Data Deposit Considerations for Sensitive Data

Should I deposit my research data to a data repository?

Data deposit and sharing promote open science and have become common practice across research domains
However, not all data should be shared publicly
Learn more about assessing risks associated with publishing sensitive data, such as human participant data, below.

Getting Help

Email yul_rdm@yorku.ca to book a consultation or receive email support from the Libraries’ research data management team.
Office of Research Ethics (Provides support for research involving human participants)
Office of the VPRI's Safeguarding Research resources (Provides support to navigate research security requirements)

Although data deposit and sharing promote open science and have become common practice across research domains, not all data should be openly shared. Human participant data and other sensitive data must be handled with care and in accordance with relevant research ethics frameworks, such as the Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans (TCPS 2, 2022). Researchers are responsible for assessing the risks associated with data disclosure, determining appropriate data deposit and access conditions for their research outputs, and obtaining informed consent from research participants that aligns with these data deposit and sharing practices.

The below resources provide guidance on data disclosure risk levels and considerations researchers should keep in mind if they plan to deposit final research data. Additionally, resources have been included on York University Dataverse's guidelines for sensitive research data.

Data disclosure risk levels	Low risk	Medium risk	High risk	Extreme risk
Definition	Public data identifiability [no] Vulnerability [no] Sensitivity [no]	Identifiability [can be de-identified] Vulnerability [no] Sensitivity [maybe]	Identifiability [yes] Vulnerability [maybe] Sensitivity [yes]	Identifiability [yes] Vulnerability [yes] Sensitivity [yes]
Retention	Data may be retained indefinitely.	Data may be retained indefinitely.	Data may be retained indefinitely in an appropriate secure environment.	Data must be destroyed in accordance with the Office of Research Ethics -approved protocol.
Deposit	Data can be deposited with unrestricted access.	Data from participants who opt out must be separated from data to be deposited. De-identified data can be deposited with unrestricted access .	Data from participants who opt out must be separated from data to be deposited. De-identified data should be deposited with restricted access	Data should not be deposited anywhere.

Adapted from "Human Participant Research Data Risk Matrix" by the Digital Research Alliance of Canada Sensitive Data Expert Group.

Note: Research contexts where additional ethics review processes and approvals are required may result in data needing to be restricted regardless of the results of data disclosure risk level assessments.

Data disclosure risk levels	Low risk	Medium risk	High risk	Extreme risk
Consent requirement	Notification that data will be made available for future unspecified research use	Notification that de-identified versions of the data will be made available for future unspecified research use Option to opt-out should be considered	Notification that data may be made available for future unspecified research use Formal opt-in for data deposit If possible, provide options regarding areas of future research (e.g., use for this study only, only for studies in this subject area, or for any use).	Confidentiality will be maintained for as long as the data exist Specific considerations for re-use or data will not be shared beyond the research team

Adapted from "Human Participant Research Data Risk Matrix" by the Digital Research Alliance of Canada Sensitive Data Expert Group.

York University Dataverse, York’s institutional data repository, does not accept data that contains sensitive or confidential information. Data must be anonymized and de-identified before deposit.

York University Dataverse is part of Borealis: The Canadian Dataverse Repository (Borealis). Because of this, York University Dataverse’s deposit guidelines aligns with Borealis’ guidance on the deposit of sensitive and confidential data, including human participant data. Please refer to the following documents for more information:

The Digital Research Alliance of Canada Sensitive Data Toolkit for Researchers:

Last updated: August 2026