6.1 Data access creates obligations

Receiving access to data does not transfer ownership or create unrestricted permission. Data remain subject to the conditions established by the data owner, applicable agreements, organizational policy, ethical expectations, and relevant law. A person may be authorized to analyze a file without being authorized to email it, place it on a personal device, upload it to a cloud service, publish a chart, reuse it for another project, or retain it after the work ends.

Responsibility extends beyond the original dataset. Derived and communication products may contain the same sensitive information in a different form. These products include:

• extracts and cleaned files;
• temporary exports and backups;
• screenshots;
• tables and charts;
• small-cell summaries;
• model inputs and outputs;
• reports and presentations;
• prompts sent to an external system; and
• notes that connect coded values to real people or organizations.

A project should therefore treat data protection as a workflow, not as a single decision made when the file is first received.