Incidental exposure or loss of data may cause severe consequences on several fronts. Understanding and identifying the potential personal, environmental, commercial, institutional, or state security risks, classifying them, and responding by using adequate controls that mitigate these risks is fundamental to research data management as well as compliance.
Security Protocols
Where once security protocols related to research data involved securing data in a locked cabinet in the secured office of the researcher, data stored and transmitted in digital formats has created a much more challenging landscape for securing one’s research data. Once the security implications associated with a particular dataset have been identified and a risk classification assigned to reflect these security implications, UBC’s Advanced Research Computing team can help ensure that the storage and transmission infrastructure you use for your data are compliant with the above assessments.
Security Risks
Security risks from the mishandling of research data may impact participants or other data subjects, individual researchers and collaborators, their institution(s), and in some cases, the security of the state. UBC and its affiliated research ethics boards, the Research Security team, and the Advanced Research Computing team can help identify potential risks.
Risks to Participants and Data Subjects
Once any data or information is exposed—especially online—it is often impossible to fully retract. Even seemingly innocuous information can carry significant personal value and, if compromised, may lead to psychological distress, reputational damage, or financial loss. While physical harm is often top-of-mind, researchers must also account for these other, less visible but equally important, risks.
Risks to Researchers and Collaborators
Consider the nature of your research and whether any risks could expose members of your team to personal or professional consequences. Could the subject matter attract unwanted attention, harassment, or threats? Risk to individuals includes not only participants but also the researchers themselves, whose safety and wellbeing are integral to the ethical conduct of research.
Furthermore, the risk of exposure or loss of data can prevent researchers or their partners from establishing intellectual property rights, thereby limiting the ability to commercialize the work and damaging relations. Even when there is not a commercial interest in the project, a data breach could harm the relationship between the researcher(s) and partners, limiting or preventing them from being able to collaborate on new work.
Ethical Risks
Considering ethical risks is essential to maintaining research integrity, ensuring compliance with ethical standards, and fostering responsible, respectful scholarship. The impact of research extends beyond the university—it can affect individuals, communities, and society at large. Recognizing these risks helps researchers make informed decisions that uphold trust and accountability. The UBC Office of Research Ethics supports researchers in identifying and addressing risks associated with human and animal research, ensuring that ethical considerations are embedded throughout the research lifecycle.
Institutional Risk
It’s easy to assume that certain research areas are not valuable enough to attract attention from malicious actors—but every project carries some level of risk to the institution itself. Regardless of discipline, an information security breach—whether accidental or malicious—can have far-reaching consequences, including:
- Reputational damage to individual researchers, collaborators, and the university;
- Financial losses, including remediation costs, penalties, or loss of funding;
- Legal or regulatory consequences, such as litigation;
- Operational disruptions, including impacts on staffing, infrastructure, and continuity of research.
National Security Risk
In an increasingly competitive research ecosystem, certain research data and information can be highly valuable in the hands of those who might wish to harm Canada’s national security.
Researchers should take care to ensure that research data is not transferred to or from unauthorized or illegal entities, including those subject to sanctions or listed on the Government of Canada’s list of Named Research Organizations.
Data involving work in certain research areas, especially those on the Government of Canada’s list of Sensitive Technology Research Areas, or those involving critical minerals and infrastructure, may be at higher risk to be compromised by unwanted or unauthorized data transfer. Other kinds of data may be considered a controlled good and should be treated with additional safeguards to prevent it from falling into the wrong hands.
Find Support
Resources