Research Records normally should be maintained in the office, laboratory or department where they are created and used, or otherwise on University premises or in electronic computing systems maintained by the University. Principal Investigators and other University faculty and staff who lead or administer research projects are responsible for maintaining an orderly system for recording, retaining, accessing, and storing their Research Records, and for communicating such systems and their proper use and access to the members of their research teams and other appropriate administrative and academic personnel, including administrative leadership of their department(s). Research Data and Materials in particular must be stored in compliance with the Harvard Research Data Security Policy (http://www.security.harvard.edu/research-data-security-policy) and, in the case of Research Data and Materials relating to human subjects research, in a manner that complies with all applicable IRB and University requirements, and with any relevant contracts, data use agreements and federal regulations.
 As of the date of initial adoption of these FAQs (July 31, 2012), University electronic systems may not be fully capable of handling all electronic storage related to research, due to technological limitations. As stated in this policy, researchers should use Harvard electronic systems to store and transmit Research Records whenever possible, and must migrate Research Records to Harvard systems when capacity becomes available. When it is not possible to use Harvard systems due to a lack of internal capacity, researchers should only use external data storage providers that have been approved by the University CIO. This is especially important in the case of research involving high-risk confidential information, because external data storage providers may lack adequate security measures. In any situation involving storage of Research Records on systems external to Harvard, it remains the researcher’s obligation to assure that such Research Records can promptly be made available to the University, school and department, as needed, for administrative, audit and research integrity purposes.