Handling sensitive data responsibly is essential for some types of research. But putting a set of rules, regulations or guidance documents online does not mean researchers will understand how those rules apply to their own work. Nor does it mean they will feel confident enough to act when they encounter an unfamiliar situation.

This is the gap Dr. Vanessa González Ribao is addressing as part of the ASSURED project. Vanessa develops and coordinates ASSURED’s e-learning platform, with the aim of supporting safe research by safe people.

At first glance, her path to this role may look atypical. Vanessa holds an international PhD in Contrastive Linguistics and has worked in lexicographic projects, databank development and scientific infrastructure. She also brings more than ten years of teaching experience. However, there is a clear thread running through this work: helping people make sense of complex information and use it well.

Vanessa was looking for a new challenge when she first saw the ASSURED role. “The training-coordinator part aligned perfectly with my background,” she explains, while data protection was “exactly the new challenge” she had been looking for. Since joining the project, she has been able to draw on her existing skills while developing new expertise in data protection and secure research environments, supported by a talented team of experts.

In her earlier work, Vanessa often translated complex research findings and specialist knowledge into accessible learning materials for different groups of users. As she puts it, this involved creating materials “tailored to the specific needs of diverse learners.” Her focus was simple: understand the audience, identify key takeaways, and structure content so it’s easy to use. She now brings this user-centered approach to ASSURED.

ASSURED serves researchers and other professionals working across different disciplines, countries and secure research settings. This creates an obvious challenge. There are core principles that everyone handling sensitive data should understand, but researchers do not all work with the same types of data, the same services or the same responsibilities. A one-size-fits-all training course would either become too general to be useful or so extensive that people would struggle to find the content relevant to them.

For Vanessa, the answer is modularity. “The secret lies in modular design,” she says. ASSURED is being developed as a flexible learning environment with core modules covering the baseline essentials of responsible data handling, alongside more specialised modules focused on particular data types, services and professional roles. A researcher, data manager or data steward may therefore share a common foundation while following a learning pathway suited to their own work.

This matters because the purpose of e-learning should not be to recreate a static guidance document in a web browser. As Vanessa puts it, information that requires people only to read, scroll or click “next” can remain a rather passive experience. People learn more effectively, she argues, when they “actively do things with the material rather than consume the theory.”

Instead, ASSURED aims to combine text, video, audio and infographics with activities that give learners something to do with the information. Some activities may test knowledge. Others may encourage reflection or allow learners to explore an issue in greater depth. The point is to help people connect general principles to the practical decisions they make in their own work.

Behind this is a substantial amount of work translating expert knowledge into learning. Sometimes the ASSURED team begins with conversations with domain experts, identifying what researchers need to know in order to work safely in a particular field. At other times, they begin with existing texts, slides or other source material. In both cases, the task is to identify the key learning objectives and then build the structure, activities and assessments that will help learners achieve them.

For Vanessa, however, the goal is larger than ensuring that researchers can complete a training module successfully. Working with sensitive research data can involve personal information and data concerning potentially vulnerable people. Researchers need to understand why safeguards exist in the first place, not merely memorise a series of requirements.

“When people understand how crucial it is to handle sensitive data responsibly,” Vanessa explains, “they become interested in learning best practices and are much more likely to apply them naturally in their day-to-day work.”

Just as importantly, she wants people to feel able to ask for help. Researchers can sometimes feel uncertain about how to handle a situation, or reluctant to admit that they do not know the answer. Vanessa’s goal is for people completing ASSURED training to “feel confident managing their daily responsibilities safely,” and to feel comfortable seeking guidance when they need it.

That is the contribution Vanessa is making to ASSURED: helping researchers understand, apply and feel confident about the responsibilities that come with working with sensitive data.

On 14–15 September in Cologne, the ASSURED Workshop brought together professionals from Research Data Centers (RDCs) from Germany, the UK, and Canada to assess the current landscape of AI integration within RDCs and Trusted Research Environments (TREs). Participants shared perspectives on key technical, risk, and governance challenges when using sensitive data to work with AI, discussed how targeted training can help address these emerging infrastructure gaps.

Day 1 | Expert Talks

Sessions explored the technical and operational shift AI brings to secure data environments. Discussions covered context-dependent privacy risk taxonomies, disclosure risks and output controls like RELEASE-AI and SACRO-ML, early-pipeline mitigations across the TRE lifecycle, an AI policy developed at a German RDC, clear policy boundaries for LLMs within Data Use Agreements, and multi-tiered data classification schemes paired with robust technical safeguards.

Day 2 | Word Café

Building on the insights from Day 1, structured small-group dialogues synthesised individual perspectives into collective action. Discussions addressed researcher and staff requirements across three main areas: identifying essential technical skills, assessing AI risk exposure, and establishing robust governance frameworks to guide safe AI deployment.

