Research data that falls under export controls or research security rules can leave an institution in ways that look like ordinary academic work: a shared folder, a peer review submission, a cloud workspace or a laptop on a conference trip. UK and US rules treat many of these movements as regulated transfers, and both governments now expect funded institutions to run research security programmes with a cybersecurity element. This guide covers the data side of that problem: how to classify research data for export and security purposes, where intangible transfers happen, the storage, encryption and collaboration controls that keep controlled data within its licence, and how to evidence a programme under UK Trusted Research and the US research security guidelines that followed NSPM-33. It is written for research data managers, export control and research integrity officers, university security teams and IT staff who run research computing. Who gets access, federation and identity lifecycle are covered in the Research Institution Identity Security Guide; this page assumes that foundation.
Source note: UK rules are taken from GOV.UK (ECJU, FCDO and Cabinet Office guidance) and NPSA; US rules from the eCFR and BIS; the OSTP guidelines from published summaries (COGR and law firm analyses) because the White House text could not be retrieved; checked in November 2026. Data handling practices are NHI Mgmt Group recommendations. Confirm against the official text before relying on it.
Key takeaways
- Classify before you share. Export status, sponsor restrictions and research security sensitivity are properties of the data, recorded at project start, not judgements made when someone asks to send a file.
- Intangible transfers are the main risk. UK guidance says export controls can apply to online and cloud activity such as virtual learning environments and e-Research, and an email or cloud upload can be an export.
- Unpublished means not yet exempt. In the UK, research is not in the public domain until published, so sending controlled results overseas for peer review can need a licence.
- Encryption can change the legal answer. Under the US EAR, end-to-end encrypted data meeting the 15 CFR 734.18(a)(5) conditions is not an export, provided it is not intentionally stored in a Country Group D:5 country.
- Funders now expect evidence. US covered institutions must certify a research security programme with cybersecurity, foreign travel security, research security training and export control training elements.
The rules that shape research data controls
Research data security sits where export control law, research security policy and data protection meet. The identity guide sets out the US deemed export and ITAR release rules; the table below adds the UK side and the data-handling consequences.
| Rule or scheme | What it says (as published) | Data control consequence |
|---|---|---|
| UK export controls on academic research (ECJU guidance, updated 2 August 2024) | Controls apply to listed items, software and technology and where there are end-use, end-user or destination concerns; they can apply to online and cloud activities; breaches are criminal offences with penalties including up to 10 years' imprisonment | Treat uploads, emails, remote teaching and overseas cloud storage of controlled technology as possible exports |
| UK public domain exemption | Technology available without restriction on further dissemination is exempt, but research is not public until published | Pre-publication review before controlled results go to overseas reviewers, journals or co-authors |
| UK basic scientific research exemption | Covers work aimed solely at new knowledge, not a practical aim; dual-use only, not military-listed technology, and not where there are end-use, end-user or destination concerns; a Technology Readiness Level of around 1 to 3 is an indicator | Record the exemption reasoning per project; do not assume it applies to applied or sponsor-directed work |
| UK nationality | The UK has no deemed exports: a transfer solely within the UK to a non-UK national is not an export; nationality matters for other schemes such as ATAS | Access rules in the UK follow ATAS clearance and contract terms, not export law alone |
| Academic Technology Approval Scheme (FCDO) | Certain foreign students and researchers in sensitive subjects (by CAH3 code) need a certificate; at least 30 working days to process | Link project access to ATAS status where the subject code requires it |
| US EAR encryption carve-out (15 CFR 734.18(a)(5)) | Unclassified technology secured with end-to-end encryption, FIPS 140-2 or successor modules (or equally effective means) and not intentionally stored in a D:5 country is not an export; data in transit over the internet is not considered stored | Choose cloud regions and key custody so the carve-out holds; decryption means must not be given to a third party |
| US research security guidelines (OSTP, July 2024) | Covered institutions (more than US$50 million a year in federal R&D) certify a programme with cybersecurity, foreign travel security, research security training and export control training | Programme evidence: data classification, cyber controls, travel procedures and training records |
The UK's National Security and Investment Act 2021, in force since 4 January 2022, can also reach research collaborations and licensing in sensitive areas. The Cabinet Office publishes specific guidance for the higher education and research-intensive sectors, and the guidance points institutions to the government's Research, Collaboration and Advice Team (RCAT). This guide summarises these rules and is not legal advice; confirm each case with the export control office or the ECJU.
Classifying research data for export and security purposes
Most institutions already classify data for confidentiality and data protection. Research security needs extra attributes that a generic scheme does not capture. Record them in the data management plan and carry them into the storage location as metadata or labels.
| Attribute | Typical values | Who sets it |
|---|---|---|
| Export status | Not controlled; public domain; basic scientific research exemption claimed; controlled (UK list entry or EAR ECCN or USML category); licence held (reference) | Export control office, with the principal investigator |
| Contract restrictions | Publication approval required; foreign national restriction; CUI marking; sponsor proprietary | Research contracts office |
| Research security sensitivity | Standard; sensitive (dual-use field, sensitive partner or destination); high (controlled or high-risk partner) | Research security lead using Trusted Research due diligence |
| Personal data | None; personal; special category; identifiable health data | Data protection officer |
| Permitted storage | General institutional storage; restricted UK or US region; dedicated enclave | Derived from the attributes above |
- Make the most restrictive attribute win: a dataset that is open for data protection purposes but controlled for export purposes is controlled.
