You are an expert in data protection and privacy for M&E and research projects. Generate a data storage and privacy section that would score Excellent (5) on every dimension of the Data Storage and Privacy Practices rubric for the project described in the brief below.
QUALITY REQUIREMENTS:
Storage Location and Access: Name the storage platform, server, cloud region, or device class. Document who is authorized (by name or role), how authorization is granted, how it is revoked when staff leave or change roles, and whether access is logged. Describe differential access by role (collector, analyst, PI).
Identifier Handling: Describe the PII approach in full. Specify anonymization or pseudonymization at each stage (collection, analysis, reporting). Store direct identifiers separately from response data with a documented key-handling protocol. State the conditions and authorization for re-identification (if any). Address quasi-identifier risk in analysis and reporting.
Transfer Security: Describe every transfer in the data lifecycle. Specify encryption in transit and the named protocol or service for collection-to-storage. Specify authorized channels for storage-to-analysis. Approve specific tools for team-member transfers. Prohibit insecure transfer (personal email, consumer messaging, unencrypted USB). Govern inter-organization transfer with a data sharing agreement.
Retention and Destruction: State the retention timeline for each data category (raw, cleaned, identifiers, derived outputs). Describe the destruction approach (secure deletion, certificate of destruction, physical destruction). Name the responsible party and the verification mechanism. Cite donor or legal mandates that require specific retention.
Compliance Framework: Name the applicable data protection regime (GDPR, country law, donor policy, organizational policy). Tie specific requirements from that regime to the practices above (legal basis, data subject rights, cross-border transfer, data protection officer). Where multiple regimes apply, state the relationship.
FORMAT: Present as a numbered section: (1) Storage Location and Access Controls, (2) Identifier Handling and Anonymization, (3) Transfer Security, (4) Retention and Destruction, (5) Compliance Framework and Legal Basis.
PROJECT BRIEF:
[Paste the project type, data categories collected, populations involved, operating jurisdictions, donor and organizational policies, and available infrastructure here]
Quality bar: The result must meet these criteria. It will be reviewed against them afterwards.
- Storage Location and Access: Whether storage location is named (specific platform, server, or device), with access controls (who is authorized, how authorization is granted and revoked, audit logging).
- Identifier Handling: Whether the approach to PII is described, including anonymization, pseudonymization, separation of identifiers from response data, and the conditions under which re-identification is possible.
- Transfer Security: Whether data-transfer practices are specified for transmission between collection, storage, and analysis, including encryption in transit, authorized channels, and prohibition of insecure transfer.
- Retention and Destruction: Whether the retention timeline is stated, the destruction approach is described, and the responsible party and verification mechanism are named.
- Compliance Framework: Whether the applicable data protection regime is named (GDPR, local data protection law, donor policy, organizational policy) and the specific requirements that flow from it are tied to the practices above.
Anything still in [brackets] is not known yet: ask me, or mark it clearly in your answer.