3341-7-15 Research Data Protection, Security, and Ownership

1. Policy Statement and Purpose

   1. Bowling Green State University (BGSU) is committed to ensuring responsible stewardship, protection, and management of Research Data (as defined in this policy). BGSU asserts institutional ownership of Research Data generated under university research activities and establishes obligations for proper collection, management, security, storage, access, sharing, confidentiality, retention.

      This policy is intended to promote compliance with:

      1. Federal and state data protection laws;
      2. Sponsor and funding agency requirements;
      3. University research integrity and security standards; and
      4. Requirements for transparency, reproducibility, and responsible research.

   2. Purpose of the Policy

      The purpose of this policy is to:

      1. Define ownership, responsibilities, access rights, and security expectations for Research Data;
      2. Safeguard the confidentiality, integrity, availability, and long-term stewardship of Research Data;
      3. Support compliance with federal, state, and contractual requirements;
      4. Promote ethical and transparent research practices; and
      5. Establish high-level obligations for collection, storage, retention, archiving, sharing, and preservation.

      Procedures, detailed workflows, and specific technical requirements will be maintained separately by the Division of Research.

   3. Governing Principles

      1. Integrity and Accuracy - Research Data must be collected, stored, and maintained in a manner that supports transparency, reproducibility, and verification of research findings.
      2. Security and Protection - All Research Data must be protected from unauthorized access, disclosure, alteration, or destruction.
      3. Compliance - All BGSU researchers must comply with applicable laws, sponsor terms, intellectual property requirements, data-use agreements, and University standards.
      4. Stewardship - Principal Investigators are the primary stewards of Research Data but must manage data in accordance with University oversight and ownership.

2. Policy Definitions

   1. Research

      A systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge (45 CFR 46.102(d)).

   2. Research Data

      Any records, materials, or results needed to replicate, validate, or verify research findings.

   3. Research Record

      Documentation that describes, explains, or supports Research Data.

   4. Principal Investigator (PI)

      Individual responsible for the intellectual direction and administrative oversight of a project and managing Research Data stewardship.

   5. Metadata

      Information required to interpret or reproduce Research Data.

3. Policy Scope

   1. Research Data Ownership

      Institutional ownership ensures BGSU’s ability to fulfill legal and regulatory obligations, respond to audits or investigations, protect Research Data if a PI leaves the University, and preserve research continuity. Researchers may keep a copy of Research Data as permitted but original datasets are University property.

      BGSU asserts institutional ownership of Research Data generated from:

      1. University-administered funding, including all forms of sponsored projects such as grants, contracts, cooperative agreements, subawards, fellowships, internally funded programs, and any other externally or internally supported research, scholarly, or creative activity administered through the University.
      2. Under any institutional agreement, memorandum of understanding, data use agreement, material transfer agreement, collaboration agreement, or other formal partnership entered into by the University or its personnel acting on behalf of the University, unless the agreement explicitly assigns ownership elsewhere.
      3. Research conducted by University personnel, including faculty and staff when acting within the scope of their employment, and students when working on projects that fall under this policy (e.g., projects funded, supervised, or otherwise supported by the University).
      4. Research using University resources, including equipment, facilities, core facilities, or infrastructure, as well as research conducted by visiting researchers, external collaborators, contractors, or other non BGSU personnel when such research relies on University owned or University managed facilities or infrastructure.

   2. Research Data Protection and Security

      Researchers must:

      1. Implement appropriate administrative, physical, and technical safeguards;
      2. Protect confidential, limited access, or restricted data;
      3. Comply with data-use agreements, IRB/IACUC/IBC requirements, and sponsor mandates;
      4. Prevent unauthorized access or disclosure;
      5. Utilize standardized metadata schemas (such as the FAIR principles—Findable, Accessible, Interoperable, and Reusable) to support enterprise data cataloging and long-term archiving; and
      6. Ensure Research Data is stored using approved University systems.

      Research data protection and security must align with BGSU ITS Data Protection Standards.

      Research covered by this policy may be subject to additional review and approval or disapproval by officials of BGSU.