Thank you to everyone from 🇩🇪, 🇬🇧, and 🇨🇦 for driving this vital conversation forward!

From here, we are developing plans to keep up the discussions in our community and work on joint outputs, such as guidelines on AI policies for TREs. If you’d like to join the conversation, please do not hesitate to reach out to us at info@assured-training.org!

Sensitive data – health records, administrative registers, qualitative interviews touching on people's private lives – holds enormous value for research. But making it available safely is hard, and the people responsible for that work are telling us, clearly and consistently, what they need most: training.

That's the headline finding from a recent study by the CESSDA (Consortium of European Social Science Data Archives) Sensitive Data Working Group, chaired by ASSURED team member Deb Wiltshire. Between April and May 2025, the group surveyed 20 Service Providers (i.e., institutions that provide access to research data) across Europe to understand what stands in the way of sharing sensitive data, and what support would help.

What the survey found

The results were striking. 65% of respondents identified training as a core need, ahead of legal expertise or guidance (55%) and examples of best practice (45%).

Financial and human resources topped the list too, but training wasn't far behind – and it's notable that it outranked even legal guidance. Services aren't just short of rules to follow; they're short of the practical know-how to apply them.

Taking it further in Bergen

Those findings didn't stay on the page. At the CESSDA 50th Anniversary Conference in Bergen, Deb Wiltshire and Brian Kleiner (FORS, Switzerland) ran a workshop "Advancing Access to Sensitive Data", using a 'World Café' format to dig deeper into the themes the survey had surfaced:

• Limited financial and human resources
• Lack of technical solutions and infrastructure
• Lack of know-how, experience, or skills
• Concern about risk and liability
• Demand from researchers and data owners

Across every table and every theme, one message kept coming back: training matters, and it matters for two distinct groups – researchers and staff – each with different gaps to fill.

Researchers need practical guidance

Participants were blunt about the difficulties researchers face. Sensitive data is hard to access, and once access is granted, many users simply don't know how to handle it responsibly. A recurring problem was that researchers struggle to even recognise what counts as sensitive data in the first place, let alone how to manage it correctly through a project's lifecycle. What came up again and again was a simple, practical request: a checklist. Something concrete that tells researchers what to do at each stage, rather than leaving them to interpret abstract principles on their own.

Staff need it just as much – and the stakes are high

Training isn't only a researcher problem. Service provider staff were just as clear that they need formal training and guidance on what their organisation is actually required to do. Without that, individual staff members are left carrying decisions that should be backed by organisational policy and process.

The consequences of getting it wrong loom large. As one participant put it, the words that came up most in their discussion were reputation and trust – and reputational damage from a sensitive data breach can outlast any legal penalty. That's a heavy responsibility to place on staff who haven't been given the tools to manage it.

And the risk landscape is shifting. Participants pointed to generative AI as a new and largely unaddressed challenge: once data is fed into an AI tool, it may be impossible to remove, and even datasets that were previously considered low risk now carry a higher risk profile as a result. Staff can't be expected to navigate that shift without support.

The takeaway

Put together, the survey and the Bergen workshop tell a consistent story. Services want to open up access to sensitive data. The demand from researchers is real, and so is the public value of that research. But limited resources, technical gaps, and above all a lack of skills and know-how are holding that work back, and the fear of what happens if something goes wrong is enough to make services cautious.

Training won't solve every barrier on its own. But it's the one intervention that speaks to almost every theme on that list at once: it builds the know-how services say they're missing, it gives researchers the checklist they're asking for, it reduces the risk of costly mistakes, and it helps staff and researchers alike keep pace with a fast-changing technical landscape.

Where ASSURED fits in

This is exactly the gap the ASSURED project was set up to close, under the banner "safe research by safe people." It's building a suite of e-learning modules and a certification scheme, and its two-track design maps directly onto the needs this survey identified.

For researchers, ASSURED offers short, self-paced, interactive modules – the practical, checklist-style guidance Bergen participants said was missing. Essential modules cover what every researcher needs to know, with optional modules for specific roles and datasets, so training stays relevant without becoming one-size-fits-all.

For Research Data Centers and their staff, ASSURED provides a way to certify users and build team expertise systematically, rather than leaving staff to interpret organisational responsibilities alone – directly addressing the "what do we have to do as an organisation" gap raised repeatedly in the workshop.

The certification model also speaks to the risk and reputation concerns raised in Bergen, giving services a defensible, consistent standard rather than ad hoc judgement calls. It's an approach already established in the UK; ASSURED is now adapting it for Germany and, in time, more of the CESSDA network – turning the training gap this survey uncovered into a concrete, shared solution.

Read more about CESSDA at cessda.eu, or explore ASSURED's training modules at assured-training.org/trainings.

