University Data Management Plan: What Must Be Included

A data management plan should be treated as an operational guide, not a formal attachment. Without clear ownership and lifecycle rules, teams face compliance risks and analysis delays. A practical plan defines what data is collected, who can access it, where it is stored, and when it is deleted.

Start by classifying data into sensitivity tiers. For example: public metadata, internal operational data, and restricted personal or clinical data. Each tier should have its own storage, transfer, and access rules. This segmentation reduces accidental exposure and improves governance clarity.

Role-based access should be mapped before data collection begins. Define which roles can view, edit, export, or share each data class. Access controls should follow the principle of least privilege. Teams that apply this early usually experience fewer compliance incidents later.

Retention and deletion windows must be explicit. Many institutions store everything indefinitely, which increases legal and operational risk. Define archival rules by data type, connect them to legal requirements, and set responsible owners for deletion approvals and execution.

Versioning and documentation are equally critical. Every transformation step in analysis should be traceable to script version and source dataset. If outputs are challenged, reproducible version history allows teams to respond quickly with evidence.

Finally, document sharing and citation permissions for internal and external collaborators. When publication starts, unclear reuse rights become a major bottleneck. A clear policy from day one makes collaboration faster and protects both institutional and researcher-level accountability.