Research Guides: NIH Policy for Data Management and Sharing: NIH Genomic Data Sharing Policy

About

The NIH Genomic Data Sharing (GDS) Policy, effective January 25, 2015, governs the sharing of large-scale human and non-human genomic data generated through NIH-funded research. The NIH Data Management and Sharing (DMS) Policy, effective January 25, 2023, complements and enhances the GDS Policy by introducing a unified framework for data management and sharing across all NIH-funded research:

Integration of Data Sharing Plans:
- Under the DMS Policy, investigators must submit a Data Management and Sharing Plan (DMS Plan) with their funding application. This policy applies to all NIH-funded or NIH-conducted research that generates scientific data and incorporates genomic data sharing requirements.
- Researchers no longer need to submit a separate Genomic Data Sharing Plan; instead, genomic data considerations are addressed within the broader DMS Plan.

Key Components of a DMS Plan for Genomic Data Sharing:
- Repository Selection:
  - Non-human genomic data: can be stored in any widely used repository. See the list of some commonly used repositories here. In addition, the National Library of Medicine provides a Submission Portal to help find the appropriate NIH repository for sequence data.
  - Human genomic data: all studies generating human genomic data that fall within the scope of the NIH GDS policy must first register in the Database of Genotypes and Phenotypes (dbGaP), NIH's central repository for human genomic and associated phenotypic data, even if the data will be submitted elsewhere. See the list of some commonly used repositories here. Researchers who have questions about where their data may be deposited should consult with their program officer (Extramural, grants and contracts) or scientific director (NIH Intramural).
- Ethical and Legal Considerations: Aligning with the GDS Policy’s requirements for de-identified and controlled-access human genomic data, the DMS Policy emphasizes ethical considerations and compliance with informed consent for data sharing. Researchers should address the ethical/privacy concerns, or limitations on human genomic sharing in the DMS Plan (i.e., through de-identification, Certificates of Confidentiality, and other protective measures).

NIH Security Best Practices for Users of Controlled-access Genomic Data

Effective January 25, 2025, the NIH Implementation Update for Data Management and Access Practices Under the Genomic Data Sharing Policy (Notice# NOT-OD-24-157), introduces enhanced security requirements for accessing controlled-access human genomic data. This update applies to Principal Investigators (PIs) who are approved to access data from these 20 NIH-controlled access repositories (designated as Approved Users). The updated security standards for Approved Users include the following requirements:

Approved Users agree to terms of access in the Data Use Certification or Data Use Agreement (e.g. NIH Security Best Practices for Controlled-Access Data Subject to the NIH Genomic Data Sharing (GDS) Policy).
On January 25, 2025, Approved Users who submit a new request or renew an existing request will be expected to secure data according to the updated NIH Security Best Practices.
Approved Users will attest to NIH that the IT systems used to store human genomic data comply with NIST SP 800-171.
If Approved Users utilize a third-party IT system and/or cloud service provider for data analysis and/or storage, they must provide NIH with an attestation confirming the third-party system’s compliance with NIST SP 800-171.

For resources on using genomic data responsibly under the NIH Genomic Data Sharing Policy, click here.