      Inappropriate attempts to influence the compliance process, individual compliance members, or Research Integrity staff will be reported to the Vice President for Research. The Vice President for Research will investigate and appropriately respond to these concerns and has the authority to limit or remove an Investigator’s privilege to conduct research after due process.

   3. Research Data Retention

      Minimum retention:

      1. Seven (7) years after final publication or project completion, whichever occurs later.
      2. Longer if required by sponsors, regulations, contracts, litigation holds, or compliance reviews.

      Retention must follow University records management requirements.

      If Research Data is not actively being securely preserved at the end of its required retention lifecycle, it must be purged or securely destroyed in accordance with BGSU Records Management requirements and approved data destruction practices to prevent unauthorized access and mitigate the risk of data breaches.

   4. University Access to Research Data

      BGSU may access Research Data for:

      1. Regulatory or compliance investigations;
      2. Grant or sponsor audits;
      3. Research misconduct proceedings;
      4. Public records obligations, when applicable; and
      5. Ensuring continuity when a PI leaves.

      PIs must provide access to Research Data upon reasonable request.

      Collaborators have reasonable access to Research Data required to continue their work.

   5. Leaving the University

      When a PI or research personnel leave BGSU:

      1. Original Research Data must remain with BGSU;
      2. A copy may be taken with permission (unless restricted by law or contract);
      3. Transfers of original Research Data require formal University approval. Departing researchers must follow BGSU’s separation procedures; and
      4. The Research Integrity Director may assume custody of Research Data to ensure compliance or continuity.

   6. Research Data Sharing & Archiving

      Researchers are encouraged to share Research Data when appropriate, following:

      1. Ethical standards;
      2. Legal/privacy protections;
      3. Sponsor/public access requirements; and
      4. Intellectual property considerations.

      Limited access or restricted data may only be shared with proper approvals and agreements (e.g., Data-Use Agreements).

   7. Review by Institution

      Research Data management activities may be subject to additional review by BGSU officials; however:

      No BGSU official may authorize the transfer, release, or destruction of Research Data that violates this policy, federal regulations, sponsor terms, or contractual obligations.

   8. Use of Procedures

      Research Integrity will maintain procedures that address:

      1. Secure storage;
      2. Access management;
      3. Data collection practices;
      4. Data retention schedules;
      5. Archiving and public access procedures;
      6. Data sharing and transfer requirements;
      7. Transfer and departure workflows; and
      8. Data breach and incident reporting.

      Procedures will be published separately and updated as needed.

   9. Compliance

      Failure to comply with this policy may result in:

      1. Suspension of research privileges;
      2. Corrective action requirements;
      3. Disciplinary action under University policies;
      4. Reporting to funding agencies or regulatory bodies; and
      5. Required audits or reviews.

      Misconduct involving falsification, fabrication, or destruction of Research Data will follow the University’s research misconduct procedures.

4. Policy Provisions

   1. Responsible Office

      The Division of Research is responsible for the oversight and implementation of this policy.

   2. Implementation of Policy

      WHO	TASK
      Vice President for Research	Oversight; enforcement; investigation of concerns.
      Division of Research / Research Integrity	Maintain procedures; provide training; coordinate compliance; ensure secure data management systems.
      Principal Investigators	Steward Research Data; ensure proper collection, access, retention, security, sharing compliance, and adherence to all applicable requirements.

5. Related University Policies

   1. 33341-7-5 - Research and Sponsored Project Integrity and Misconduct
   2. 33341-7-7 - Protection of Human Subjects
   3. 33341-7-8 - Protection of Vertebrate Animals
   4. 33341-7-11 - Export Control
   5. 3341-7-14 - Material Transfer, Data Use, and Confidentiality

6. Related Government Policies and Guidance

   1. Federal data sharing and retention guidelines
   2. Sponsor-specific data management requirements
   3. Privacy and confidentiality laws (e.g., FERPA and HIPAA where applicable)
   4. Records retention and destruction regulations
   5. General Data Protection Regulation (GDPR)
   6. The Personal Information Protection Law (PIPL)

Registered Date: October 22, 2026