Policy providing requirements and standards for students storing research datasets.

Purpose

The purpose of this policy is to outline the guidelines and restrictions for storing research data by students at Booth. Ensuring the confidentiality, integrity, and availability of research data is paramount to maintaining ethical standards and compliance with institutional, legal, and funding body requirements.

Scope

This policy applies to all students involved in research activities at Booth, including but not limited to MBA, MiM/MiF and PhD students. It covers all forms of research data, whether digital or physical, collected or generated during the course of research.

Definitions

Research Data: Any recorded information (regardless of form or medium) necessary to support or validate research findings, including raw data, processed data, and metadata.

Storage Systems: Any digital or physical system used to store research data, including cloud services, external hard drives, institutional servers, and personal devices.

Policy

Approved Storage Systems

1. Research data must be stored only on approved storage systems provided or sanctioned by Booth.
2. Approved digital storage systems include:
   1. Institutional servers with proper security measures.
      1. This includes project shares on the EMC Isilon, research servers and VM’s, directories within Mercury and other research systems, and RCC research systems.
   2. Authorized cloud storage services.
      1. This includes University Box accounts configured for group/department use, Faculty Dropbox accounts, and University provisioned AWS/Azure/GCS accounts.
3. Physical data (e.g., paper records) must be stored in secured locations with restricted access.

Prohibited Storage Systems

1. *Personal devices such as personal laptops, smartphones, and tablets are not approved for storing research data.
2. Unauthorized cloud services (e.g., personal or student provisioned Dropbox, Google Drive, etc.) must not be used for storing research data.
3. External hard drives and USB drives may only be used with explicit approval and must be encrypted.

*Booth owned laptops are not recommended for data storage. These devices can be lost, stolen, damaged, or have hard drive failures.  Research data should always be stored on a platform with persistence and fault tolerance.

Data Access and Sharing

1. Access to research data should be restricted to authorized personnel only.
2. Sharing of research data with external parties must comply with Booth’s data sharing agreements and policies.
3. Collaborative research data sharing must use secure, Booth-approved methods.

Data Security and Encryption

1. All digital research data must be encrypted at rest and in transit using institution-approved encryption standards.
2. Physical data must be stored in locked cabinets or rooms with access limited to authorized personnel.
3. Regular backups of research data should be performed and stored securely on Booth-approved systems.

Data Retention and Disposal

1. Research data must be retained for a minimum period as specified by funding bodies, regulatory requirements, or University policies.
2. Upon conclusion of the retention period, data must be securely disposed of using Booth-approved methods for data destruction that are in compliance with any contractual obligation.

Responsibilities

Students: Ensure compliance with the data storage policy and report any breaches or issues to the supervising faculty member or Information Security.

Supervising Research Faculty: Oversee student adherence to the policy and provide guidance on approved storage systems and practices.

Information Security: Monitor compliance and activity.  Conduct audits.

Data Governance: Provide support and training on data storage policies.

Policy Review

This policy will be reviewed annually and updated as necessary to reflect changes in technology, regulations, and institutional practices.

Contact Information

For questions or further information regarding this policy, please contact Information Security.