Data Privacy, Cybersecurity & Research Security
Data privacy, cybersecurity, and research security cover the overlapping legal and technical frameworks that govern how research data, controlled technology, and personal information must be protected. This is one of the fastest-changing areas of research compliance, and this sub-cluster organizes it by the type of obligation involved: information-security controls, data-protection law, export controls, and the newer federal research-security requirements aimed at foreign-influence and interference risks. Information-security obligations for research handling federal controlled unclassified information are increasingly defined by NIST SP 800-171 and the associated Cybersecurity Maturity Model Certification (CMMC) framework used in Department of Defense contracting, while ISO/IEC 27001 provides an internationally recognized information-security-management-system standard many institutions adopt more broadly. Data-protection law includes the EU General Data Protection Regulation (GDPR), which governs research involving personal data of EU residents regardless of where the research is conducted, and the US Family Educational Rights and Privacy Act (FERPA), which protects student education records relevant to research conducted within academic institutions. Export-control law — the Export Administration Regulations (EAR) and the International Traffic in Arms Regulations (ITAR) — governs the transfer of controlled technology, software, and technical data, including to foreign nationals working within a US lab, known as deemed exports. A newer strand, federal research security, stems from National Security Presidential Memorandum 33 (NSPM-33), which directs federal agencies to require disclosure of research support and affiliations and to implement institutional research-security programs. Pages here cover how these frameworks intersect and where institutional responsibility for each typically sits.
Guides
BIS “Affiliates Rule” (50% Rule, Red Flag 29): What University Export-Control Screening Offices Must Do Before November 10, 2026
BIS’s Affiliates Rule automatically extends Entity List and Military End-User List restrictions to majority-owned affiliates. Suspended since Nov 10, 2025, it is due to reimpose on Nov 10, 2026 — here is what university export-control screening offices need to do to prepare, including the Red Flag 29 ownership-diligence duty.
Quantum Computing Export Controls: Deemed Exports and Foreign-National Access Rules for University Quantum Research
Quantum computing hardware, components, software, and technology were newly captured by US export controls in 2024. This guide walks through what that means for a university lab: which items are controlled, what a deemed export looks like on a quantum bench, and how the fundamental research exclusion interacts with foreign-national access.
Confucius Institute Closures and Rebranding: GAO Findings and What They Mean for Foreign-Influence Compliance
What GAO’s 2023 review of Confucius Institute closures actually found, how that differs from separate reporting on institute rebranding, and what both mean for ongoing foreign-influence compliance monitoring.
China’s PIPL and Cross-Border Data Transfer Rules for International Research
PIPL requires separate consent, a PIPIA, and one of three transfer mechanisms (CAC security assessment, SCC filing, or certification) before personal information can leave China — here is what applies to international research collaborations and why it matters.
EU Dual-Use Export Control Regulation 2021/821 and Internal Compliance Programmes
A guide to the EU’s dual-use export control regime for universities and research organisations: Regulation (EU) 2021/821, Commission Recommendation (EU) 2021/1700 on internal compliance programmes, and the 2025 Annex I control-list update.
RCAT: UK’s Research Collaboration Advice Team Explained
What the UK’s Research Collaboration Advice Team (RCAT) does, how institutions engage it for case-by-case national-security advice, and how it differs from the Trusted Research framework it helps institutions apply.
Brazil’s LGPD and Research Data: The Academic-Purpose and Anonymized-Data Exemptions
How Brazil’s LGPD (Law 13,709/2018) applies to research data: the Article 7/11 lawful bases for research bodies, the partial Article 4 academic-purpose exemption, the Article 12 anonymized-data exclusion, and the mandatory Encarregado (DPO) under Article 41.
PIPEDA and Academic Research Data: Federal vs. Provincial “Substantially Similar” Privacy Regimes
How Canada’s PIPEDA applies to academic research data, why it often is not the operative law for core university research, the s. 7(2)/7(3) research-and-statistical-study consent exception, and the substantially-similar provincial regimes in Alberta, BC, and Quebec.
UFIT and Australia’s Guidelines to Counter Foreign Interference in the University Sector
UFIT is the joint Australian government-university taskforce (established Aug 2019) behind the Guidelines to Counter Foreign Interference in the Australian University Sector — a co-designed, principles-based research-security framework, distinct from the UK’s Trusted Research guidance and the US’s agency-enforced NSPM-33 regime.
Canada’s NSGRP: Risk Assessment Form, Due Diligence, and the STRAC Sensitive-Technology List
How Canada’s National Security Guidelines for Research Partnerships (NSGRP) work: the Risk Assessment Form, the due-diligence process, the STRAC sensitive-technology list, and the rule against discrimination as a mitigation tactic.
