Research Data Management

Security & Privacy

Ensuring research data security and privacy is a critical element to consider and plan for when starting any new research project. An increasing number of grants are now requiring that researchers clearly identify the risks associated with their research data along with clear procedures and safeguards that will be in place to mitigate and address those risks. To take a proactive approach, researchers must require that cybersecurity best practices are strictly followed at the points in which data is collected, stored, accessed, and processed.

UBC researchers that plan to collect and store research information should consider contacting UBC Advanced Research Computing (ARC) for guidance and support to ensure data is properly protected. Furthermore, if the research encompasses any data that could be considered sensitive, contacting ARC is STRONGLY recommended.

Access

UBC Geog IT provides direct support to faculty and research assistants to ensure that local hardware is compliant with UBC’s standards for securely accessing research data. This includes ensuring laptops and desktops have full disk encryption, access control for system administration, and installation of UBC IT-provided malware protection. Additionally, researchers with machines connected to Geography’s local network have additional protection through multiple firewalls.

Maintaining secure computing environments is a collaborative process though, and ultimately, it is the responsibility of the researcher to ensure that any machines that are used for accessing their project’s research data, including those used by their research assistants, are effectively secured. Part of this includes ensuring machines are protected with a password or passphrase that complies with ISS U2, have been setup to automatically lock after, at most, 30 minutes of inactivity, and receive routine updates to the operating system and any installed software1. Depending on the risk levels associated with a researcher’s data, the restrictions noted above may need to be more stringent.

Before sharing research data with recently hired research assistant, ensure that they have completed the following UBC training modules.

  • Privacy & Information Security Fundamentals Training Part 1 & 2

Also consider reviewing and assigning the following modules:

Collection & Storage

Even if a project does not include Personal Identifiable Information (PII) or other sensitive data, classifying research information that will be collected, stored, and analyzed through the lifetime of a research project is an important to step to identify and assess risk levels that may be associated with the project.

Both UBC IT and UBC ARC provide tools and services, like REDCap for data collection and OneDrive for data storage, which are thoroughly reviewed to ensure compliance when working for sensitive data. Any tools that rely on external service providers will need to go through a Security Threat Risk Assessment (STRA) to ensure that the tool complies with privacy legislation and effectively mitigates known security threats.

UBC ARC’s REDCap Security and Privacy provides a good example of the kind of information that would be gathered and documented through an STRA.

Data Collection Systems

For survey or form-based data collection, UBC researchers can access either of two FIPPA-compliant systems, REDCap, which is managed by UBC’s Advanced Research Computing (ARC) team, or Qualtrics, which is a vendor-supported cloud service that UBC IT manages a subscription for.

REDCap

REDCap is ideal for academic research, particularly when working with sensitive data and/or running a long-term research project. Many academic institutions support their own REDCap instances, and it’s often used for medical research. For offline data collection, REDCap provides a mobile app.

UBC Survey Tool (Qualtrics)

Qualtrics works best for quickly developing surveys for assessments or short-term research projects. It provides a ton of features alongside a modern and user-friendly interface. A mobile app is also available for offline data entry.

LimeSurvey

LimeSurvey is a free and open-source alternative to REDCap and Qualtrics. While UBC researchers do not have direct access to LimeSurvey, an instance can be easily deployed via a VM on the Alliance Cloud infrastructure. Generally, REDCap and Qualtrics are better options, but LimeSurvey can be a helpful tool to be aware of when collaborating with small organization who need to retain ownership and access to collected research data.

Footnotes

  1. UBC ARC (2025, March 13). UBC Research Security Compliance Checklist. https://arc.ubc.ca/media/document/arc-securitycompliancechecklist-fillablepdf↩︎