Outlier Science
Confidentiality and Research Information
Research materials can contain unpublished findings, personal data, confidential institutional information or intellectual property. Before detailed files are shared, the project should establish what information is needed, who may access it and the conditions governing its use.
On this page 8 sections
01
Begin with a description
The initial inquiry can explain the research question, project stage and support needed without including confidential files. Do not enter participant identifiers, sensitive personal information or restricted research material into the contact form.
A short description allows the likely scope and information requirements to be discussed first. If the assignment needs detailed material, the appropriate transfer route and responsibilities can then be agreed.
The public inquiry form is not a research-data repository. Sending a message should not be treated as approval to upload a full dataset or a confidential manuscript through an unconfirmed channel.
02
Establish the right to share
The client should confirm that it has the necessary authority to provide the material and commission the proposed work. Relevant restrictions may come from participants, collaborators, institutions, funders, employers, contracts or data providers.
Access to a dataset does not automatically permit onward disclosure. A research team should check the original conditions and any additional requirements before providing material to an external contributor.
Where personal data are involved, the appropriate roles and legal arrangements depend on the actual processing. The scope should identify these questions for the responsible institutional or legal contact. A general confidentiality statement does not replace a required data-processing or data-sharing agreement.
03
Share only what the work requires
The information package should be proportionate to the task. A methods consultation may need a protocol and a data dictionary rather than participant-level records. An initial manuscript assessment may need selected sections before the full set of supplementary materials.
Where identifiers can be removed without undermining the task, the responsible research team should consider doing so. De-identification needs care: removing names does not necessarily prevent identification from combinations of other information. The GDPR’s discussion of identifiability is one relevant legal reference where EU data-protection law applies.
The scope should identify any data that must remain within an institutional environment or be accessed only under specific conditions. If the available arrangement cannot meet those requirements, the work or method of access needs to change before transfer.
04
Agree access and transfer arrangements
Before substantive work begins, agree the authorised people, the approved transfer route and any restrictions on downloading, copying or onward disclosure. The arrangement should fit the sensitivity and contractual conditions of the material.
If an external specialist is needed, their role and access should be addressed explicitly. Client permission for a defined assignment should not be interpreted as permission for unrestricted distribution.
Any proposed confidentiality agreement should be reviewed and accepted before the information it is intended to cover is shared. The agreement should identify the parties, material, purpose and relevant exceptions or obligations. No particular contract or security feature should be assumed from an inquiry alone.
05
Define permitted use and AI restrictions
Project material should be used only for the agreed purpose. Reuse for publicity, examples, training or a different project requires a separate basis and appropriate permission.
Third-party AI tools need explicit consideration. A manuscript, dataset or confidential proposal should not be uploaded merely because a tool is convenient. The project must establish permission, relevant safeguards and compatibility with institutional, funder, journal and contractual requirements.
Where AI use is authorised, the scope should identify the permitted material and task, the checking responsibility and any documentation or disclosure needed. Read the research integrity principles for expectations around accountable use.
06
Set retention and handover requirements
The agreement should state which project records are retained, why they are needed and the applicable retention or deletion arrangements. A single period may not suit every type of material or contractual obligation.
Handover should identify the final outputs and any working files included. It should also address the client's continued access and responsibility for preserving research records required by its institution or funder.
Deletion and return requests need to be considered alongside legal, contractual and technical constraints. The actual process and any limits should be explained in the agreement and the applicable privacy information, rather than assumed.
07
Questions before sharing
Can I send a manuscript with the first message?
No upload is required in the initial inquiry. Describe its subject, stage and the support you need. Detailed sharing arrangements can be discussed after suitability and information requirements are clearer.
Can we use our institution's confidentiality agreement?
An institutional agreement can be considered during scoping. It needs to be reviewed and accepted by the appropriate parties before covered information is transferred. Its requirements may affect access, delivery methods or the suitability of the assignment.
Is removing names enough to make data anonymous?
Not necessarily. Other fields or combinations may identify a person. The responsible research team should assess the risk and determine what can lawfully and appropriately be shared. A consultant should not assume that a file is anonymous because it lacks a name column.
Can you work without receiving the full dataset?
Some tasks can use a protocol, variable dictionary, aggregate outputs or an appropriately prepared example. Whether this is sufficient depends on the question. The scope should make clear what conclusions can and cannot be reached from limited access.
08
Discuss information requirements first
Describe any institutional restrictions or confidentiality concerns in general terms. The next step is to determine the minimum material needed and the arrangements that must be in place before the work can proceed.