RDIM Terminology Sensitive Data Classifying and Managing Sensitive Research Data at JCU

Classifying and Managing Sensitive Research Data at JCU

JCU uses a risk-based sensitivity classification to help researchers understand the levels of sensitivity associated with their data.

The classification is completed within the Research Data Management Plan (RDMP), where self-assessment questions guide you through identifying relevant sensitivities and what they may mean for data handling, storage and access. This supports safe, ethical, and culturally respectful research practice.

Data is classified according to the potential impact if it were compromised through accidental or unauthorised access, loss, misuse, or disclosure. Clear classification helps protect individuals, communities, the University, and external partners.

What is sensitive data?

Data is considered sensitive if it can be used to identify an individual, species, object, or location in a way that introduces a risk of discrimination, harm, cultural harm, or unwanted attention.

Examples include:

Identifiable or re-identifiable personal or health data
Culturally sensitive data
Ecological data (e.g., locations of rare or endangered species)
Security-sensitive data
Commercially valuable data with commercialisation potential.

Using the classification

Sensitive data is often subject to legal, ethical, cultural, regulatory, and commercial requirements that shape how it can be accessed, handled, stored, and shared.

The sensitivity classification questions in the Research Data Management Plan (RDMP) help you:

identify whether your data is sensitive
understand what the level of sensitivity means for data handling, storage and access
recognize when additional advice, controls, or approvals may be needed.

📌 You can—and should—select multiple categories if your data falls into more than one area.
This ensures a complete assessment and supports appropriate data handling throughout the project.

How to interpret classification guidance

The sensitivity classification helps you identify considerations for data handling, storage, and access based on risk.

It does not automatically assign specific systems or storage locations.

Within each classification, there may still be variation in risk — and this should be considered when determining appropriate storage, access controls, and handling.

Decisions about where and how data is stored depend on project context and may involve ethics approvals, consent conditions, Indigenous governance requirements, contractual obligations, the application of appropriate security and access controls, or the availability of suitable institutional infrastructure.

This guidance supports informed, proportionate decision-making — it does not replace governance processes, expert advice, or researcher responsibility.

ℹ️ Culturally sensitive data

Indigenous and cultural knowledge cannot be treated as just another “risk category.” Cultural data sensitivity is deeply connected to research practice, relationships, custodial authority, and community expectations.

While the sensitivity classification uses a risk-based framework, the tool also incorporates considerations such as custodial authority, community consent, and culturally appropriate access controls (including tiered access where determined by communities). These inclusions support researchers in thinking more carefully about cultural data, while recognising that cultural protocols and decisions sit beyond what any classification tool can fully capture.

Culturally sensitive data is ultimately guided by Indigenous-led governance, custodial guidance, and community decision-making about how knowledge may be used, handled, accessed, and shared. Cultural protocols are community-driven, context-specific, and dynamic, and they may require specific permissions, restrictions, or community-led management pathways.

Formal Indigenous data protocols are being developed by the Indigenous Education and Research Centre (IERC), and these will guide future refinements to the classification and strengthen alignment with Indigenous data governance principles.

A separate Case Study on Collecting Plant Materials for Biodiscovery outlines how cultural sensitivity, legislation, ethical frameworks, and practical data handling come together in research practice.

Sensitivity levels

Research Data Classification	Risk	Access and Handling	Examples
Official (Public)	Compromise would have little or no impact.	Data is eligible for public release.	Published research data e.g., open access with a Creative Commons licence.
Official (Internal)	Compromise unlikely to cause harm.	Internal or limited access (e.g., includes external research collaborators under controlled conditions) based on general academic, research or business need.	Active or unpublished data not classified as Sensitive or Protected. Published data made available under conditional access e.g., aggregated, deidentified data.
Sensitive	Compromise could breach ethical, legal, commercial or regulatory obligations. Adverse impact is likely.	Authorised access only, based strictly on academic, research or business need.	Re-identifiable data e.g., includes indirect identifiers such as post code + rare occupation, or data linkage is possible. Data with cultural or ecological sensitivities. Data reflecting early-stage research findings or ideas with commercial potential (e.g., patentable or protectable results or industry application being explored—but not yet covered by an agreement)
Protected	Compromise would breach ethical, legal, commercial or regulatory obligations. Serious adverse impact expected.	Highly restricted access, may be subject to regulatory controls.	Identifiable health/medical data Personal information as defined by the Privacy Act i.e., direct identifiers + one or more pieces of information from Table 1 (Part I, Division I, Section 6) Police records Cultural data where disclosure would cause serious harm, is legally restricted, or subject to binding agreements Data subject to confidentiality agreements, IP protections or funding/commercial contracts Data relating to military or dual-use applications, or that could compromise national security.

This table provides a high-level overview of JCU’s sensitivity levels. It is designed as a quick reference to accompany the RDMP questions.

Policy alignment

This classification is directly aligned with JCU’s Information Classification Policy and complements JCU’s broader research integrity, ethics, and data governance frameworks.