The data management plan says the de-identified dataset will go to a repository. The consent form, written a year earlier from an old template, says "only the research team will have access to your responses" and "all data will be destroyed five years after the study ends." Both documents were approved. Only one of them can be kept.
This happens constantly, and it's the consent form that wins, because a promise to participants outranks a promise to a funder. The fix is cheap if you make it before recruitment and expensive after. This guide covers what a consent form has to say for data sharing to be possible, the phrases that quietly rule it out, sample wording you can adapt with your IRB, and what to do with data you've already collected under a restrictive form.
Why the consent form decides
Repositories check. When you deposit data about people, a curator at ICPSR, Databrary, or a similar archive will ask what participants were told, and some ask for the consent form itself. If the form rules out sharing, the deposit stops there. IRBs check too, when a request to share comes in after the fact.
Funders now expect the two documents to agree. NIH's Data Management and Sharing Policy asks you to think through, at the design stage, whether and how participant data will be shared, and to reflect that in the consent process. NIH published an optional resource in 2022, Informed Consent for Secondary Research with Data and Biospecimens (PDF), with points to consider and sample paragraphs, and its consent page collects the rest. ICPSR has offered model consent language for data sharing for years. None of it is mandatory, and all of it is useful.
What the form needs to say
A participant should be able to answer six questions after reading the data section of the form. Keep each answer to a sentence or two in plain language.
- Will my data be shared with people outside the study? Say yes if that's the plan, and say with whom: other researchers, at this institution and elsewhere. If commercial researchers could get access, say that too. Vague phrasing here is what IRBs later read as "no."
- In what form? Explain that direct identifiers (name, contact details, and so on) will be removed first, and that the shared data won't include information that could readily identify them. Don't promise "anonymous" unless it's true; a survey with a birth date and a ZIP code isn't anonymous. The de-identification guide explains the difference.
- Where, and under what conditions? Name the type of destination: a public data archive, or a restricted archive where other researchers must sign an agreement and promise not to try to identify anyone. If you already know the repository, name it. The repository guide covers how to pick one.
- For what purposes? "Future research on similar topics" is narrower than "future research of any kind." The wider the purpose, the more useful the data, and the more clearly you have to say it.
- For how long? Shared data are kept indefinitely. Say so. A retention limit written for your local copy ("destroyed after three years") will be read as applying to every copy, and it may also conflict with the retention period your funder and institution require.
- Can I say no to sharing and still take part? Either make sharing a condition of participation and say so, or offer a separate checkbox. Both are legitimate. Silence is not, because it leaves the participant assuming the narrower reading.
Two more items belong in the form when they apply: whether participants might be re-contacted for future studies, and whether they can withdraw their data from sharing later (usually only until it's deposited or de-identified, after which it can't be traced back to them).
Phrases that quietly rule out sharing
These come from templates written before data sharing was expected. Each one is a promise you'll be held to.
| Avoid | Why it's a problem | Write instead |
|---|---|---|
| "Only the research team will have access to your data." | Rules out every other researcher, forever. | "Identifying information will be kept by the research team only. De-identified data may be shared with other researchers." |
| "All data will be destroyed after [N] years." | Read as covering the repository copy too. | "The research team will delete identifying information after [N] years. De-identified data may be kept and shared indefinitely." |
| "Your responses are anonymous." | Usually false for surveys with demographics, and it limits what you can later say about risk. | "Your name and contact details will not be stored with your responses." |
| "Your data will be used only for this study." | Excludes secondary use of any kind. | "Your de-identified data may be used in future research by this team and by other researchers." |
| "Your data will never be shared." | Self-explanatory. | Drop it. |
Sample wording to adapt
This is a starting point, not IRB-approved text. Your IRB has its own template and reading-level rules, and it has to approve whatever you use. The bracketed parts change from study to study.
Public archive, sharing as a condition of participation:
We plan to share the information you give us with other researchers after we remove your name, contact details, and anything else that could readily identify you. The de-identified data will be placed in [a public research data archive / name of repository], where other researchers can use them for future studies on [any topic / topics related to this study]. Those data will be kept indefinitely. We will not share your name or contact information with anyone outside the research team. If you don't want your de-identified data shared in this way, you shouldn't take part in this study.
Restricted archive, sensitive data:
After the study, we will remove your name and other direct identifiers and place the data in [name of repository], a restricted research data archive. Other researchers can request access to the data only for research purposes, only after approval from [the archive / our institution], and only after agreeing in writing not to try to identify anyone in the study. The research team will keep the information that links your name to your data separately and securely, and will delete it [N years after the study ends / when the study ends].
Separate choice to allow sharing:
Please check one: [ ] Yes, my de-identified data may be shared with other researchers for future research as described above. [ ] No, use my data for this study only.
If you offer that choice, plan for it. You'll be maintaining two versions of the dataset, the deposited file will be smaller than the analysis file, and your data availability statement will need to explain the difference.
A note on broad consent
The revised Common Rule added "broad consent" as an option for storing and reusing identifiable private information and biospecimens in future, unspecified research. It's a defined procedure with its own required elements, and an institution that adopts it takes on tracking obligations (for example, honoring refusals). Many IRBs haven't adopted it, and for most social and behavioral studies it isn't needed, because you're sharing de-identified data, not identifiable data. The ordinary consent form, with clear sharing language, does the job. Ask your IRB before assuming either way.
Data you already collected under a restrictive form
This is the situation most people are in when they first read a data sharing requirement. You have options, in rough order of how often they work.
- Read the form again, carefully. "Confidential" is not "never shared." A promise to protect identity is compatible with sharing de-identified data; that's ICPSR's whole argument in its model language. A promise that only named people will see the data is not.
- Ask the IRB for a determination. Sharing a properly de-identified file often falls outside the original approval's scope in a way the IRB can address without re-consent. Bring the form, the DMP, and the target repository's terms.
- Deposit under restricted access. A data use agreement, approval per request, and a no-re-identification pledge are safeguards that can satisfy an IRB when the form was narrow but not absolute.
- Re-consent. Practical for a small, reachable sample; rarely for a large or anonymous one.
- Share what you can. Aggregate tables, the instrument, the codebook, and the analysis code are all shareable and all count toward transparency, even when the microdata can't be.
Whatever you decide, write it into the data availability statement honestly. "Consent did not permit sharing; aggregate data and code are available" is an accepted answer. A silent omission isn't.
If you support researchers
The single most effective thing a research office or library can do here is get the IRB template changed, so that the default data section already contains sharing language and the restrictive phrases above are gone. One template edit fixes every future study on campus, and it costs a meeting. Pair it with a DMP checklist that asks "does the consent form allow this?" next to the sharing section. I help institutions set up this kind of practical support; the guide to starting research data services is a good first read, and you can get in touch if you'd like help.
Common questions
Does NIH require consent for data sharing? NIH's Data Management and Sharing Policy expects you to plan for sharing and to address, in the consent process, whether and how participants' data will be shared for future research. NIH publishes optional sample language you can adapt.
Can I share data if my consent form said only the research team would see it? Usually not as a public file. Ask your IRB whether a restricted-use deposit under a data use agreement is consistent with what participants were told, whether re-consent is practical, or whether only aggregate results can be shared.
Should I let participants opt out of data sharing separately? It depends on the study and your IRB. A separate opt-out respects choice but creates two versions of the dataset. If sharing is essential, make it a condition of participation and say so plainly.
Is broad consent the same thing as consent for data sharing? No. Broad consent is a specific option in the revised Common Rule for storing and reusing identifiable data, with its own required elements and tracking obligations. Most studies instead add clear sharing language to the ordinary consent form.