“Repository” and “archive” get used interchangeably in casual conversation about research outputs, but for data management planning, funder compliance, and long-term preservation, the distinction is operationally meaningful. A funder mandate that says “deposit your data in a trusted repository” is not satisfied by uploading a file to any storage location that happens to keep it around. This guide sets out the criteria that actually distinguish a research repository from a general-purpose archive, an institutional repository, and a preprint server, and how researchers and research administrators choose among repository types in practice.
What counts as a research data repository
A research data repository is a managed system for depositing, describing, preserving, and providing discovery/access to research data over time, distinct from ad hoc file storage in that it is built around active curation, standardized metadata, and mechanisms for other researchers to find and cite what is deposited. The Registry of Research Data Repositories (re3data.org), which indexes several thousand such services, uses exactly this bundle of characteristics — persistent identifiers, structured metadata, defined access conditions, and a stated preservation commitment — to decide what belongs in the registry and what does not.
That bundle is the practical test. A location only counts as a research repository if it does most or all of the following:
- Curation: someone or something reviews, validates, or normalizes what is deposited rather than accepting arbitrary files with no oversight.
- Persistent identifiers: the repository mints or supports a resolvable, citable identifier (typically a DOI via DataCite, sometimes a Handle) for each deposited object.
- Structured, standardized metadata: deposits carry machine-readable descriptive metadata (Dublin Core, DataCite Metadata Schema, or a discipline-specific standard), not just a filename and a free-text note.
- Defined access and reuse terms: a stated licence or access-tier policy governs how the deposited object can be reused, rather than leaving that ambiguous.
- A preservation commitment: an explicit intention — ideally backed by a continuity plan — to keep the object accessible and intact over a defined or indefinite horizon, not just “until the server is decommissioned.”
A shared drive, a personal website, a lab’s internal file server, or a general cloud storage bucket can hold research data indefinitely without meeting any of these criteria. That does not make them repositories in the sense a funder mandate or a data management plan (DMP) means when it requires repository deposit.
Repository vs. archive: what actually separates them
“Archive” is the older and broader term, and it is not wrong to call a research data repository an archive — but the reverse does not hold. In archival science, an archive is a body of records preserved for their long-term evidential or historical value, with practices (appraisal, provenance tracking, fixity checking) that long predate digital research data and originate from the discipline of archival management. The OAIS Reference Model (ISO 14721) — the conceptual framework almost every trustworthy digital repository is built on, including research data repositories — itself uses “archive” as the generic term for any organization that ingests, manages, and provides access to information over the long term. So the vocabulary genuinely overlaps.
Where they diverge in practice, for a research administrator deciding whether a given service satisfies a funder or journal repository requirement:
- Scope of content. A general or institutional archive (a university records archive, a national archive, a departmental file store) may hold anything with retention value — administrative records, correspondence, physical objects, digitized historical material. A research data repository specifically handles research outputs: datasets, code, and their supporting documentation, described in ways researchers in that field can discover and reuse.
- Discovery and reuse infrastructure. Repositories are built for a stranger to find and cite a specific dataset — that is why persistent identifiers, standardized metadata, and search/API access matter so much. A general archive’s finding aids are often built for provenance and retrieval by archivists and researchers who already know roughly what they are looking for, not for open discovery by a search engine or a metadata harvester.
- Certification. Frameworks like CoreTrustSeal assess specifically whether a repository meets a defined bar of trustworthiness for research data — mission and scope, deposit/appraisal workflow, metadata quality, technical infrastructure and security. See CASRAI’s CoreTrustSeal certification guide for the full requirement set. A general archive can be a well-run, trustworthy custodian of records without ever engaging with this framework, because it was not built to answer the specific question a data-sharing mandate asks: can another researcher find, verify, and cite this dataset.
In short: every certified research data repository functions as a kind of archive, but not every archive functions as a research data repository. The label that matters for compliance purposes is not the word in the service’s name, but whether it delivers curation, PIDs, standardized metadata, and a stated preservation commitment for research data specifically.
Repository vs. institutional repository
An institutional repository is a repository scoped by affiliation rather than by subject or data type — it is operated by a university, research institute, or funder to hold the outputs of researchers affiliated with that organization, and it often mixes content types (theses, articles, datasets, sometimes grey literature) in one system. That is an organizing axis, not a competing category: an institutional repository can be a perfectly valid research data repository if it also meets the curation/PID/metadata bar above, and a growing number pursue CoreTrustSeal certification specifically to demonstrate that (examples include Apollo at the University of Cambridge and Edinburgh DataShare).
The distinction that trips people up is scope, not trustworthiness: a discipline-specific repository or generalist repository accepts deposits from any researcher working in a given field or on any topic, regardless of institutional affiliation, while an institutional repository is typically restricted to (or at least primarily built for) researchers at that one institution. A funder mandate that says “deposit in a repository appropriate to your discipline” is not automatically satisfied by your home institution’s repository if that repository does not serve your field’s community or metadata conventions — and conversely, a mandate requiring institutional deposit for reporting purposes is not satisfied by depositing only in a subject repository the institution has no visibility into.
Repository vs. preprint server
A preprint server (arXiv, bioRxiv, medRxiv, SSRN, and similar) is a repository for manuscripts — typically the author’s own version of a paper, posted before or during peer review — not for the underlying research data. Preprint servers share several repository characteristics (persistent identifiers, structured metadata, open access, sometimes even discipline-specific curation norms), which is part of why the distinction gets blurred. But the content type is fundamentally different: a preprint server captures a manuscript’s evolving textual record, while a data repository captures datasets, code, or other non-narrative research objects, generally with much more granular structural metadata (variables, file formats, instrumentation) than a manuscript needs. See CASRAI’s arXiv preprints guide for more on how preprint servers work specifically. A DMP data-deposit requirement is not satisfied by posting a preprint of the paper describing the data; the two serve different compliance obligations (open access to the manuscript vs. FAIR access to the underlying data) and are frequently required in parallel, not as substitutes for each other.
