Who Owns the Data When a Peer Research Project Ends? Drafting Data Sharing Agreements That Keep Community Control

Picture the last week of a peer research project in a Sefton youth centre. The young researchers have finished their interviews. The university partner has the transcripts on a secure drive. The funder wants the final report. Someone asks, reasonably, what happens to the recordings now. Nobody has a clear answer, because nobody wrote one down at the start.

That is the moment this article is about. The end of a project is not an administrative afterthought. It is a governance event. The decisions made at wind-down — who keeps access, where files live, when they are deleted, who can reuse them — determine who still controls the data a year later. Those decisions belong in a data sharing agreement, not in a closing email.

Ownership and control are different questions

People often say the community should “own” the data. That sounds right and is usually too vague to enforce. Ownership and control are separate questions, and a good agreement answers both.

Legal ownership may sit with a university, an NHS body or a funder, depending on who commissioned the work and what the contracts say. Control is different: who can access the data, who is consulted before it is reused, who speaks for the findings, and who can say no. A community partner can hold meaningful control rights even when it does not hold legal title. Drafting those rights explicitly is more useful than a general statement of ownership that nobody can act on.

NHS guidance on community-based participatory research makes this practical point directly. It says academic and community partners need to consider data ownership and access carefully and develop agreements about data use and accessibility. It then lists the questions partners should settle:

• Who owns the data and products?
• Who controls the data and access during and after the research?
• Where is the data stored and who has access during and after the research?
• Do research subjects know who is likely to have access, and why?
• What are the community’s interests, and is there other useful information the community could mine from the data?

Those five questions are a good skeleton for any data sharing agreement, whatever the funder’s template looks like. They are also the questions most likely to be skipped when a project is busy delivering.

What the ICO code expects

The Information Commissioner’s Office Data Sharing Code of Practice is a statutory code made under section 121 of the Data Protection Act 2018. It is not a template, but it sets out what good practice looks like, and the Commissioner must take it into account when assessing whether an organisation has complied with its data protection obligations when sharing data.

The code recommends assessing risks with a Data Protection Impact Assessment and states that it is good practice to have a data sharing agreement. It also says a data sharing arrangement should include policies and procedures that allow data subjects to exercise their individual rights easily. It advises agreeing retention periods and making arrangements for secure deletion, and arranging regular reviews of the arrangement.

Commentary on the code adds detail worth knowing when you sit down to draft. A law-firm summary reports that the code says the purpose of the data sharing initiative should be documented in precise terms, that the agreement should address common rules for retention and deletion of shared data, and that it is good practice to provide a single point of contact so individuals can exercise their rights without making multiple requests to several organisations.

None of that tells you what your community partner should insist on. It tells you the floor. The clauses that protect community control sit on top of it.

The community-identifiability problem

Here is a point that catches people out. You can anonymise every young person in the study and still leave the partner organisation identifiable. The NHS guidance notes that while individual participants’ anonymity may be preserved, a community partner group is often more easily identifiable, and that this matters if the research suggests a community may be more predisposed to particular conditions or circumstances.

The same guidance is candid about the gap underneath this. It notes an absence of policy on privacy and confidentiality relating to community participation in research, and observes that most policy, including the GDPR, relates to the rights of individuals but does not deal with the rights of communities.

So do not assume that individual consent forms solve the organisational problem. If the findings could identify a youth centre, a tenants’ group or a small charity in a way that affects its reputation or funding, the agreement should say who speaks for those findings, who is consulted before publication, and what happens if the partner disagrees with the framing.

A drafting checklist for the community partner

The following is a practical checklist, not legal advice. It is written for a small voluntary organisation signing up to a peer research project, and it assumes the partner wants to keep real control without blocking the research.

Clauses to insist on

• Named access holders. Not “the research team” but named roles and, where possible, named people. Say what happens when someone leaves.
• A deletion date. A specific date or a defined period after the final report, with a named person responsible for confirming deletion in writing.
• A consultation or veto right over secondary use. If the university or funder wants to reuse the data for a new purpose, the community partner should be asked first, in writing, with a stated response time.
• A named contact for data subject requests. One person, one route, so a young person or parent does not have to chase three organisations.
• A plain-language data schedule. A short annex in ordinary English that a volunteer can read and use, attached to the main agreement.
• A successor clause. If the community partner closes or merges, who holds its interest in the data? Name the organisation or the process.

