Privacy Policy for UPSI Research Data Management (RDM) Portal
Last Updated: 3 April 2026 (GMT +8)
1. Introduction
This Privacy Policy explains how Universiti Pendidikan Sultan Idris (UPSI), through Perpustakaan Tuanku Bainun, manages personal data and research data within the Research Data Management (RDM) Portal (“the Portal”).
The Portal supports research data lifecycle management in line with institutional policies, funder requirements, and applicable laws including the Personal Data Protection Act 2010 (PDPA), Malaysia.
By accessing or using the Portal, you agree to this Privacy Policy.
2. Types of Data Collected
2.1 Personal Data
We may collect the following personal information:
- Name
- Staff / student ID
- Institutional affiliation (UPSI or external collaborator)
- Email address and contact details
- User account credentials (securely encrypted)
2.2 Research Data
- Research datasets (including structured and unstructured data)
- Metadata and documentation
- Data Management Plans (DMPs)
- Project and grant information
Users are responsible for ensuring that uploaded data complies with ethical approvals and does not violate confidentiality, privacy, or legal restrictions.
2.3 Sensitive Personal Data
Where applicable (as defined under PDPA), this may include:
- Health-related data
- Biometric or identifiable human subject data
- Any data requiring ethical clearance
Such data must only be uploaded with proper authorization and safeguards.
2.4 Technical Data
- IP address
- Browser and device information
- Access logs and activity records
3. Purpose of Processing
Data is collected and processed for the following purposes:
- To provide RDM services including storage, curation, and sharing
- To support compliance with UPSI research policies and funder requirements
- To enable data publication (including Open Data where applicable)
- To ensure security, auditing, and system integrity
- To improve portal functionality and user experience
- To facilitate collaboration and controlled data access
4. Legal Basis (PDPA Compliance)
Processing of personal data is based on:
- User consent
- Performance of institutional functions (education and research)
- Compliance with legal and regulatory obligations
Users may withdraw consent where applicable, subject to operational and legal constraints.
5. Data Sharing and Disclosure
Data may be shared under the following conditions:
- Within UPSI (authorized staff, librarians, system administrators)
- With research collaborators (as permitted by the data owner)
- Publicly, if datasets are published as Open Data
- With funders or regulatory bodies when required
- With third-party service providers under strict data protection agreements
UPSI does not sell personal data to third parties.
6. Data Classification and Access Control
Data within the Portal may be classified as:
- Open – publicly accessible
- Restricted – access upon request or approval
- Confidential – limited to authorized users only
Users are responsible for selecting appropriate access levels.
7. Data Storage and Security
UPSI implements appropriate safeguards including:
- Secure institutional servers or approved cloud infrastructure
- Encryption (in transit and at rest where applicable)
- Role-based access control
- Regular monitoring, logging, and security audits
- Backup and disaster recovery mechanisms
However, UPSI cannot guarantee absolute security.
8. Data Retention
- Personal data will be retained in accordance with UPSI policies and PDPA requirements
- Research data retention follows:
- Institutional guidelines
- Funder requirements
- Research integrity standards
Data may be retained beyond project completion for archival, verification, or compliance purposes.
9. User Responsibilities
Users must:
- Ensure data accuracy and legality before upload
- Obtain necessary ethical approvals
- Anonymize or de-identify sensitive data where required
- Assign correct licensing (e.g., Creative Commons) for shared data
- Avoid uploading prohibited or unlawful content
10. User Rights (Under PDPA)
Users have the right to:
- Access their personal data
- Request correction of inaccurate data
- Withdraw consent (where applicable)
- Request restriction of processing
Requests can be submitted to the contact below.
11. Cookies and Usage Tracking
The Portal uses cookies and similar technologies to:
- Maintain login sessions
- Improve system performance
- Analyze usage patterns
Users may adjust browser settings to control cookies.
12. Third-Party Services
The Portal may integrate with external systems (e.g., ORCID, authentication services, analytics tools). These services are governed by their own privacy policies.
13. Policy Updates
This Privacy Policy may be revised periodically. Updates will be published on the Portal and, where appropriate, communicated to users.
14. Contact Information
For any inquiries or data requests:
Perpustakaan Tuanku Bainun
Universiti Pendidikan Sultan Idris (UPSI)
Email: reference.pustaka@upsi.edu.my