DATA MANAGEMENT PLANS: A Risk-Informed Approach

Data are central to human research, and the integrity, security, and handling of data are each critical to the integrity, transparency, and reproducibility of research. They demand careful custodianship and care, and these matters must not be left to chance. But how should data be properly managed? What are data management plans (DMPs) and why are they important—if at all? Should an existing template be used or is it best to develop a bespoke DMP from scratch? What are the essential elements of these plans? What is the best way to develop a DMP? We address these questions by drawing on both the DMP and risk assessment literature. Our central argument is that while a multitude of templates and tools exist, a one-size-fits-all approach works against DMPs that are practical, useful, and user-friendly—and most importantly, not onerous. We propose an approach for mapping research designs onto DMPs that draws on ‘threat modelling’ as practised by information security professionals.