Summary report about HEAP data governance. Public deliverable 2.3

This Deliverable describes the governance of the HEAP Platform. The HEAP platform is a generic term for the tools developed during the HEAP project and allows for several use cases. A researcher or research institute could employ the HEAP platform as its research environment. However, that does not necessitate a specific HEAP governance. As explained in the HEAP sustainability plan (D1.2), the tools will remain available at the HEAP GitHub repository for as long as that site exists. As governance is, in essence, about the responsible and accountable balancing of the interests of various stakeholders, one specific research institution using HEAP tools is not relevant for a particular HEAP governance document. That research institution will have already organised its governance.A very different use case is where a data holder on the one hand and a requesting researcher (affiliated with a research institution, other than the data holder) at the other end use the HEAP Platform, with all the tools already embedded in it as has been developed during the Project, and which is hosted at CSC. As the processor, CSC offers a secure data analytics environment with these HEAP tools. In that case, this data chain involves various responsibilities of each party, and a HEAP-specific governance document should give guidance. Hence, this document is about this specific use caseThe responsibilities of the various entities involved in this data chain are described. It starts with a research protocol submitted by the requesting researcher. The data holder should approve that the requested data may be used for the intended research according to its own governance, including its commitment to the cohort participants or registry.To make the HEAP Platform governance easily accessible to researchers, a split has been made between a concise core document and explanatory appendices. Appendices start with a letter explaining further legal arrangements that must be made between the data holder and the requesting researcher (via their research institution). Appendix 1 describes the Secure Processing Environment and the Five Safe principles. Appendix 2 discusses the governance literature about data-intensive research and justifies the choices made for the governance of the HEAP Platform.