Sensitive Data

EBRAINS supports the responsible and secure sharing of personal data in line with the European General Data Protection Regulation (GDPR) and relevant national legal, ethical and societal requirements. When working with personal data (also known as identifiable or sensitive data), you must follow specific guidelines to ensure that data sharing through the EBRAINS platform is compliant and trustworthy.

If you store personal data in a Secure Repository or TRE, EBRAINS can facilitate discoverability by curating and publishing anonymous metadata and by providing information on access and reusability to potential users.

Step 1: Ensure legal and ethical compliance
Confirm that your project has the necessary ethics approvals, institutional authorisations and participant consents, and that they allow for the planned sharing and reuse of the data. The institution where the data were acquired remains the data controller and is responsible for GDPR compliance and respecting national regulations.

Step 2: Submit a data curation request
Contact EBRAINS through the Data curation request form to initiate the curation process. You will be asked to provide information about the dataset, the legal basis for processing and sharing, and the consent and governance arrangements.

Step 3: Evaluation by EBRAINS
EBRAINS will review the submitted information to verify that the dataset is suitable for publishing anonymous metadata through the EBRAINS Knowledge Graph, and that the appropriate safeguards for access and reuse are in place.

Step 4: Data Sharing via a Secure Repository or Trusted Research Environment (TRE)
Sensitive data remain stored in a Secure Repository or TRE. EBRAINS does not host the sensitive data, but enables users to request access by publishing anonymous metadata and contact information to guide potential users to the data custodian. Access decisions and data use agreements are handled by the institution serving as data controller, not by EBRAINS. 

Provider and Dataset Compliance Checklist

As part of the curation process, data providers complete a “Provider and dataset information” checklist. This ensures that EBRAINS has clear documentation of responsibilities, governance, and technical safeguards before publishing metadata.

1. Provider details
   The person completing the checklist must provide their name, role and professional contact details. This identifies the primary contact for any questions about the information supplied.
2. Data Custodian details
   The checklist records the name, role and professional contact details of the Custodian for the research data involving personal data. The custodian is responsible for the content and quality of the data and metadata and for day‑to‑day management and oversight of the dataset.
3. Dataset description
   The dataset title and a short description must be given, including the categories of human data involved (e.g. clinical, imaging, behavioural, genetic). This helps EBRAINS assess the nature and sensitivity of the data.
4. Responsible institution
   Information about the institution responsible for the underlying data is collected:
   • Name of institution
   • Department
   • Country

This establishes the organisational context and jurisdiction for data governance.

5. Data controller responsibilities
   The checklist confirms whether the institution identified above serves as the data controller. The data controller decides the purposes and means of processing personal data and is responsible for ensuring that data collection, storage, sharing and reuse comply with legal and ethical requirements. The data controller must have appropriate legal bases, participant information, and safeguards in place before any data or metadata are shared, and remains accountable for how the data can be used and reused.
6. Jurisdiction and approvals
   The checklist verifies that the research is performed in the European Economic Area (EEA), Switzerland or the United Kingdom, and that the required ethics approvals, institutional authorisations and participant consents allowing data use or reuse by third parties under defined conditions have been obtained. If the research is conducted outside these countries, additional procedures will apply
7. Location and security of the underlying data
   It must be confirmed that the underlying data remain exclusively in a Secure Repository or TRE located in the EEA, Switzerland or the United Kingdom. If this is not the case, an explanation is required. 
8. Scope of EBRAINS involvement (anonymous metadata only)
   The checklist clarifies that EBRAINS will receive and publish only anonymous metadata, together with contact or routing information necessary to connect potential users with the data custodian. EBRAINS does not take decisions regarding users’ access to the underlying research data.
9. No access by EBRAINS to underlying data
   It is confirmed that EBRAINS will not receive, view, download, host or otherwise access the underlying research data. All sensitive data remain under the control of the Secure Repository or TRE and the data controller.
10. Accuracy and authorisation
    Finally, the person completing the checklist confirms that the answers are accurate and complete to the best of their knowledge, that supporting documents can be provided on request, and that they are authorised to provide these answers on behalf of the institution identified above.

This checklist helps ensure transparent roles and responsibilities, robust legal and ethical compliance, and a clear separation between EBRAINS’ role in publishing anonymous metadata and the data controller’s role in governing access to the underlying sensitive data.

Current TREs connected to EBRAINS data sharing services