Horizon Europe Research Security: “As Open As Possible, As Closed As Necessary” and Sensitive-Technology Screening
How Horizon Europe balances its default open-science principle against mandatory security appraisal and sensitive-technology screening, and how that EU framework differs from US research-security regimes like NSPM-33.
MFTRP Annual Re-Certification: What Senior/Key Personnel Must Do Every Year
The recurring annual MFTRP certification for senior/key personnel at NSF and NIH: deadlines, systems (Research.gov vs. RPPR), and what happens when it’s missed.
Empowered Official: The ITAR-Required Export-Control Compliance Role
22 CFR 120.67 defines the Empowered Official ITAR requires every DDTC-registered institution to designate: who can hold it, what independent sign-off authority it requires, and how it differs from a Research Security Officer or EAR compliance lead.
Whistleblower Protections for Reporting Export Control (EAR/ITAR) Violations in Research
Reporting an EAR or ITAR violation on a federally funded research project runs on different statutes than research-misconduct whistleblowing. This guide covers 41 U.S.C. 4712, the DoD-specific 10 U.S.C. 4701, False Claims Act anti-retaliation, DOJ’s 2024-2025 Corporate Whistleblower Awards Pilot Program, and exactly where a report should go.
“Covered Individual” Under NSPM-33: Who Qualifies and What They Must Disclose
Who counts as a “covered individual” under NSPM-33 and the CHIPS and Science Act, the Tier I/Tier II distinction, and exactly what biosketch, Current and Pending Support, MFTRP, and training disclosures each must make.
Insider Threat Program Mechanics Under NSPM-33: Behavioral Indicators and Reporting Channels
NSPM-33’s research security training element requires insider-threat awareness content and a reporting channel — a narrower obligation than NISPOM’s ITPSO-led Insider Threat Program. This guide covers the behavioral indicator categories a compliant training program should name and the reporting-channel mechanics (intake, confidentiality, escalation, non-retaliation, recordkeeping) that make a channel functional rather than nominal.
Deemed Export Screening at Lab Onboarding: A PI Checklist
A practical, step-by-step checklist for PIs and lab managers screening international students, postdocs, and visiting scholars (F-1/J-1/H-1B) for deemed-export risk before granting lab access — covers foreign-person status, visa documents, restricted-party screening, and Technology Control Plans.
Criminal Liability Under the Foreign Direct Product Rule: What Researchers Need to Know
The Foreign Direct Product Rule (15 CFR 734.9) extends U.S. export-control jurisdiction to foreign-made items built on controlled U.S. technology. This guide explains how FDPR works, when a violation becomes criminal rather than civil under 50 U.S.C. 4819, and how researchers and institutions can reduce exposure.
Restricted Research Designation: What It Means and How Institutions Manage It
What makes a project “restricted research,” who at an institution decides, and the operational controls that follow: publication review, technology control plans, restricted-access facilities, and foreign-national exclusion.
Countries of Concern Under the CHIPS and Science Act: What Research Restrictions Actually Apply
The CHIPS and Science Act’s own countries-of-concern list names China, Russia, Iran, and North Korea, plus a Secretary of State designation process, and triggers two specific research restrictions: the malign foreign talent recruitment program ban and Foreign Financial Disclosure Reporting.
5 Actions Required for EAR Compliance: A Checklist for Research Offices
A practical, five-item checklist for what a university EAR compliance program actually needs in place: written policy, restricted-party screening, deemed-export access controls, training, and recordkeeping.
Who Is Responsible for CUI Compliance at a University?
No single office owns CUI compliance at a university. This guide breaks down the distinct responsibilities of the institutional CUI program lead, the IT security office (NIST SP 800-171/CMMC), the sponsored programs office (contract flow-down), and the principal investigator.
Foreign Travel Security Policy: What Research Institutions Must Require Before International Trips
What a compliant NSPM-33 foreign travel security policy actually requires operationally: pre-travel disclosure and registration, destination and restricted-party screening, device and data-security precautions, and post-travel reporting.
ECCN Lookup Guide for Research Equipment: Self-Classification vs. BIS Commodity Classification (SNAP-R)
A practical, step-by-step guide to determining the Export Control Classification Number (ECCN) for research equipment — self-classification against the Commerce Control List, when to request a Commodity Classification from BIS via SNAP-R, and how this fits into university procurement and international shipping.
The Four Pillars of Export Control Compliance
The four operational areas most university export control programs are built around: cybersecurity and deemed-export controls, international travel screening, foreign talent recruitment program disclosure, and training.
