Overview
Funders increasingly require a data management plan (DMP) at application stage, and many universities require one for doctoral projects. Each funder uses its own template, often accessed through DMPonline (widely used in the UK and Europe) or the DMP Tool (widely used in the US). Requirements change: US funders such as NSF and NIH have been moving to more structured, form-based plans during 2026, so we always work from the current version of your funder's template and guidance.
A strong DMP answers concrete questions. What formats and volumes of data? What documentation and metadata standards? Where will data be stored during the project, and how is it backed up? Which repository will hold it afterwards, under what license and with what access conditions? What cannot be shared, and why? Vague answers such as 'data will be stored securely' are a common reason reviewers mark plans down.
When research involves personal data, the DMP must also reflect data protection law, such as the EU GDPR, UK GDPR or other national regimes. We help you apply principles such as data minimization, purpose limitation and storage limitation, choose between anonymization and pseudonymization, and make sure your consent forms and information sheets say the same thing. We are not lawyers; your institution's data protection officer remains the authority on legal questions.
Who it’s for and the problems it solves
This is for you if you are…
- Researchers preparing grant applications that require a DMP or data management and sharing plan
- Doctoral students whose university requires a DMP at registration or confirmation
- Projects collecting interviews, health data, images or other personal data that need a data protection approach
- Teams responding to reviewer or data steward comments on a submitted plan
- Projects moving from a first DMP to an updated version during the project, as some funders require
Common problems we help with
- You do not know which template your funder requires or what reviewers expect in each section
- Your plan promises open data but your consent forms do not allow sharing
- You are unsure whether pseudonymized data counts as anonymous
- You need to choose a repository and license but do not know the options in your field
- Your DMP and ethics application describe storage and retention differently
- Your data include special category information, such as health or ethnicity, and you need extra safeguards
What’s included — and what isn’t
Included
- Identification of the correct funder or institutional template and its current guidance
- Drafting or reviewing DMP sections: data description, documentation and metadata, storage and backup, ethics and legal compliance, sharing and preservation, responsibilities and resources
- Application of the FAIR principles (findable, accessible, interoperable, reusable) to your data types
- Repository and license selection, including discipline repositories, generalist repositories and institutional options
- Data protection mapping: what personal data, lawful basis as determined by your institution, minimization, retention and data subject information
- Anonymization and pseudonymization strategy, including handling of indirect identifiers in qualitative data
- Consistency check across the DMP, ethics application, consent forms and information sheets
- Data sharing agreements and data flow descriptions for multi-partner or international projects
- Costing notes for data management activities so they can be included in your budget
Not included
- Legal advice or formal data protection impact assessment sign-off; your data protection officer decides
- Acting as data controller or processor for your research data
- Promising data sharing or security measures you will not actually implement
- Guaranteeing that a funder will score the plan favorably
What you receive
- Completed DMP
- A plan in your funder's or institution's template, ready to paste into DMPonline, the DMP Tool or the funder's system, within its length limits.
- Data inventory
- A table of each dataset: type, format, estimated volume, personal data status, storage location, repository and license.
- Consistency report
- A cross-check of your DMP, ethics documents and consent materials, listing any statements that need aligning.
- Anonymization plan
- A practical procedure for de-identifying your data type, with examples for quantitative variables or qualitative transcripts.
- Budget notes
- Data management costs, such as storage, repository fees, transcription or curation time, for your grant budget.
How it works
Identify requirements
We confirm your funder, template, deadline and institutional policies, and collect your project summary, methods and consent drafts.
Map your data
We build a data inventory with you, identifying personal and sensitive data, formats, volumes and sharing possibilities.
Draft
We draft each section with specific, verifiable commitments, flagging decisions that need your data protection officer or library.
Align and review
We cross-check the plan against your ethics and consent documents, then revise with your comments within the word or character limits.
Update as needed
For funders that expect a living DMP, we help you update it at milestones or when your data plans change.
Templates, principles and standards
- DMPonline and the DMP Tool
- Funder and institutional templates hosted on these platforms, used for writing, sharing with collaborators and exporting plans.
- Horizon Europe DMP
- The European Commission's FAIR-oriented template, with a first version typically due early in the project and updates later; we check the current grant agreement requirements.
- US funder plans
- NIH data management and sharing plans and NSF data management plans, both moving toward structured, form-based formats; we follow the version in force for your deadline.
- FAIR principles
- Persistent identifiers such as DOIs, rich metadata, open or controlled access, standard formats and clear licenses such as CC BY or CC0 where appropriate.
