From Data Lifecycle to Project Governance: A Project-Phase Model for Research Data Management and Research Security

We present a project-phase–based training model for research data management (RDM) and research security, developed and piloted by Suna Kıraç Library in a one-week intensive course titled “Data Management in Multi-Partner and Industrial Research Projects.” The model reframes RDM not as a library-centered activity but as a multidisciplinary and integral component of research project governance. To that end, it addresses legal, infrastructural, and security risks at each stage of collaborative research.

The model's core innovation is its project-phase structure. Rather than organising RDM around traditional data lifecycle categories, the training aligns data management and research security with the phases of a research project: design, partner identification, negotiation, proposal writing, project onset, results generation, and post-project reuse. This approach helps researchers understand when FAIR principles, legal obligations, data sovereignty concerns, and security requirements become operationally relevant and how these considerations shape decision-making in multi-partner and cross-border research environments.

The pilot implementation focused on clinical research, where legal obligations and data security pose some of the most substantial challenges across disciplines. Training sessions addressed legal research security, the protection of sensitive clinical data, consent management, and risks associated with international collaboration and foreign interference. We devoted a full training day to securing research infrastructure, including a nuanced discussion of institutional, hybrid, and cloud-based architectures, access-control models, and trusted research environments. This design allowed the model to be stress-tested under conditions where research security is hardest to operationalise.

The training was explicitly designed as a cross-disciplinary capacity-building initiative to underscore shared institutional responsibility for research security and data stewardship. The instructor cohort included librarians, legal experts, project managers, clinical researchers, ethics board members, and IT specialists. Group activities for participants included DMP-writing exercises, metadata and README tasks, and expert panels addressing legal and security risks at each project phase. Despite its online format, the pilot fostered sustained dialogue between academic and non-academic audiences deeply interested in multi-partner project management.

Evaluation results demonstrate maturity and impact: all participants reported that the course met or exceeded expectations; 86% rated it 8/10 or higher and said they would recommend it to colleagues; and no dissatisfaction was reported. A follow-up iteration will be held in February 2026 in a hybrid format, funded by the Turkish National Science Foundation.

The accompanying poster visually presents the training model, its structure, and outcomes, highlighting transferable lessons for libraries and research-support units across Europe. Although piloted in Turkey, the project's phase logic and security framing are directly applicable to research environments in Norway, France, and beyond, providing a practical model for libraries that support a secure society.