Backed by Y CombinatorFree template
A data management plan for your funder, a journal sharing statement and a retention note, plus sheets that record what each dataset may share.
Free download · No account needed
What you get
Pack of 6 files: 3 documents, 3 spreadsheets
Research Data Management Plan TemplateConsent Constraint Map
| Dataset | Sharing Status |
|---|---|
| Household survey, de-identified | Public deposit |
| State health department extract | Not shared |
The second row is blocked by the department's own data use agreement, not by anything participant consent says.
A data management plan (DMP) is a short document that says what data a research project will produce and how you will look after them. NIH and NSF, which call it a data management and sharing plan, ask for one with grant applications. A good plan takes each dataset in turn. It says how the dataset will be stored and described, who may access it, where and when it will be shared, and how long it stays available. Where a dataset can't be shared, the plan says why.
Answer the sharing question one dataset at a time. One study can produce a survey you may post publicly and health records you may never share, and no single sentence is true of both.
Get your funder's current format before you write, because NIH and NSF both changed theirs in 2026. NIH now requires a 2026 format page1 of mostly yes-or-no questions. NSF has dropped its two-page PDF: you build the plan in a form on Research.gov2, with one entry per category of data3.
What NIH and NSF ask for
| Question | NIH | NSF |
|---|---|---|
| Format | Seven elements, mostly yes or no | One form entry per data category |
| Limits on sharing | One answer of up to 300 words, with specific reasons | A justification for each category that has limits |
| Data types and repositories | A table of up to 100 words | Named in each category's entry |
| When to share | By publication, or the award's end for other findings | At publication, unless you justify an exception |
| How long | At least as long as the repository or journal requires | At least two years after the project, or justify less |
| Who reviews it | Program staff, usually outside the peer review score | Reviewers, under Intellectual Merit or Broader Impacts |
Check your funding opportunity too: some NIH institutes and NSF programs add their own requirements.
Draft the plan alongside your grant proposal, since the aims decide what data you'll produce.
List each dataset the project will create or receive, including records from a hospital, school or state agency. Those often arrive under a data use agreement whose terms can bar sharing even where participants agreed to it. Give each dataset its own row:
Split files that carry different identifiers, even if they came from the same visit. A survey coded by study ID and a file of home coordinates describe the same people but may not get the same sharing answer. Start a data dictionary for each one, so anyone reusing it knows what every variable means.
For each dataset, find the consent form's sentence on sharing and read any agreement that covers it. NIH lists consent that won't permit sharing, and agreements that restrict it, among justifiable reasons to limit sharing1. It generally won't accept that data are too small, unlikely to be widely used or without a suitable repository.
Where consent and an agreement differ, follow the stricter one. Participants can't waive a contract they never signed, so a state agency's ban on redistribution stands even if your consent form allows public sharing. If a form says nothing about sharing, ask your IRB how to read it.
Give each dataset one answer from a short list: public deposit, restricted access, aggregate only or not shared. Restricted access is what NIH calls controlled access4: requesters must verify who they are and that their proposed use is appropriate. NIH says to consider it for data with explicit limits on use, sensitive data and data that can't be reliably de-identified.
Household survey, 450 respondents: public deposit. Consent allows de-identified data to be shared publicly.
Staff interviews, 22 participants: not shared. Consent covered quoted excerpts only, and job titles would identify people.
Travel times from 450 homes to six clinics: aggregate only. Consent covers county-level findings, not home locations.
State health department records for 410 of the households: not shared. The agency's data use agreement bars redistribution.
Still writing the consent form?
Say plainly how each kind of data will be shared. NIH's privacy guidance asks for consent that is clear about future sharing4 and its limits. The IRB and ethics application template covers the form.
Name a repository for each dataset you will share, and say plainly when a dataset won't go to one. NIH expects established repositories1 to be used when they exist. Prefer one built for your field or data type. NSF also encourages repositories that give each dataset a persistent identifier2, such as a DOI.
Then price the work. NIH lets you budget for curating, de-identifying and depositing data5, but every cost must fall within the award period. If your plan keeps data in a fee-charging repository for 10 years, you pay for all 10 years before the award ends. In your budget justification, explain these costs in half a page or less under the label "Data Management and Sharing Justification."
Set retention by record type: consent forms, the key linking codes to names and the repository copy can each follow a different rule.
An approved plan is a set of promises your funder will check. NIH staff review compliance with approved plans in each annual progress report1. If your data types or repository change, update the plan and get the funding institute's approval.
When you publish, many journals ask for a data availability statement saying where readers can get the data. Avoid a bare "available upon reasonable request." A 2022 study in the Journal of Clinical Epidemiology6 asked the authors of 1,792 papers in BioMed Central journals for data their statements said they would share. Of those authors, 1,669 (93%) didn't respond or declined.
Instead, give each dataset the paper uses the same answer as your plan: what is available, where and on what terms, and what isn't, and why. The open-access publisher PLOS won't accept an author as the only contact for restricted data7, and asks for a data access or ethics committee instead.
