Data Repository

A data repository is a system or platform dedicated to the long-term storage, curation, preservation, and dissemination of research data, built around persistent identifiers, standardized metadata, and defined access and reuse terms. That combination is what distinguishes a data repository from general-purpose file storage: a network drive, a personal cloud folder, or a project’s internal file server can hold data, but none of them guarantee that a dataset stays findable, citable, and usable once the project that created it has ended.

What makes something a data repository

Operationally, a system counts as a data repository when it does all of the following for the data it holds:

• Assigns a persistent identifier (typically a DOI) so the dataset can be cited and located independent of where the file physically lives.
• Captures structured, standardized metadata describing the data’s provenance, format, and scope, rather than relying on a filename and a folder structure.
• Commits to a preservation timeframe and a defined process for fixity checking and format migration, rather than storing a file only for as long as someone remembers to keep it.
• Publishes explicit access and reuse terms (a license, an embargo policy, or a controlled-access process for sensitive data) rather than leaving reuse rights implicit.

A data management plan typically names the intended repository up front, and funder data-sharing policies (for example, the NIH 2023 Data Management and Sharing Policy) increasingly expect deposit in a repository that meets a recognized bar rather than an ad hoc storage location.

General-purpose, discipline-specific, and institutional repositories

Data repositories are generally organized around three overlapping axes, each already documented on its own in the CASRAI Dictionary:

• Generalist repositories accept research outputs from any discipline, applying domain-agnostic curation and discovery. Zenodo (operated by CERN, developed under OpenAIRE) and Dryad are commonly used examples — Zenodo has no discipline restriction; Dryad curates datasets tied to a published article across disciplines, with its preservation copy held in the CoreTrustSeal-certified Merritt repository at the California Digital Library.
• Discipline-specific (domain) repositories — also called domain repositories — bound their scope to a particular field, with metadata schemas and curation practices tailored to that field’s data types and community norms: GenBank for nucleotide sequences or the Protein Data Bank (PDB) for macromolecular structures are long-standing examples. A subject repository is the same idea defined by discipline rather than institutional affiliation.
• Institutional repositories are scoped by affiliation rather than discipline — a single university’s repository may hold outputs spanning many fields, managed as part of that institution’s broader scholarly-communication and open-access infrastructure.

These axes are not mutually exclusive: an institutional repository is still either generalist or, less commonly, tailored to a dominant discipline at that institution. When a funder or a data management plan asks “which repository,” the honest answer usually has to specify which of these three axes is actually being satisfied, not just “a repository.”

What makes a data repository trustworthy

“Trustworthy” is not a vague quality judgment in this field — it maps to specific, independently assessed criteria. A trusted digital repository is one whose governance, technical infrastructure, and procedures have been assessed against a recognized standard and judged to meet it, most commonly:

• CoreTrustSeal — a peer-reviewed self-assessment against 16 published requirements, renewable every three years; the de facto entry-level certification for data repositories, recognized by major funders, the European Commission, and OpenAIRE/EOSC. Read the full CoreTrustSeal certification guide for the requirements, process, and fee.
• The nestor Seal and ISO 16363 — respectively a plausibility-checked self-assessment and a full external audit, both against more extensive criteria than CoreTrustSeal’s entry-level tier; see extended-level certification.
• The NIH/OSTP “Desirable Characteristics of Data Repositories” framework (National Science and Technology Council, May 2022) — the reference framework the NIH Data Management and Sharing Policy points investigators to when no NIH-designated or discipline-specific repository exists. It covers identifiers, metadata, curation, security, and provenance, and repositories increasingly publish self-assessments against it directly.

Certification is not the whole picture. Checksum verification and fixity checking — repeatedly confirming stored data hasn’t silently changed — is the practical, ongoing mechanism most certification schemes require underneath the paperwork. And certification is scoped to a specific instance, not a brand: figshare, for example, holds ISO/IEC 27001 information-security certification and helps institutional customers pursue their own CoreTrustSeal certification, but the shared figshare.com platform is not itself CoreTrustSeal-certified — a distinction worth checking directly with any repository rather than assuming from its reputation.

To compare repositories directly, re3data.org — a global registry of research data repositories managed by the Karlsruhe Institute of Technology and Purdue University Libraries, indexing well over 3,000 repositories — lets you filter by certification status, subject area, and metadata standards supported, and is generally a more reliable comparison point than a repository’s own marketing page.

Data repository vs. adjacent terms

A few terms get used loosely alongside “data repository” but describe genuinely different things:

• Data warehouse — a repository of structured, integrated operational data modeled for analytical querying (star/snowflake schema), optimized for reporting and decision-making. This is an enterprise-analytics concept, not a research-outputs preservation and dissemination system.
• Code repository (e.g., GitHub, GitLab) — a version-control system for software source code. Code and data repositories are complementary, not interchangeable: a common pattern is developing code in a version-control platform, then archiving a citable snapshot in a data repository (Zenodo’s GitHub integration is a widely used example) once a persistent identifier is needed.
• General file storage (a network drive, Google Drive/Dropbox folder, institutional file share) — can hold research data during active work, but provides none of the four properties above: no persistent identifier, no standardized metadata for external discovery, no preservation commitment beyond whatever the storage provider’s default retention happens to be, and no formal reuse terms.

See the CASRAI Dictionary’s general repository entry for the broader digital-preservation concept a data repository is one instance of, and FAIRsharing for a curated registry of the standards and policies repositories are often assessed against.

References

• National Science and Technology Council (OSTP), “Desirable Characteristics of Data Repositories for Federally Funded Research” (May 2022).
• CoreTrustSeal Foundation, “CoreTrustSeal Requirements 2023-2025” (coretrustseal.org).
• re3data.org — Registry of Research Data Repositories, Karlsruhe Institute of Technology and Purdue University Libraries.
• NIH Data Management and Sharing Policy (NOT-OD-21-013).