Researchers exchanging a sealed transcript package and separate access token
Unique faceless editorial photograph created for this research workflow.
01 / PRIVACY QUESTION

Authorize use, not just receipt

Check the protocol, consent language, data-use terms and recipient role before preparing any transcript package.

Create an auditable sharing approach for academic teams; distinguish file encryption from recipient authorization

Practical scenario

A collaborator asks for a transcript through a convenient file-transfer channel. The package can be encrypted, but the request does not state whether the collaborator is named in the protocol, covered by a data-use agreement or allowed to receive the code level provided.

02 / WORKFLOW CONTROL

Use controlled access

Encryption protects a file in transit or storage; it does not establish that the recipient may use the data or prevent onward disclosure.

  1. 01Confirm the recipient identity and approved study role.
  2. 02Match the proposed use to consent, protocol and data-use terms.
  3. 03Choose the least identifiable version that still supports that use.
  4. 04Use an institution-approved transfer route and communicate secrets separately.
  5. 05Set an access end date and obtain confirmation that local copies will be handled as agreed.
03 / DECISION RECORD

Leave evidence another custodian can follow

Document who approved the disclosure, the specific version sent, purpose, recipient, transfer method, access duration and return or deletion requirement. Avoid putting passwords or re-identification material in the same message.

Pause and review when

  • The request is forwarded from an unfamiliar address or personal account.
  • The recipient asks for the code key when a pseudonymized copy should suffice.
  • The transfer method creates uncontrolled copies or indefinite links.
04 / TECHNICAL BOUNDARY

Encryption does not decide permitted research use

Does not replace provider permissions, guaranteed backup, password recovery or enterprise identity management. Pseudonymized data can remain sensitive, especially when indirect identifiers or a usable code key exist. Technical protection must sit inside the approved research workflow rather than replace it.

Document the decisionRecord the data state, approved roles, participant code convention, storage location, recovery owner and review date without copying identifiers into the log.
05 / COMMON QUESTIONS

Questions to resolve before acting

Does encrypting an attachment make sharing authorized?

No. Encryption can reduce interception risk, but authorization comes from the study’s governance, consent and recipient controls.

Can a password be sent in the same email?

That weakens separation. Use the approved institutional method and a separate communication channel when a secret must be conveyed.

PRIMARY REFERENCES

Sources for this decision

Links are selected for the question on this page, not to meet a link quota. They do not imply endorsement. Institutional, IRB, consent, legal and funder requirements control the actual study; this independent resource does not make an IRB or regulatory determination.