- GDPR principles
- Lawfulness, fairness and transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability, with research safeguards such as pseudonymization.
- Anonymization techniques
- Removal of direct identifiers, aggregation, top-coding, generalization of dates and places, and qualitative redaction with a documented disclosure-risk review.
Anonymization versus pseudonymization
These terms are often confused, and the difference has legal consequences. Pseudonymization replaces identifiers with codes while a key exists somewhere that could re-link them. Under the GDPR and UK GDPR, pseudonymized data is still personal data, and data protection law continues to apply. UK regulator guidance puts it plainly: pseudonymization reduces risk but does not take data outside the law.
Anonymized data is data from which individuals can no longer be identified by any means reasonably likely to be used, taking into account other information that might be available. Removing names is rarely enough, especially for small samples, rare characteristics or rich interview transcripts. We help you describe accurately which one you are doing, and choose the approach that fits your sharing plans.
Making open data and consent agree
Many funders expect data to be shared 'as open as possible, as closed as necessary'. That is only possible if participants agreed to it. If your consent form says data will be destroyed after the project, you cannot later deposit it in a repository.
We check the chain from consent to deposit and suggest wording that allows responsible sharing, such as consent for anonymized data to be archived for future research, or controlled access through a repository that vets users. If sharing is not appropriate, we help you explain why in terms reviewers accept.
What reviewers look for in each section
Although templates differ, reviewers tend to reward the same qualities.
- Named storage services, backup frequency and who has access, rather than generic statements
- Specific repositories with persistent identifiers and a stated embargo or access policy
- Recognized file formats and metadata standards for your discipline
- Clear roles: who is responsible for data management tasks, and with what resources
- Realistic costs included in the budget
- Honest explanation of any data that cannot be shared and the legal or ethical reason
What the work can look like
Illustrative example — fictional data
A DMP for a mixed methods study of young people's mental health apps
A fictional early-career researcher is applying for a research council grant. The project combines app usage data from 400 participants aged 16 to 24 with 30 interviews, and the funder expects data to be deposited at the end.
Data inventory
Three datasets were identified: pseudonymized usage logs, survey responses containing health data (special category data) and interview audio and transcripts. Volumes, formats and storage were set out in a single table.
Sharing decisions
Survey data would be anonymized by removing postcodes and banding age, then deposited with controlled access. Interview transcripts would not be shared openly because of re-identification risk in small communities; a detailed codebook would be deposited instead.
Alignment
The consent form was revised to ask separately about archiving anonymized survey data, and the information sheet was updated to match the DMP's retention period of ten years.
Illustrative, invented scenario. Requirements depend on your funder, institution, jurisdiction and data.
What you’ll need to provide
- Funder name, call, template and deadline, or your institution's DMP requirement
- Project summary, methods and expected data types
- Draft ethics application, consent forms and information sheets if available
- Your institution's research data policy and approved storage options
- Any guidance or contacts from your library, data steward or data protection officer
You don’t need everything ready to ask for a quote — tell us what you have and we’ll say what’s missing.
What affects price and turnaround
Price depends on
- Funder template length and number of required sections
- Number and types of datasets, especially sensitive or special category data
- Number of partners, countries or data flows involved
- Whether a consistency check against ethics and consent documents is included
- Whether an updated or mid-project version is required
Turnaround depends on
- Your grant or institutional deadline and internal sign-off times
- How settled your methods and data types are
- Time needed for input from your data protection officer, library or partners
Every project is quoted individually. How we price our work.
Questions people ask before starting
Which template should I use?
Use your funder's template for grant applications and your institution's for internal requirements. DMPonline and the DMP Tool host many of them. Funder requirements change, so we always check the current guidance for your call before drafting.
Is my data anonymous if I remove names?
Often not. Other details such as job titles, locations, rare conditions or dates can identify people, especially in small samples. If a key linking codes to people exists, the data is pseudonymized and remains personal data under GDPR-style law.
Do I have to share all my data?
Not necessarily. Funders generally accept justified restrictions for ethical, legal or commercial reasons. The plan should explain what will be shared, what will not, and why, and consider alternatives such as controlled access or sharing metadata only.
Can you tell me what lawful basis applies under GDPR?
We can explain the options typically used in research, but the lawful basis is set by your institution as data controller, usually through its data protection officer. We help you describe it consistently once it is decided.
Does my PhD need a DMP?
Many universities require one, and it is good practice for any project with personal data. It also makes your ethics application and final thesis data statement easier to write.
Can you review a plan I already wrote?
Yes. A review with comments and suggested wording is often enough, particularly if you have used your library's guidance.