Handling sensitive data responsibly is becoming an essential part of research. Yet for many researchers, formal training in safe, legal and ethical data use remains limited. This is exactly the gap that Dr. Frederic Gerdon is helping to address as a new member of the ASSURED project at GESIS – Leibniz Institute for the Social Sciences.

Frederic brings a combination of skills that align closely with ASSURED’s mission. His background rests on three core areas: empirical research, teaching, and data ethics. Trained in quantitative methods, he has worked extensively with data throughout his academic career. This experience gives him a strong understanding of how sensitive data are produced, what makes them valuable, and why they require careful handling.

Alongside his research expertise, Frederic has a clear commitment to teaching. He has taught at both Bachelor’s and Master’s levels and has completed formal training in higher education and learning. For him, teaching is not just about delivering content, but about designing materials that people actively engage with. This perspective plays an important role in ASSURED, where the goal is not simply to inform researchers, but to support meaningful learning and fostering the motivation to keep engaging with the covered topics.

A third pillar of his work is a long-standing interest in data ethics and privacy. Since his Master’s studies, Frederic has been engaged with questions around privacy and responsible data use. He is also involved in collaborative efforts to integrate data ethics more systematically into university teaching, including work with researchers at LMU Munich. This focus feeds directly into ASSURED’s aim to promote the ethical use of sensitive data.

Within the project, Frederic is primarily involved in developing and reviewing training modules. These modules cover key topics such as data ethics, legal frameworks for data protection, and statistical disclosure control. They are designed to support researchers working with sensitive data, particularly in secure environments such as Trusted Research Environments.

The first of these modules is already in use, providing guidance for researchers accessing data through the Secure Data Center at GESIS. Further core modules are currently in development and will expand the training offering in the near future.

What motivates Frederic most is the potential impact of this work. While researchers generally care about ethical and legal considerations, these topics are often addressed only in the context of specific projects. ASSURED aims to change that by offering structured, accessible training that researchers can use proactively.

Looking ahead, Frederic is particularly interested in seeing the training adopted more widely, across research data centers and beyond. The longer-term vision is to make high-quality training in secure data use easier to access, more consistent across institutions, and ultimately more embedded in everyday research practice.

Registration is now OPEN for our essential workshop at the International Data Curation Conference (IDCC) 2026! The ASSURED Project is developing an accreditation scheme for handling sensitive research data. This workshop is your opportunity to gain critical expertise.

What You Will Learn:

• Safe Outputs: Explore the issues emerging from sensitive data results and learn the principles for producing non-disclosive, safe outputs.
• Key Techniques: Focus on methods like Statistical Disclosure Control (SDC) to minimise harm and protect privacy.
• Interactive Training: This is a highly interactive-focused session, encouraging rich discussion among researchers and data professionals.

Who Should Attend? This training is important for:

• Researchers working with sensitive data.
• Data Curators and professionals involved in data access.
• Anyone responsible for ethical data release.

Elevate your professional standards. Secure your spot and become more confident in working with sensitive data.

👉 Register Today for the Workshop at IDCC 2026: https://t1p.de/8ltfu

Learn more and apply here: https://lnkd.in/ejpuSYnv

Are you passionate about the intersection of FAIR data, open science, and researcher education? Join the Data Services for the Social Sciences department, where you'll play a vital role in ensuring safe, reproducible research.

This role is centered on our GESIS Secure Data Center and the exciting, multi-partner ASSURED project. You will be key in developing a new Safe Researcher Training program both in Germany and internationally.

Your Impact Will Include:

• Lead the coordination and communication for the multi-consortium ASSURED project.
• Design and continuously improve digital learning materials (video tutorials, interactive exercises) in spatial transcriptomics data processing.
• Contribute to high-impact research activities on data governance, privacy, and secure data infrastructures.
• Provide essential support for the Secure Data Center, including conducting statistical disclosure reviews.

What We Are Looking For:

• A completed Master’s degree and a completed or in-progress Ph.D. 🎓
• Proven experience working in Trusted Research Environments (TREs) or with sensitive data.
• Strong command of quantitative methods and statistical programs like Python, R, and Stata.

We offer an international, interdisciplinary environment with flexible working hours, mobile working options, and excellent benefits, including subsidies for childcare.

Ready to shape the future of secure social science research?

Learn more and apply here: https://lnkd.in/ejpuSYnv

We are currently looking for someone to join the ASSURED team for 3 years to develop and deliver training to researchers and data professionals working with sensitive data. We're an international team, spread across multiple sites, although this role sits within the Secure Data Center at GESIS Cologne. If you want to work in a small but dynamic team and play your part in the exciting development work here at ASSURED and GESIS, then please get in touch!

The ASSURED team had an amazing time at the #EOSCSymposium2024 in Berlin! We spent three days discussing FAIR sensitive data and training opportunities. Presenting our poster was a highlight. Let´s foster FAIRness and trust in research and researchers. #OpenScience #FAIRData #SensitiveData #SafeP...