Before you submit the plan
The template on this page has a worked plan, sharing statement and retention note, built from a dataset register and a consent map. With Edit with AI, River fills in both sheets from your answers, then drafts the documents to match.
Use the files as they are, or open them in River. River asks what your study collects: each dataset, its format, roughly how many records, and what the consent form or any data agreement says about it. It fills in the Dataset Register and Consent Constraint Map, one row per dataset, then drafts the plan, sharing statement and retention note to match those rows.
Get the three Word documents and three CSV sheets free, or open them in River and start from what your study collects.
Add each dataset to the Dataset Register, including records a partner sends you, with its format, size and identifiers.
In the Consent Constraint Map, give each dataset one sharing answer and name the consent clause or agreement behind it.
Write the plan and statement from the map yourself or with River, then run the Deposit Checklist before any upload.
Dataset RegisterFour datasets under one IRB approval, one row each.
| Dataset | Format | Records |
|---|---|---|
| Household survey | CSV / SPSS | 450 households |
| Staff interviews | Audio + transcript | 22 participants |
| Travel-time matrix | GIS / CSV | 450 households by 6 clinics |
| State extract | CSV | 410 of 450 households |
Same approval, same consent process for three of the four. The fourth is a linkage with a second, separate consent.
Consent Constraint MapFour rows, four sharing answers, checked before either document is drafted.
| Dataset | Sharing Status | Basis |
|---|---|---|
| Household survey | Public deposit | Consent names public deposit explicitly |
| Staff interviews | Not shared | Consent offered excerpt use only |
| Travel-time matrix | Aggregate only | Consent excludes point-level location |
| State extract | Not shared | Blocked by the state's own data use agreement |
The fourth row is not a consent question at all. The department's agreement controls regardless of what participants agreed to.
Deposit ChecklistOnly one of the four datasets ever reaches this sheet.
| Step | Applies To | Status |
|---|---|---|
| Small-cell suppression confirmed | Household survey | Complete |
| Accession number received | Household survey | Not started |
| Any deposit step | Interviews, extract | Not applicable |
Not applicable is a checked answer here, not a blank one. The other three datasets were never headed for a repository.
A data management plan should name each dataset the project will create or receive and say where and when it will be shared. It also covers each dataset's format, who can access it, how long it stays available and who is responsible. Where sharing is limited, the plan gives the specific reason, such as a consent limit or a data use agreement.
As long as your funder's format allows, and no longer. NIH's 2026 format is mostly yes-or-no answers, with a 300-word cap on limitations and a 100-word table of data types and repositories. NSF replaced its two-page PDF with a Research.gov form that takes one entry per data category. Fill in what the form asks and leave out general background.
Yes, and you should update it when your data or repository change, usually with your funder's approval. At NIH, the funding institute must approve the updated plan. At NSF, you need the program officer's prior written approval2 if the change alters the project's objectives or scope, and exceptions to sharing belong in the plan you first submit.
A data management plan goes to your funder before the research starts and covers every dataset the project expects to produce. A data availability statement is printed in a paper and tells readers where to find the data behind that paper and how to get them. Both should give the same answer for any dataset they mention.
Yes. The three Word documents and three CSV sheets download free, with no signup. They come filled in with a made-up study of four datasets, so you can see how each file works before you clear it. Edit with AI opens the same template in a free River workspace.
It opens the template in a free River workspace and asks what your study collects, dataset by dataset, along with any consent or agreement wording you have. River records each dataset's sharing answer first, then drafts the plan and sharing statement from those answers rather than one blanket line. Nothing goes to a funder or journal until you send it.
National Institutes of Health. “Writing a Data Management and Sharing Plan.” grants.nih.gov (opens in a new tab)
NSF - U.S. National Science Foundation. “Policy Notice: Implementation of Policy Changes to Proposal and Award Policies and Procedures Guide (PAPPG) 24-1, Supplement 2.” nsf.gov (opens in a new tab)
Research.gov. “Data Management and Sharing Plan.” research.gov (opens in a new tab)
National Institutes of Health. “NOT-OD-22-213: Supplemental Information to the NIH Policy for Data Management and Sharing: Protecting Privacy When Sharing Human Research Participant Data.” grants.nih.gov (opens in a new tab)
National Institutes of Health. “Budgeting for Data Management & Sharing.” grants.nih.gov (opens in a new tab)
Journal of Clinical Epidemiology. “Many researchers were not compliant with their published data sharing statement: a mixed-methods study.” pubmed.ncbi.nlm.nih.gov (opens in a new tab)
PLOS One. “Data Availability.” journals.plos.org (opens in a new tab)
Written by
Co-founder & CEO, River
Chandler has spent the last six years working in AI, building tools for millions of users and Fortune 100 companies. In 2025, he co-founded River to build a new kind of operating system for AI agents.