The key distinguishing criteria in more depth
Curation
Curation ranges from light-touch (automated file-format and completeness checks on ingest) to deep (subject-expert review of the dataset’s structure and documentation before it is published, as some discipline-specific repositories provide). What separates curation from mere hosting is that a human or automated process is actively assessing what comes in against defined criteria, and can reject or require revision of a non-conforming deposit. A file server that accepts anything uploaded to it is not curating; it is storing.
Persistent identifiers
Most established research data repositories mint a DOI (via DataCite) or a Handle for each dataset or dataset version, giving it a stable, resolvable citation target independent of where the file physically lives or what its current URL happens to be. A repository that cannot mint a DOI without supplying the required DataCite metadata properties (creator, title, publisher, publication year, resource type, at minimum) generally cannot satisfy this criterion at all — the PID and the metadata requirement are linked, not separate features.
Metadata standards
Repositories describe deposits using standardized, machine-readable schemas — Dublin Core and the DataCite Metadata Schema are the two most widely used general-purpose standards, alongside discipline-specific schemas (Darwin Core in biodiversity data, DDI in social science survey data, and others) that capture field-specific structure a generic schema cannot. This is what makes cross-repository discovery and metadata harvesting (by aggregators like re3data.org, or by a funder’s own reporting systems) possible at all. See CASRAI’s guide on descriptive metadata for datasets for the practical mechanics.
Certification (CoreTrustSeal and related frameworks)
CoreTrustSeal is the most widely adopted “core” level of a three-tier trustworthy-repository certification framework — Core (CoreTrustSeal, a peer-reviewed self-assessment), Extended (the nestor Seal, based on the German DIN 31644 standard), and Formal (ISO 16363, a full external audit). CoreTrustSeal assesses a repository against 16 numbered requirements spanning organisational infrastructure (mission and scope, rights management, continuity of service, legal/ethical compliance, governance, expertise), digital object management (provenance, deposit/appraisal workflow, preservation planning, quality assurance, discovery), and technology (storage integrity, technical infrastructure, security). Certification is not a prerequisite for a repository to be genuinely useful, but it is the clearest independently verifiable signal that a repository meets a defined trustworthiness bar — which is why an increasing number of funder policies (including the US OSTP-aligned “Desirable Characteristics of Data Repositories” framework that agencies like NIH point investigators toward) reference certification or its underlying criteria explicitly. CASRAI’s CoreTrustSeal certification guide covers the requirements, process, fee, and renewal cycle in full.
How to choose between repository types
In practice, researchers and research administrators are choosing along two mostly independent axes: scope (discipline-specific vs. generalist vs. institutional) and trust signal (certified vs. uncertified). A practical sequence:
- Check for a funder- or field-designated repository first. Many funders and journals name a specific repository for certain data types — for example, NIH designates dbGaP for controlled-access human genomic data, and GenBank/SRA are the default for most sequence data. Depositing in a named repository, where one exists, is usually the safest compliance choice.
- If no designated repository exists, look for a discipline-specific repository serving your field. A subject repository’s metadata conventions and user community are typically a better fit for discoverability within that field than a generalist repository, even when both would technically satisfy a funder’s generic “trusted repository” language.
- Fall back to a generalist repository (Zenodo, Dryad, Figshare, an institutional repository) when no field-specific or institutional option applies, prioritizing CoreTrustSeal certification (or equivalent) where the funder mandate references trustworthiness explicitly, and confirming the repository can mint a DOI with adequate metadata for your object type.
- Confirm the repository is not simply an archive or generic storage system being asked to do a repository’s job. If it cannot mint a PID, does not enforce structured metadata on deposit, and has no stated preservation commitment, it will not satisfy a “deposit in a trusted repository” requirement even if it reliably keeps files around indefinitely.
CASRAI’s guide to choosing an open data repository and re3data.org’s own comparison tooling are useful next steps once the field is narrowed to a shortlist.
Frequently asked questions
Is every institutional repository a research data repository?
Not automatically. An institutional repository is scoped by affiliation, not content type, and many were originally built primarily for theses and articles rather than datasets. Whether a given institutional repository qualifies as a research data repository depends on whether it meets the curation, PID, and metadata criteria above for data deposits specifically — check the repository’s own documentation or its re3data.org record rather than assuming.
Does a repository need CoreTrustSeal certification to count as trustworthy?
No. Certification is the clearest independently verifiable signal, but plenty of well-run, widely used repositories operate without it. What matters for most funder mandates is whether the repository meets the underlying criteria (persistent identifiers, structured metadata, defined preservation and access commitments) — certification demonstrates that formally, but its absence is not automatically disqualifying unless a specific policy requires it.
Can a preprint server also host datasets?
Some do accept supplementary files alongside a manuscript, but that is not the same as functioning as a dataset’s primary, citable repository — supplementary files on a preprint server typically lack the structured metadata, dedicated PID, and discipline-appropriate description that a dedicated data repository provides. Depositing the dataset itself in a proper data repository and linking to it from the preprint is the more robust approach.
What is the difference between a repository and a database?
A database is a structured store of data, queried directly (often via SQL or an API) rather than downloaded as discrete deposited objects. Some research resources are genuinely both — for example, GenBank functions as both a curated database and a de facto repository for sequence submissions. The repository/database distinction is about access pattern (query vs. deposit-and-download) more than about trustworthiness or curation.
