interpretation, reproducibility, and accountability, while quality management records both strengths and limitations. FAIR promotes findability, accessibility, interoperability, and reuse; CARE adds collective benefit, authority to control, responsibility, and ethics. Data sovereignty requires attention to jurisdiction, community authority, and self-determination. Repository and access choices must reflect sensitivity, consent, cultural context, and re-identification risk. Security controls, privacy-enhancing technologies, automation, and AI can support governance but cannot replace human and community judgement. Responsible stewardship is an ongoing practice of proportionate protection, meaningful accountability, and ethically justified reuse.

Key Terms

Data governance: The policies, roles, processes, and controls that determine how data are managed and used.

Data lifecycle: The connected stages through which data are planned, collected, processed, used, shared, preserved, and deleted or retained.

Data management plan: A living document specifying how research data will be handled, protected, documented, shared, and preserved.

Provenance: The history of a dataset’s origin, custody, processing, and modification.

Metadata: Structured information describing data content, structure, context, rights, and technical characteristics.

Data stewardship: Responsible care and oversight of data on behalf of stakeholders and future users.

Custodian: An entity responsible for maintaining and protecting data without necessarily owning them.

Data quality: The fitness of data for a defined purpose, including accuracy, completeness, validity, and consistency.

FAIR principles: Principles requiring data to be findable, accessible, interoperable, and reusable.

CARE principles: Principles requiring collective benefit, authority to control, responsibility, and ethics.

Data sovereignty: The authority to govern data according to applicable laws, values, and jurisdictional or community rights.

Pseudonymisation: Replacing direct identifiers with codes while retaining a controlled possibility of linkage.

De-identification: Processing intended to reduce the association between data and identifiable persons.

Persistent identifier: A durable reference, such as a repository identifier, that supports reliable citation and discovery.

Controlled access: A model in which data use requires eligibility checks, approval, or specified conditions.

Data repository: A managed service that stores, documents, preserves, and distributes research data.

Least privilege: Providing users only the access necessary for their authorised tasks.

Retention schedule: A documented rule specifying how long records or data should be kept and when they may be destroyed.

Privacy-enhancing technology: A technical method designed to support analysis while reducing exposure of identifiable information.

Machine-actionable DMP: A structured data management plan that can be interpreted and processed by software.

Review Questions

Short Answer Questions

1. Distinguish data governance from information security.

2. What is the purpose of a provenance record?

3. Why is a backup not the same as an archive?

4. Define controlled access and give one example of when it is appropriate.

5. State the four FAIR principles.

Long Answer Questions

1. Explain the stages of a research data lifecycle and show how early planning affects later sharing and preservation.

2. Discuss the structure and function of a doctoral-level data management plan.

3. Compare FAIR and CARE, including situations in which their practical implications may differ.

4. Explain how metadata and data-quality practices support reproducibility and responsible reuse.

5. Analyse the roles of consent, data sovereignty, repository selection, and security in governing sensitive research data.

Analytical / Application Questions

1. A researcher wants to publish a dataset containing rare diagnoses, precise locations, and interview quotations after removing names. Identify the risks and design an appropriate access and documentation strategy.

2. A community objects to unrestricted publication of a dataset that a funder requires to be “open.” Using FAIR and CARE, propose a governance arrangement that preserves scientific value while respecting community authority.

3. A laboratory has data stored on personal laptops, no version history, and undocumented transformations. Develop a prioritised remediation plan covering security, provenance, quality, backup, repository deposit, and retention.

22. Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes a backup from an archive?

A. A backup supports recovery from loss, whereas an archive supports long-term intelligibility and preservation.

B. A backup always has stronger access controls than an archive.

C. An archive is used only for temporary working files.

D. A backup automatically provides complete metadata and provenance.

Correct Answer: A. A backup supports recovery from loss, whereas an archive supports long-term intelligibility and preservation.

Question 2

A dataset has persistent identifiers and rich metadata but includes culturally restricted knowledge released without community approval. Which conclusion is most accurate?

A. It fully satisfies responsible governance because it is FAIR.

B. It is technically discoverable but may fail CARE and data-sovereignty requirements.

C. It cannot be considered research data.

D. Its metadata must be removed to resolve the ethical problem.

Correct Answer: B. It is technically discoverable but may fail CARE and data-sovereignty requirements.

Question 3

What is the strongest reason to preserve a read-only copy of raw data?

A. It guarantees that no data will ever be disclosed.

B. It allows researchers to distinguish original observations from later transformations.

C. It eliminates the need for a data management plan.

D. It makes all derived datasets publicly accessible.

Correct Answer: B. It allows researchers to distinguish original observations from later transformations.

Question 4

Which access model is most appropriate when data are potentially re-identifiable but have substantial scientific value?

A. Unrestricted public download in all cases

B. No metadata or description of the dataset

C. Reviewed or controlled access with documented conditions

D. Deletion immediately after analysis regardless of obligations

Correct Answer: C. Reviewed or controlled access with documented conditions

Question 5

Which item is most characteristic of a strong data management plan?

A. A general statement that data will be stored securely

B. A list of software brands without assigned responsibilities

C. Specific controls, responsible roles, sharing conditions, and retention decisions

D. A promise that all future uses will be predicted exactly

Correct Answer: C. Specific controls, responsible roles, sharing conditions, and retention decisions

Question 6

Why does removal of names not necessarily make a dataset anonymous?

A. Names are never direct identifiers.

B. Quasi-identifiers and external datasets may enable re-identification.

C. Metadata always reveal every participant’s identity.

D. Anonymity requires deleting all research documentation.

Correct Answer: B. Quasi-identifiers and external datasets may enable re-identification.

Question 7

In the illustrative Northbridge case, why was unrestricted open release rejected?

A. The funder prohibited all repository deposits.

B. The dataset had no scientific value outside the university.

C. Privacy, consent, cultural restrictions, and collective authority created significant risks.

D. FAIR principles prohibit sharing health data.

Correct Answer: C. Privacy, consent, cultural restrictions, and collective authority created significant risks.

Question 8

Which action best reflects the principle of least privilege?

A. Giving every project member administrator access

B. Using one shared account for convenient auditing

C. Providing each authorised user only the access needed for a defined task

D. Allowing access permanently once it has been granted

Correct Answer: C. Providing each authorised user only the access needed for a defined task

Question 9

What is a central limitation of automated data classification and AI-based governance tools?

A. They cannot process any metadata.

B. They may misclassify sensitive material and cannot replace contextual human judgement.

C. They make encryption technically impossible.

D. They eliminate the need for community participation.

Correct Answer: B. They may misclassify sensitive material and cannot replace contextual human judgement.

Question 10

Which statement best expresses proportional research data governance?

A. All research data should be public regardless of risk.

B. The most restrictive possible control is always ethically superior.

C. Controls should correspond to sensitivity, purpose, risks, rights, and scientific value.

D. Governance is complete once ethics approval is obtained.

Correct Answer: C. Controls should correspond to sensitivity, purpose, risks, rights, and scientific value.