Grad Student Beginner’s Guide to Restricted-Use Data

I decided to write down some steps for graduate students looking to work with restricted-use data, but not at a university or department offering dedicated secure data space or licenses to tack on to (because institutional memory is important!). My advisor was super helpful in walking me through the process, but this outline quick guide may be helpful to others, especially since this isn’t a topic you learn in any courses in graduate school.
There are two main steps to obtaining restricted-use data, which are:
1.) IRB approval at your university
2.) Restricted-use data application approval from the data source
The first step is to read about the IRB (Institutional Review Board) process and complete a CITI training, so that you understand the process and issues that arise in research (https://about.citiprogram.org/en/series/human-subjects-research-hsr/). As a researcher, you will renew this every three years. I actually found the history and ethical issues around Human Subjects Research in the training to be very interesting.
After that, some tips and steps:
1. Identify the research office on campus. Ask “Which office deals with Research Compliance and IRB approval?” Folks in this office can guide you to the necessary steps in getting your research approved and get rolling with your restricted-use data license.
2. Is your research human subjects research? If so, what category? To find this out, you will first file a Human Subjects Determination Form, or similar, with the research office (or equivalent).
3. After determining the category of your human subjects research, then you will begin the IRB approval process. This involves writing a protocol for your institution’s IRB that demonstrates why you need restricted-use data and how you will adhere to security protocols.
3. For your IRB protocol, collect all application materials from the data source and note the steps needed to complete them.
a. Do you need a computer security plan?
b. Do you need notarized signatures? Is a notary available in your department or on campus?
c. Does some portion of the application need to be completed by the Research office of your university?
4. Draft all of the relevant portions of your protocol for your records, and to be reviewed by your advisor. This includes:
a. Computer security plan
b. Outline of project and methods
c. Description of why restricted-use data is necessary for your project. Be clear and succinct in describing your research question, method, supporting literature, and why your project is a contribution in which analyzing the restricted-use data in necessary. This description is important, since reviewers from other fields may be reading your protocol, and you want to clearly communicate your project, especially to those less familiar with your specific research.
5. You will then submit your protocol for approval by the IRB. Once this is complete and approved, you will then complete the data license application from whichever restricted-use data source you are using (for example, the Institute of Education Sciences, Department of Labor, etc.) At this stage, the research office can assist with next steps if needed.
6. General advice: Ask around! Did your advisor or mentor previous use restricted-use data? Or another professor in your department, or another department? Ask for help about how the application process has gone for others.
7. More advice: When in doubt, just keep pestering and asking for help. In my experience, the bottleneck was finding physical space (i.e. a secure office space). But, asking and reminding proved very useful is finding a small, secure office space for using my data.
8. Helpful clarification: Many restricted-use data licenses require the applicant to hold a PhD, so you will need your advisor or professor to assist in your application. They will then specify you are a data user on the license agreement.
As a PhD student at a department without dedicated resources for secure data, it can feel like more “prestigious” programs have a leg up when it comes to accessing certain data. They do, but that should not deter you from a good research idea, and your advisors and professors are there to support you in pursuing that, especially if you are willing to put in the work of going through the license application process. I also look at it as a very good learning experience for when I apply for restricted-use data or similar research methods as an Assistant Professor, where I will once again have to learn the institutional processes and procedures.
Next steps after getting your data: PRINT THE USER MANUAL (if that feels feasible), find tutorials on your data, and look for replication code from others who have published with your data.