The paper is accepted. The journal wants a data availability statement, your funder's plan promised the data would be shared, and now someone has to decide where it actually goes. This is usually the point where a good project loses a week, or takes a shortcut it regrets: the files get dumped as supplementary material, or parked on a lab website, or the statement quietly reads "available from the authors on request."
Picking a repository isn't complicated once you know what the choices are and which questions separate them. Here's the decision, in the order I'd work through it.
First, check whether the choice has already been made for you
Three parties may have an opinion, and they outrank your preference:
- Your funder. Some agencies name specific repositories or maintain a list of acceptable ones, and some fields have a designated home that reviewers expect. If your data management plan already named a repository, that's a commitment, not a suggestion.
- Your journal. Many publishers require deposit in a recognized repository and will not accept a link to a personal site. Check the author guidelines before you pick, not after.
- Your agreement. If the data came from a data use agreement, a vendor license, or a partner institution, the terms may forbid redeposit entirely. That question has to be answered before anything else.
If all three are silent, the choice is yours, and it comes down to three kinds of repository.
The three kinds, in order of preference
Discipline repositories serve one field and understand its data. They enforce a metadata standard your peers already use, they often curate submissions (a real human checks your files and documentation), and they're where people in your field go looking. Genomics, astronomy, social science, neuroimaging, and archaeology all have long-established ones. ICPSR, for example, has held social and behavioral science data since the 1960s and offers restricted-access options for sensitive datasets. If a strong repository exists for your field, use it. Discoverability is the whole point of depositing, and a field repository is where the discovery happens.
Institutional repositories are run by your university, usually through the library. They're free to you, they keep the data connected to your institution's record, and the people who run them can sit down with you. They tend to be generalist, so the metadata is broader and the audience is narrower, but for datasets with no disciplinary home they're a solid default and the staff support is worth a lot.
General repositories take data from any field. Zenodo, Dryad, Figshare, and the Open Science Framework are the ones most researchers encounter. They're fast, they issue a DOI immediately, and they accept the odd-shaped material that doesn't fit anywhere else. What you give up is curation and field-specific metadata: in most cases nobody checks whether your files make sense to a stranger, so the quality of the deposit is entirely on you.
Two tools save time here. re3data.org is a registry of thousands of repositories, searchable by subject, and the FAIRsharing registry maps repositories to the standards and policies of each field. Both let you see what's normal in your discipline before you commit.
What to check before you commit
Repositories differ in ways that only become obvious later. Six things are worth two minutes each:
- Does it issue a persistent identifier? A DOI or similar handle is what makes the dataset citable and keeps the link alive when the site is redesigned. A plain URL is not a persistent identifier.
- What is the preservation commitment? Look for a written statement about how long content is kept and what happens if the repository shuts down. Certification schemes like CoreTrustSeal are a useful signal that someone has audited the answer.
- Can you control access? Not everything can be fully open. Good repositories offer tiers: open, registered users, or an application process with a data use agreement. If your data are sensitive, this feature is the whole decision.
- What licenses does it allow? You need a license that tells reusers what they may do. CC0 (public domain dedication) and CC BY are the common choices for data, and some funders and repositories require one of them.
- What does it cost, and what are the size limits? Some repositories are free up to a size threshold, some charge per deposit. Deposit fees are usually an allowable budget line, which is much easier to arrange while you're writing the proposal than after the award ends.
- Is it curated, and does it check formats? Curation catches the missing data dictionary and the file only three people on earth can open. It's the difference between data that are technically available and data someone can actually use.
The test that matters: could a researcher who has never met you download this deposit and understand what the variables mean, how the data were collected, and what they may do with them, without emailing you? If not, the deposit isn't finished, whatever the repository accepted.
Data about people need a different path
Human-subjects data can often be shared, but not by uploading a spreadsheet to an open repository and hoping. Three things have to line up.
The consent has to permit it. Participants can only be bound by what they agreed to, so the sharing language belongs in the consent form at the start of the study, not in a request to the IRB after the fact. If the original consent promised the data would be seen only by the study team, that promise stands.
The data have to be prepared. De-identification is more than deleting the name column: dates, geography, small cells, rare characteristics, and free-text responses are the usual re-identification routes, and rich longitudinal or qualitative data are the hardest cases of all. Your IRB and, where it applies, a privacy rule such as HIPAA will shape what counts as adequate.
And the venue has to match the risk. This is why restricted-access repositories exist: the data sit behind an application and a signed use agreement, and sometimes behind a secure enclave where analysts work without ever downloading the file. Sharing under controlled access still satisfies most funder policies. The phrase to keep in mind is "as open as possible, as closed as necessary." Openness is the default, not an obligation to be reckless.
What actually goes in the deposit
A dataset is not just the data file. A deposit someone can use contains:
- The data, in open or widely readable formats where possible (CSV alongside the statistical package file, plain text alongside the vendor format).
- A README that explains what the project was, what each file is, and in what order the analysis runs.
- A data dictionary or codebook: every variable, its meaning, its units, and what each code stands for.
- The analysis code, if code produced the results. Many people deposit code in a repository like Zenodo (which can archive a GitHub release and issue a DOI) and link the two records.
- A license, and a citation for the dataset itself so reusers know how to credit it.
If that list looks familiar, it's because it's the same material as a well-organized project folder. Deposit is cheap when the project was organized from the start and expensive when it wasn't.
Timing, and the mistake worth avoiding
Deposit at acceptance, not at publication, and definitely not months later. Repositories can mint a DOI and hold the record private until the paper appears, which gives you the identifier for the data availability statement while the embargo still holds. Waiting until after publication means doing the work with no deadline pressure and no co-author attention, which is how deposits quietly never happen.
The mistake to avoid is the statement that says the data are available from the authors on request. It reads as compliance, but email addresses expire, people leave, and the request often goes unanswered years later. A deposited dataset with a DOI keeps working when you've moved on, and it gets cited on its own terms, which is the part most researchers don't expect and then appreciate.
If you're at the proposal stage rather than the publication stage, name the repository in the data management plan and budget any fees now. Deciding once, early, spares you this whole decision at the worst possible moment.