NSPM-33 Research Security Program Requirements: The Four Mandated Elements
What NSPM-33’s four required research security program elements (cybersecurity, foreign travel security, training, export control) actually require institutions to build and operate.
Embargoed Countries List for Export Control: OFAC Sanctions and University Research
OFAC’s comprehensively-sanctioned countries list operates on different logic than EAR/ITAR, and universities that only screen for controlled technology can still hit an OFAC problem. This guide covers the current list and what it means for research collaboration, travel, and technology transfer.
DoD Component Decision Matrix: 2026 Foreign-Influence Risk Review
The DoD/DoW’s 2026 Component Decision Matrix screens fundamental research proposals for foreign-influence risk, expanding Prohibited Entity Lists from 4 to 13 and adding an equipment-sourcing restriction.
Thousand Talents Program and Research Security
China’s Thousand Talents Program, how it became the center of US research-security enforcement, the DOJ’s China Initiative prosecutions (including the Charles Lieber case), and the disclosure rules that replaced it.
ITAR US Munitions List (USML): What It Is and How It Applies to University Research
What the USML (22 CFR Part 121) is, its 21 categories, and how it applies to defense-related university research, controlled technical data, and deemed exports.
US-China Research Collaboration: Research Security and Compliance Concerns
US-China research collaboration compliance spans four overlapping regimes — undisclosed foreign talent programs, export control, federal/statutory disclosure requirements, and CFIUS investment screening. This guide orients institutions to how they fit together.
Malign Foreign Talent Recruitment Program (MFTRP): Definition, Disclosure, and Consequences
What makes a foreign talent recruitment program “malign” under the CHIPS and Science Act, the certification requirements this creates for federal grant applicants and recipients, and the consequences of non-compliance.
Export Control Reform and Research Security: What’s Changing and Why
A tracker of the legislative, regulatory, and agency-level reform activity reshaping how EAR, ITAR, and federal research-security requirements apply to US university research since 2022.
CMMC Compliance for Universities: A Guide for Research Institutions
A guide for research administrators on how CMMC 2.0 applies to universities, research institutes, UARCs, and FFRDCs that handle DoD-funded controlled unclassified information (CUI) — levels, scoping, assessment paths, and the phased rollout.
CMS Data Use Agreement (DUA) Mechanics for Research Data
How the CMS Data Use Agreement process works for researchers accessing Medicare and Medicaid claims data: LDS vs. RIF file types, the ResDAC application process, VRDC security requirements, permitted-use restrictions, and how it interacts with general HIPAA obligations.
NIH Foreign Subawards: PF5/UF5 Activity Codes and the 2025-2026 Policy Overhaul
How NIH regulates foreign components and subawards: the foreign-component definition, the new PF5/UF5 (and linked RF2/UL2) activity-code application structure effective January 2026, subrecipient monitoring, and disclosure duties.
Restricted Party Screening
Restricted party screening is the institutional process — not the lists themselves — of checking collaborators, vendors, visiting scholars, and students against the CSL, OFAC, and BIS/State restricted-party lists before engaging with them.
32 CFR Part 117 (NISPOM): A Guide for Universities with Classified Research
32 CFR Part 117 (NISPOM) sets the federal security requirements for facility and personnel clearances at institutions holding classified research contracts. This guide explains what it requires, who at a university it affects, and how it differs from export control.
ISO 27001 for Research Data Security
ISO/IEC 27001 is a general information security management standard, not a research-data standard — here is what it actually certifies, why funders and clinical trial sponsors increasingly reference it, how it relates to CoreTrustSeal and FAIR, and what certification involves.
GDPR and Data Protection Compliance in Research Involving Personal Data
How the GDPR applies to research involving personal data — Article 89 safeguards and derogations, the lawful bases available to research controllers, Article 9 special-category data rules, and pseudonymisation — connected to Data Management Plan practice.
Material Transfer Agreements (MTA): The Practical Process for Sharing Research Materials
The practical process behind a Material Transfer Agreement: standard US templates (UBMTA, NIH Simple Letter Agreement), who negotiates and signs, common IP and publication-rights sticking points, export control and biosafety overlays, and realistic timelines.
Export Control (EAR/ITAR) and International Research Collaboration
How the fundamental research exclusion under EAR and ITAR works, when export-controlled technology or technical data crosses that exclusion, deemed-export rules for foreign national researchers, and practical compliance steps for institutions running international collaborations.
EU AI Act: Obligations and Exemptions for Research Organizations
What the EU AI Act’s Article 2(6) research exemption actually covers, when it stops applying, and what research administration offices need to track as implementation phases in through 2026-2028.