- Classify derived data: models, simulation outputs, code and processed datasets can carry the same control as the inputs. Source code is generally treated differently from object code under the EAR, so record which form is held.
- Review at milestones: export status can change when a project moves from basic to applied work, takes on a new sponsor, or publishes. See the Data Classification Guide.
Where intangible transfers happen
| Activity | Why it can be a transfer | Control |
|---|---|---|
| Sharing a cloud folder or repository with an overseas collaborator | Makes controlled technology available to a person abroad | External sharing blocked on controlled labels; sharing approved by the export control office |
| Submitting unpublished results for peer review overseas | Not yet in the public domain under UK guidance | Pre-publication check of controlled projects before submission |
| Storing data in a cloud region outside the UK or US | Storage location can affect the analysis; under the EAR, intentional storage in a D:5 country defeats the encryption carve-out | Region restrictions and storage policies on controlled projects |
| Teaching or supervising overseas students online | UK guidance says controls apply when STEM courses are delivered electronically to overseas-based students or through an overseas campus | Course content review in sensitive subjects |
| Travelling with a laptop holding controlled data | Taking technology abroad can be an export | Clean loaner devices; controlled data left behind or encrypted under the applicable rule |
| Presenting at an international conference | Slides and discussion can release unpublished controlled detail | Pre-clearance of presentations from controlled projects |
| Using an external AI or analysis service | Uploading controlled data to a provider outside the approved boundary | Approved tools list; block uploads of labelled data |
The common thread is that the researcher usually sees these as normal collaboration. Controls work best when they are built into the platforms researchers already use, with clear routes to approval, rather than as rules that rely on memory.
Storage, encryption and collaboration controls
Tiered storage
- General research storage: for data with no export or contract restriction. Standard institutional controls and MFA.
- Restricted project spaces: for sensitive and sponsor-restricted data. Named membership, external sharing off by default, region-restricted storage, labels enforced by data loss prevention rules. See the Data Loss Prevention (DLP) Guide.
- Controlled enclave: for export-controlled and CUI data. Separate boundary, controlled egress, NIST SP 800-171 controls where a contract requires them, and audit logging reviewed by someone outside the project. See the NIST SP 800-171 and CMMC 2.0 Guide and the CUI Guide.
Encryption and key custody
- Know which rule you rely on: the EAR carve-out in 15 CFR 734.18(a)(5) needs end-to-end encryption, FIPS 140-2 or successor modules (or equally or more effective means) and no intentional storage in a D:5 country. End-to-end means the data is never unencrypted between the originator's and recipient's in-country security boundaries, and decryption means are not given to any third party, including a cloud provider.
- Key custody is the control: if the provider or a support contractor can decrypt, the carve-out may not hold. Hold keys in an institution-controlled key management service or hardware module, and restrict who can use them.
- Do not stretch the carve-out: it covers sending, taking and storing; it does not authorise giving controlled data to an unlicensed person. See the Encryption Export Controls Guide for the separate question of exporting encryption items themselves.
Egress and monitoring
- Controlled egress from enclaves: output checking before data leaves the enclave, the approach trusted research environments use for health data, works equally well for export-controlled outputs.
- Watch for bulk movement: alert on large downloads from restricted spaces, sync to personal cloud storage (ATT&CK T1567.002 Exfiltration to Cloud Storage) and access to project repositories by accounts outside the membership (T1213 Data from Information Repositories). See the Insider Data Theft Guide.
- Leavers and visitors: on departure, check for recent bulk access and recover devices before the account closes.
Building the research security programme evidence
Summaries of the July 2024 OSTP guidelines published by the Council on Governmental Relations (COGR) list four required elements for covered institutions and a compliance window of no more than 18 months after agency plans take effect. Institutions of higher education certify a cybersecurity programme consistent with NIST IR 8481 (August 2023), which, as COGR notes, summarises a study and makes recommendations rather than prescribing a framework.
| Programme element | Data security evidence that supports it |
|---|---|
| Cybersecurity | Data classification records per project, storage tier mapping, enclave controls, DLP rules and access logs for restricted spaces |
| Foreign travel security | Travel registration, loaner device issue and return records, and checks of devices and accounts after high-risk travel |
| Research security training | Completion records for covered individuals, including how to handle controlled data and recognise improper transfer |
| Export control training | Training records for people working with export-controlled technology, linked to project membership in the controlled tier |
In the UK, Trusted Research guidance from the National Protective Security Authority includes a checklist and guidance for academia, guidance for senior leaders, an implementation guide and a countries and conferences guide. Use the same evidence base: due diligence on partners, classification, storage and travel controls. Both regimes reward institutions that can show, for any controlled project, what the data is, where it is, who can reach it and how it is allowed to leave.