Clauses to question

• Open-ended retention. “Retained for research purposes” with no end date is not a retention period.
• Unilateral amendment. If one party can change the agreement without the other’s written consent, the control is illusory.
• Broad secondary-use permissions buried in a consent form rather than the agreement.
• Indemnity and insurance wording that shifts liability onto a volunteer-run partner. The NHS guidance notes that insurance and indemnity arrangements need to set out how, or if, community participants are covered, and that a partnership agreement should be written at the start of a project to cover this alongside roles and responsibilities.

Who signs

Check the constitution or articles of association before signing. The NHS guidance advises community organisations to do this, because there may be restrictions on who can enter into agreements, and responsibilities delegated to directors and trustees cannot always be delegated onward to community members. A youth worker with enthusiasm and a lanyard may not be the person who can bind the organisation.

A worked example, clearly hypothetical

To show how clause wording changes outcomes, here is a scenario. It is illustrative, not a report of a real project.

Suppose a youth peer research project runs in a coastal town in Sefton. A university leads it, a local youth charity hosts the peer researchers, and a funder pays. The project ends. The university wants to keep the transcripts for ten years to support future publications. The charity wants the young people’s work to remain usable locally.

Option A — the weak clause. “Data will be retained by the University for research purposes in accordance with its retention policy.” At wind-down, the charity has no access, no consultation right and no deletion date. If the charity later wants to use the findings for a funding bid, it must ask permission. If the university’s policy changes, the charity finds out afterwards.

Option B — the specific clause. “The University will retain personal data until 31 March 2031. The Charity will hold a copy of all anonymised transcripts and the final report indefinitely. Any secondary use of personal data beyond the purposes in Schedule 1 requires written consent from the Charity, which will respond within 20 working days. The Charity may nominate a successor organisation to hold its interest if it ceases to operate.”

Option B costs an hour of drafting. Option A costs the community its leverage at the exact moment it has least time to fight for it.

When the partners disagree

Disagreement is normal. The funder wants open data. The university wants long retention. The community partner wants control over how its area is described. The agreement should say how those conflicts are resolved before they arise.

Write in a decision-making process: who decides, in what order, and what happens if consensus fails. The NHS guidance recommends that the process for review and approval, and the weight given to each opinion, should be set out in a partnership agreement. It also lists data ownership and intellectual property, data storage and access, and decision-making processes among the matters a partnership agreement should cover.

For a youth project, add one more layer. The ICO code states that you may share children’s data if you can demonstrate a compelling reason to do so, taking account of the best interests of the child. That is a high bar, and it should shape both what is collected and what is retained. If the young people themselves want their recordings kept, that is a relevant consideration, but it is not the only one.

What to do before the project ends

If you are reading this mid-project and no agreement exists, you are not lost. Do three things now.

1. Write down the five questions from the NHS guidance and get answers in writing from every partner.
2. Agree a deletion date and a named person responsible for confirming it.
3. Name a single contact for data subject requests and tell participants who it is.

Then attach the answers to whatever contract already exists. A short, plain-language schedule signed by all parties is better than a perfect agreement that never gets drafted.

The young people in Sefton did the work. The question is whether, a year after the report is printed, they and their organisation can still point to it and say: that is ours, and we decide what happens next. That question is answered in the drafting, not at the closing meeting.

FAQ

Does the community partner legally own the data if it hosts the peer researchers?

Not automatically. Ownership depends on the contracts, the funder’s terms and who is the data controller for each purpose. The NHS guidance treats ownership as something partners must agree, not something that follows from hosting. Draft it explicitly.

Is a data sharing agreement legally required?

The ICO code describes a data sharing agreement as good practice rather than a universal legal requirement. But the code is statutory, and the Commissioner must take it into account when assessing compliance. In practice, having one is the simplest way to demonstrate accountability.

What if the community organisation closes before the retention period ends?

That is why the agreement should name a successor or set out a process for transferring the community’s interest. NCVO’s help and guidance index includes a closing-down section covering what to consider when closing a charity or voluntary organisation, which is a sensible starting point for that conversation.

Can we just rely on consent forms signed by the young people?

Consent forms address individuals. They do not resolve organisational identifiability, secondary use by a university, or what happens to the data when the project ends. The NHS guidance notes that most policy, including the GDPR, addresses individual rights rather than the rights of communities. The agreement is where the organisational questions get answered.