A Research Data Management Plan Template for a Small Lab or Study Team
Funders ask for a DMP; ethics boards ask where consent lives. One document answers both if it is written around how the study actually runs. Here is the skeleton.
Most data management plans are written the week before a grant deadline and never opened again. The good ones are short, specific, and describe a system the team will actually use. Below is the skeleton we see working for small studies — a lab of six, a clinical audit, a social-science project with a few hundred participants — with the questions each section must answer.
1. What data will be collected?
List the data types (survey responses, interview recordings, samples, images, sensor logs), their formats, their expected volume, and which are personal or sensitive. Personal data gets its own handling rules below; be explicit about which is which.
2. How will it be organised?
One record per study; beneath it, one record per participant or per site; beneath that, the dated events (visits, samples, interviews). Every item has an ID that never changes. Identifying details and study data are kept apart: the participant's name and contact details in a restricted record, the pseudonymised ID on everything else, and the key between them in exactly one place. In Herarx this is a study case with participant sub-cases under Advanced Security; the shape is described in cases as study records.
3. Consent and ethics
Where consent forms are stored, how re-consent after an amendment is recorded, where the ethics approval and its amendments live, and who can see them. The answer "on the participant's record, alongside the version of the form they signed" satisfies most boards.
4. Storage and security
Where each data type lives (institutional storage, the case system, a secure enclave for identifiable data), encryption at rest, access by named role, and how access is logged. Say who can see identifiable data — usually two or three people — and how that is enforced rather than promised.
5. Backup and recovery
What is backed up, how often, where, and — the question most DMPs skip — when the restore was last tested. See backups are not recovery.
6. Sharing and publication
What will be shared, with whom, under what licence, after what anonymisation. Which repository. What will not be shared and why (identifiable, commercially sensitive, third-party restrictions).
7. Retention and destruction
How long the underlying data is kept after the study ends (funders and ethics boards commonly require years; ten is typical for underlying data), what is destroyed earlier (identifiable data as soon as the study no longer needs it), and how destruction is evidenced. Put the date on the study record so it triggers a review rather than relying on someone remembering in 2036.
8. Roles
The data manager (one named person), the PI's responsibilities, what students and assistants may and may not do. Short.
Making it real
A DMP is only honest if the system matches it. If the plan says "identifiable data restricted to the PI and data manager" and the actual storage is a shared drive, the plan is fiction. Build the study record first, then describe it — the document will be shorter, and true.