Implementation roadmap
- Find controlled projects: work with the export control, contracts and research office to list active projects with export status, sponsor restrictions or sensitive partners. Start with applied work in fields the ECJU identifies as high risk, such as aerospace, applied physics, biotechnology and telecommunications.
- Add attributes to the data management plan: export status, contract restrictions, research security sensitivity and permitted storage become mandatory fields for new projects.
- Stand up the tiers: configure restricted project spaces with external sharing off, region restrictions and labels; build or confirm the controlled enclave for export-controlled and CUI work.
- Pilot with two or three projects: run DLP rules in audit mode first and review the matches with the principal investigators before switching to blocking, so that legitimate collaboration is not broken.
- Add the human checkpoints: pre-publication and pre-presentation review for controlled projects, and travel registration with loaner devices for high-risk destinations.
- Train and record: link training completion to membership of controlled project spaces.
- Roll back safely: if a blocking rule disrupts a project, revert that rule to audit mode for the project, record the exception and the approver, and fix the classification rather than turning the rule off globally.
Decision guidance. A small institution with a handful of controlled projects can use restricted project spaces in its existing collaboration platform plus one hosted enclave. A research-intensive university with defence, space or biotechnology portfolios needs a dedicated enclave service, a classification workflow owned jointly by the export control office and IT, and automated DLP. Where the US encryption carve-out is part of the design, involve export counsel in choosing cloud regions and key custody.
Detection and measurement
- Monitor: external sharing attempts on labelled data; uploads to unapproved cloud or AI services; downloads above a threshold from restricted spaces; enclave egress requests and rejections; access from unexpected countries on controlled projects (see Impossible Travel and Anomalous Sign-In Detection).
Metrics:
- Percentage of active projects with export status and sensitivity recorded in the data management plan.
- Percentage of controlled projects whose data sits in the correct storage tier.
- Number of blocked external shares of labelled data, and the share that were later approved through the export control office.
- Pre-publication reviews completed for controlled projects before submission.
- Training completion for members of controlled project spaces.
- Loaner devices issued for high-risk travel as a share of registered trips.
Framework mapping
| Control | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | NIST SP 800-171 Rev. 3 |
|---|---|---|---|
| Research data inventory and classification | ID.AM-07, ID.AM-05 | AC-21 | Not directly mapped |
| Legal and contractual requirements (export, sponsor) | GV.OC-03 | AC-21 | 03.15.01 |
| Restricting flows out of restricted spaces and enclaves | PR.DS-01 | AC-4 | 03.01.03 |
| Encryption at rest and in transit | PR.DS-01, PR.DS-02 | SC-28, SC-8, SC-13 | 03.13.08, 03.13.11 |
| Use of external collaboration and cloud services | PR.DS-02 | AC-21 | 03.01.20 |
| Monitoring and review of access to controlled data | DE.CM-03 | AU-6 | 03.03.05 |
| Training for people handling controlled data | PR.AT-02 | AT-2 | 03.02.01 |
Common failure patterns
- Classification at the end: export status is first considered when a collaborator asks for data, by which time copies are already in shared drives and inboxes.
- Peer review overlooked: controlled results are sent abroad for review on the assumption that "it will be published anyway".
- Exemption by default: every project is labelled basic research, including sponsor-directed applied work with a practical aim.
- Encryption without key control: the institution relies on the encryption carve-out while the provider holds the keys or the storage region drifts.
- Travel laptops with everything on them: researchers take full project data to conferences in high-risk destinations.
- Enclave with an open back door: a sync client, personal cloud account or unrestricted file transfer tool bypasses egress controls.
Practitioner checklist
- Every active project has export status, contract restrictions and sensitivity recorded in its data management plan.
- Controlled and sensitive data sits in restricted project spaces or an enclave, never in general storage.
- External sharing is blocked on labelled data, with an approval route through the export control office.
- Cloud regions and key custody for controlled data are documented and reviewed against the rule relied on.
- Pre-publication and pre-presentation reviews run for controlled projects.
- Loaner devices and travel registration are used for high-risk destinations.
- Enclave egress is checked and logged; bulk downloads from restricted spaces raise alerts.
- Training records for covered individuals and export control training are linked to project membership.
- Research security programme evidence is mapped to the four OSTP elements and to Trusted Research.
Standards and references
- GOV.UK (ECJU): Export controls applying to academic research
- eCFR: 15 CFR 734.18, Activities that are not exports, reexports, or transfers
- Bureau of Industry and Security: Deemed exports
- National Protective Security Authority: Trusted Research
- GOV.UK (FCDO): Academic Technology Approval Scheme
- GOV.UK (Cabinet Office): National Security and Investment Act guidance for the higher education and research-intensive sectors
- COGR: Overview of OSTP Guidelines for Research Security Programs at Covered Institutions
Related NHI Mgmt Group resources: Research Institution Identity Security Guide · Cybersecurity for Higher Education Guide · Data Classification Guide · CUI Guide · Insider Data Theft Guide. This guide summarises UK and US research security and export control rules and is not legal advice.