Your Research Data Management Team
Senior Research Data Management Librarian
Storage Tips and Guidelines
(Adapted from Figure 1 in Elvira-García, Wendy & Farrús, Mireia & Garrido, Juan-María. (2023). Comparison of intensity-based methods for automatic speech rate computation. Loquens. 9. e090. 10.3989/loquens.2022.e090 with a Creative Commons Attribution 4.0 International license.)
Data Storage and Backup are key to your research data management strategy. When deciding how and where to store your data, consider security, data sensitivity, backup processes, collaboration (internal or external), and storage capacity.
Store research data securely. Use a strong password for accessing websites, email accounts, or your computer. Store sensitive data that is on paper documents or transportable media, such as portable external drives, in a safe or locked file cabinet.
Regularly maintain backup copies in at least three locations. The 3-2-1 backup principle is to keep three copies of your files on at least two different media with one offsite. Find out the backup schedule and retention policies of any centralized backup services you may use. Using only laptops, computer hard drives or external storage devices to store data is risky.
Consider individual storage vs. group storage. Individual storage files will be deleted when the owner leaves the institution. To retain the files, ownership must be transferred. Group storage decreases risk of data loss caused by team member departures. However, group storage accounts may not work for projects that contain data subject to data use agreements restricting access to certain named individuals.
Consider storage capacity. Size limits may prevent storage of large files, such as videos or 3D images. File number and sync limitations may not work for projects that generate many small files.
| Access Control | How will you control access to keep the data secure? How will you ensure that collaborators can access your data securely? If creating, or collecting data in the field, how will you ensure its safe transfer into your main secured systems? |
| Sensitivity | Does your data contain personal information? Do you have Institutional Review Board (IRB) requirements? University Data Protection Standards provide protection guidance for highly sensitive data, sensitive data, internal use data, and public data. |
| Backup | How will the data be backed up? How much drive space or CDs or DVDs will be required to maintain a backup schedule? Who will be responsible for backup and recovery? How will data be recovered in the event of an incident? How long will your backups be stored? |
| Storage | How much data do you need to store? 5 megabytes (MB)? 5 gigabytes (GB)? 5 terabytes (TB)? Do you have enough storage or will you need to include charges for additional services? |
- Why Can’t I just use Dropbox? A comparison of cloud file storage platforms used for researchThis journal article compares individual vs group ownership, storage capacity, and file organization features of four cloud file storage platforms: Box, DropBox, Google Drive, and Microsoft SharePoint/OneDrive.
- University Data Protection Standards (UDPS 3.0)These standards are maintained by UVA Information Security (InfoSec). They cover six areas of data protection for highly sensitive, sensitive, internal use, and public data: Responsibility for Data, Data in Transmission, Data Storage and Destruction, Shared Devices (e.g., Servers, Network Attached Storage, Disk Arrays), Individual-Use Electronic Devices (e.g., Desktop Computers, Laptops, Tablets, Smart Phones, Mobile Devices), Assessing and Managing Risk
- Information Security (InfoSec)InfoSec provides information security consultation, guidance, and investigative support to the UVA community.
- Data Sensitivity Classifications and ExamplesExamples of highly sensitive, sensitive, internal use, and public data are provided. Data Sensitivity Classifications and Examples is part of the UVA University Data Protection Standards.
UVA Storage and Backup Options
One straightforward way to apply the 3-2-1 principle at UVA, is to store one local copy on your laptop, a second local copy on an external hard drive, and a remote copy on a secure option in the cloud (OneDrive and UVA Box may be used for public and sensitive data). Caveat: Make sure this storage and backup system is appropriate for your data given sensitivity levels and size. Make sure that your system follows University Data Protection Standards requirements.
UVA Box and OneDrive are not intended for highly sensitive data, such as health information, social security numbers or export-controlled research. Contact the UVA Information Security Office for information about storing highly sensitive data.
Files associated with an individual storage account, such as OneDrive or UVA Box, will be deleted when the owner leaves UVA. If you have an individual storage account, see OneDrive or UVA file management guidance for those leaving UVA.
Consider Microsoft Teams or Microsoft Groups for a group storage account. Group storage decreases data loss caused by team member departures. Be aware though that group storage accounts may not work for projects containing data subject to data use agreements restricting access to certain named individuals.
Consider Research Data Storage for research data measured in Gigabytes (GB), Terabytes (TB), and Petabytes (PB). UVA Research Computing provides this service. ITS also provides tiers of data storage for personal and non-research storage needs.
(The database backup image above is a Windows 8 icon available with a Universal Multimedia License Agreement for Icons8.)
- OneDrive (Microsoft 365)UVA faculty, staff, and students have access to OneDrive for Business through their Academic Microsoft 365 (formerly Office 365) accounts at UVa. UVA users receive 5 TBs of storage (no increases allowed).
- Box (UVA Box)UVA Box is a free, cloud storage for eligible students, faculty, and staff to store up to 1 TB of non-sensitive/sensitive University files securely – anywhere, anytime, on any device, for as long as they're at UVA.
- SharePoint (Microsoft 365)You can use SharePoint store and share files, build websites, intranets, and dashboards at UVA. SharePoint is a group collaboration platform. It is the underlying service for Microsoft Teams and Microsoft Groups
- Research Data StorageResearch Computing, a division of UVA ITS, offers Research Data Storage for large-scale data that can be measured in GB, TB, or PB. Options are available for public, internal use, sensitive and highly sensitive data.
- Storage Home (ITS)Provides tiers of data storage for personal and non-research storage needs.
- Information Technology Services (ITS) Storage, Hosting & ServersITS offers storage, server, cloud, and backup solutions for UVA researchers.
Data De-identification Resources
When generating new data from human subjects, you may need to redact your data to avoid re-identifying individuals. However, the process of de-identifying data must be customized for each situation with factors involving characteristics of the data itself and how the data will be used. Research Data Services has not identified an authorized vendor who can provide an automated system for de-identification and does not endorse any de-identification software.
Below are UVa services that can help in addition to software tool lists compiled by the National Institute of Standards and Technology (NIST) and Johns Hopkins University.
(The figure above, created by Utsa099, is available from Wikimedia Commons with a CC BY-SA 4.0 license.)
- Research ComputingResearch Computing can help researchers write code to de-identify their data for a fee. Researchers must upload their data to Ivy, a secure high performance computing environment, and provide de-identification rules. Consultation fees vary depending on the size of the data set and the complexity of the de-identification task. There is also a fee for access to Ivy. Ask for support on the Data Analytics Center request form.
- Research and Clinical Trials Analytics (RCTA)RCTA, like Research Computing, also provides a service for de-identifying data for research projects at UVA,and will work with non-UVA Health/School of Medicine researchers. They offer a one-hour free consultation, and an hourly fee thereafter. Contact RCTA at RESEARCHDATA@uvahealth.org.
- Information Security (InfoSec) ComplianceInfoSec Compliance will review a specific vendor if requested. However, InfoSec has no recommendations for data de-identification tools.
- NIST Disassociability ToolsThis page is on the NIST Privacy Engineering Program site.
- Software for De-identificationThis is a page on the Johns Hopkins University Protecting Human Subject Identifiers guide.