Research in progress
Data storage
We recommend using storage that is managed or contracted by the University wherever possible. The University’s recommended storage facilities also have options to help with collaborative working and data sharing with colleagues at the UofG and elsewhere.
You need to consider where the data will reside while you are working on it and where it will be deposited for long-term storage once it is finalised.
Working with sensitive data
If you are working with any data which is subject to data protection legislation or which requires ethical approval or is provided to you under a confidentiality agreement, you will need to select appropriate storage to meet those requirements.
For more information about this, please review UofG confidential data guidance; also refer to the project initiation workflow for research involving personal data, and there is Open Research training available to staff and PGR students around data management, including sensitive data.
Central data storage options
CARDS Service
Central Active Research Data Storage (CARDS) Service
Use for:
Active, project-owned research data that needs a managed allocation, controlled access, a defined lifecycle, or TB-scale capacity.
- The robust processes surrounding the CARDS service facilitate data lifecycle planning and transition to long-term storage at project end.
Be aware:
This is a mounted network drive, not a web-sharing or synchronisation service. The Standard tier includes managed backup. The Basic tier has no managed backup or replication.
Charges apply to allocated capacity above the 1TB free allowance per service engagement.
Key features:
- Recommended option
- Free quota: 1TB per project
- Collaboration: Internal - Yes. External by arrangement.
- Edit shared documents together: No
- Sync to local machine: No
- VPN needed for remote access: Yes
- Backups: Yes, unless opted out
- GDPR concerns: No
Microsoft 365
Teams / SharePoint
Use for:
- Everyday collaboration where the Microsoft 365 service is suitable for the project.
- SharePoint is the file store underlying Teams and can be accessed via the shared tab in Teams or in SharePoint.
- Each Team and each private channel is a separate SharePoint site.
Be aware:
Do not use where a funder or agreement requires data to be stored physically within the University.
- Storage is currently limited to 2GB per Team, but modest increases can be requested.
- This solution could be used for collaboration on documents while the data is held in CARDS. It's GDPR compliant, but there are potential GDPR risks around users granting access and links.
- Sharing risks can be mitigated with training and awareness.
Project teams must do data management planning at project initiation to ensure end-of-project transition from this platform to long-term storage for data that will be kept.
Key features:
- Recommended option
- Free quota: 2GB per Team
- Collaboration: Internal and external - Yes
- Edit shared documents together: Yes
- Sync to local machine: Yes
- VPN needed for remote access: No
- Backups: Yes
- GDPR concerns: Risks around sharing links
OneDrive for Business
Use for:
Personal working files where the Microsoft 365 service is suitable for the project.
Be aware:
Do not use where a funder or agreement requires data to be stored physically within the University.
- Files held in OneDrive will be removed when the owner leaves UofG.
- Storage strictly limited to 100GB for staff and 50GB for students.
- GDPR compliant but with potential risks around users granting access and link sharing that can be mitigated with training and awareness.
You must do data management planning at project initiation to ensure end-of-project transition from this platform to long-term storage for data that will be kept.
Key features:
- Recommended option
- Free quota: 100GB per person
- Collaboration: Internal and external - Yes, but there is a data loss risk if the owner leaves UofG.
- Edit shared documents together: Yes
- Sync to local machine: Yes
- VPN needed for remote access: No
- Backups: Yes
- GDPR concerns: Risks around shared links
Network drives
Mapped network drives
Use for:
Eligible University work using a centrally managed network drive, for example, the J: drive, where other recommended storage options are unsuitable.
Be aware:
Network drives can be limited by availability, allocation, collaboration, backup, and support arrangements vary; confirm them with the relevant IT team.
Project teams must do data management planning at project initiation to ensure end-of-project transition from this platform to long-term storage for data that will be kept.
Key features:
- Acceptable option
- Free quota: Varies
- Collaboration: Internal - Yes. External - No.
- Edit shared documents together: No, only one editor at a time
- Sync to local machine: No
- VPN needed for remote access: Yes
- Backups: Yes
- GDPR concerns: No
Trusted Research Environment
UofG Trusted Research Environment (TRE)
Use for:
- Safe access to sensitive health data: ensuring secure access to electronic health records and patient privacy
- Exploring personal and confidential information while adhering to the highest legal and ethical standards.
- Guided by the Five Safes Framework and certified under the Cyber Essentials Plus and NHS Data Security and Protection Toolkit, the University of Glasgow TRE operates from a Tier 3 ISO 27001 data centre.
- The TRE would be recommended when working with very sensitive data, pseudonymised datasets from real-world sources like the NHS, or when instructed under a Data Processing or Sharing Agreement if holding data for a non-UofG data controller.
While the TRE team are based within MVLS, they can support any UofG project that needs a TRE.
Be aware:
Charges apply to this service with storage costed per project.
Key features:
- Recommended option
- Free quota: No
- Collaboration: Internal and external - Yes
- Edit shared documents together: No
- Sync to local machine: No
- VPN needed for remote access: Yes
- Backups: Yes
- GDPR concerns: No
Other storage options
Departmental and school drives
Some schools may have their own networked storage and opt out of the centrally provided offerings.
Be aware:
The arrangements are likely to differ from the central IT storage provision in terms of quotas, backups, etc.
Key features:
- Acceptable option
- Free quota: Varies
- Collaboration: Internal - Yes. External - No.
- Edit shared documents together: No, only one editor at a time.
- Sync to local machine: No
- VPN needed for remote access: Yes
- Backups: Check with your local IT support
- GDPR concerns: Check with your local IT support
If you have any specific support queries about departmental and school drives, please contact your local IT support.
Specialist project services
In order to conduct your research, your project may need to use tools or storage with functionality which is not offered centrally by the University.
Be aware:
- If researchers choose to use such options, they should check that they meet minimum requirements for data security and also be aware that they are not supported by IT Services.
- If handling any sensitive data, you must also comply with the requirements of data protection legislation, ethical approval and any confidentiality agreements in place.
- If you are provided with a virtual desktop, this is an access environment, not automatically an approved data store.
Key features:
- Acceptable option
- Free quota: Varies
- Collaboration: Varies
- Edit shared documents together: Varies
- Sync to local machine: Varies
- VPN needed for remote access: Varies
- Backups: Varies
- GDPR concerns: Varies
If you have any specific support queries about specialist project services, please contact your local IT support.
Storage options not supported
Consumer-oriented cloud services
It is not recommended that services such as Dropbox, iCloud, or Google Drive be used for storing live research data, and it is prohibited for data considered medium or high risk.
These services have inherent risks:
- There is often no guaranteed retention or back-up of data.
- The servers they use could be based outside the UK/EU, which can have implications for data protection and may breach funder requirements.
- There is a lack of clarity on ownership and rights over the data.
Laptop hard drive
It is not recommended that personally managed storage like your computer's home directory (C:\) or external hard drive be used for research data due to the following risks:
- You are responsible for managing back-up.
- Access and security are dependent on the protection you install.
- Laptops and external storage can be damaged if dropped or mishandled.
- Portable storage media such as CDs, DVDs, and memory sticks (also known as USB sticks, flash drives, thumb drives, and memory keys) are risky, as they are not backed up centrally and are vulnerable to loss and damage.
- It's best not to rely on these devices as your only copy of important data. Can be useful for secondary, back-up copies, files only one person at a time needs to access, non-confidential data, and data you can afford to lose.