NIH Genomic Data Sharing (GDS) Policy

The NIH Genomic Data Sharing (GDS) Policy is a 2014 National Institutes of Health data-sharing policy that governs how NIH-funded research generating large-scale genomic data must be consented, submitted, and shared for secondary use. It predates and sits alongside — rather than inside — the broader 2023 NIH Data Management and Sharing (DMS) Policy: a genomics-generating award is typically subject to both, and the GDS Policy’s genomics-specific consent, Institutional Certification, and controlled-access requirements are not superseded by DMS Policy compliance.

Operational definition

A study is covered by the GDS Policy when it is NIH-funded (in whole or in part) and generates large-scale human or non-human genomic data, including genome-wide association studies (GWAS), SNP arrays, whole-genome or whole-exome sequencing, and other data types such as transcriptomic, epigenomic, metagenomic, and gene-expression data at a genome-wide scale. The policy, issued via NIH Guide notice and Federal Register publication on August 27–28, 2014 and effective for competing applications submitted on or after January 25, 2015, expanded the scope of NIH’s original 2007 GWAS-specific data-sharing policy to this wider set of large-scale genomic data types.

For human data, three requirements distinguish a GDS-covered study from ordinary NIH data-sharing expectations:

• Prospective, GDS-specific informed consent. For specimens or data collected, or cell lines created, on or after January 25, 2015, the consent form must inform participants that their genomic and phenotypic data may be used in future research beyond the original study and that individual-level data will be shared broadly through a controlled-access repository. This consent requirement applies even where the resulting data will be de-identified.
• Institutional Certification. Before data can be submitted to a repository, the investigator’s institution — via its Signing Official, in coordination with the IRB — must certify that the submission is consistent with the GDS Policy, with the informed consent of the original participants, and with the preferences of the study population. The IRB determines whether the Institutional Certification accurately reflects the terms of consent and whether any research-use limitations (for example, disease-specific or non-commercial-use restrictions) must be flagged for the repository.
• Submission to an NIH-designated repository. Covered data must be deposited in a repository NIH designates for the data type — dbGaP (the Database of Genotypes and Phenotypes) is the primary controlled-access repository for large-scale human genomic and associated phenotypic data.

dbGaP and controlled access

dbGaP holds two tiers of data: an open-access tier (study documentation, summary statistics, variable dictionaries) that requires no request, and a controlled-access tier (de-identified individual-level genotype/phenotype records, pedigrees, and participant-level association results) that requires review and approval by the specific study’s Data Access Committee (DAC). There is no single central DAC — each dataset’s DAC evaluates requests against the consent-based use limitations set out in that study’s Institutional Certification.

To request controlled-access data, a Principal Investigator submits a Data Access Request through the dbGaP Authorized Access System (via their eRA Commons credentials) and agrees to a Data Use Certification (DUC) Agreement and the Genomic Data User Code of Conduct. The institution’s Signing Official must co-sign before NIH review. Approval grants “Approved User” status for a one-year access period, renewed annually via a Project Renewal and Progress Update, or closed out; failing to renew or close out within the grace period after expiration results in account suspension.

How GDS differs from the NIH DMS Policy

The GDS Policy (2014) and the NIH Data Management and Sharing (DMS) Policy (effective January 2023) are separate, overlapping requirements, not one policy superseding the other:

• The DMS Policy applies to essentially all NIH-funded research that generates scientific data, regardless of discipline, and requires a Data Management and Sharing Plan submitted at the time of application, reviewed by NIH program staff (not peer reviewers) for adequacy.
• The GDS Policy applies specifically to large-scale genomic data, predates the DMS Policy by nearly a decade, and layers on genomics-specific machinery the general DMS Policy does not require: GDS-specific prospective consent language, Institutional Certification tied to IRB review, and controlled-access dbGaP submission with a Data Use Certification.

In practice, an award that generates large-scale genomic data must satisfy both: a DMS Plan describing the overall data management and sharing approach, and separately, the GDS Policy’s consent, certification, and dbGaP-submission requirements for the genomic data specifically.

Examples

Covered: An NIH R01-funded study conducting whole-exome sequencing on a cohort of 800 participants to identify variants associated with a disease phenotype. Because the study generates large-scale human genomic data, it is GDS-covered: the consent process must address future use and broad sharing, the institution must submit an Institutional Certification, and the resulting genotype/phenotype data must be deposited in dbGaP under controlled access.

Not covered: An NIH-funded qualitative interview study collecting no genomic or genetic data is subject to the general NIH DMS Policy (a Data Management and Sharing Plan is still required) but is not GDS-covered, since it generates no large-scale genomic data and triggers no dbGaP submission, consent-language, or Institutional Certification obligation.

Related terms

See also dbGaP and the broader Data Management Plan (DMP) concept that the NIH DMS Policy builds on.