How to Write a Data Management Plan (DMP) for Your Thesis Step by Step (2026)

Your university asks for a data management plan and you stare at the template, unsure where to start. A DMP sounds bureaucratic, but it is one of the most practical documents you will write during your thesis — it forces you to think clearly about how to write a data management plan before you collect a single data point, saving you from costly mistakes later. Whether your supervisor requested it, your funder mandates it, or your ethics committee needs it, this guide walks you through every section, the tools that make it easier, and exactly what UKRI, NSF, and Horizon Europe expect.

A data management plan is a living document — typically two to five pages — that describes what data you will collect, how you will store and protect it, who can access it, and what happens to it after your project ends. Funders including UKRI, NSF, and Horizon Europe now require one as a condition of award. Even when not mandated, a DMP makes your research more reproducible, protects sensitive participants, and prepares your dataset for long-term reuse.

What is a data management plan and when do you need one?

A data management plan is a structured document that answers three questions: what data does your project generate, how will that data be kept safe and usable during the project, and how will it be preserved and shared afterwards? Unlike the methodology chapter of your thesis, a DMP is not a description of your intellectual approach — it is an operational plan for your files, folders, and datasets. The two documents complement each other: your methodology chapter explains your research design; your DMP describes the practical infrastructure that supports it.

You will need a DMP in three common situations:

• Funder-mandated: UKRI, NSF, NIH, Wellcome Trust, and Horizon Europe all require a DMP as part of the grant application or as an early deliverable.
• Institutionally required: Many UK universities now require doctoral students to submit a DMP within the first six months of their programme as part of the annual review process.
• Good practice: Even when not required, writing one before you collect data prevents format chaos, backup failures, and last-minute data sharing panics at submission.

Choosing your tool: DMPonline vs DMPTool

Two tools dominate DMP writing, and choosing the right one depends on your location and funder:

Both tools are free. Both provide inline guidance notes and example answers within each template question, which makes filling in your DMP much faster than starting from a blank document. The Digital Curation Centre (DCC), which maintains DMPonline, also publishes a 13-question DMP checklist useful as a generic template when no funder template applies.

Step 1 — Describe what data you will collect

Begin by listing every type of data your project will generate or reuse. Be specific: a vague answer like “interview data” is less useful than “24 semi-structured interview recordings in MP3 format, averaging 45 minutes each, totalling approximately 11 GB.” Cover:

• Data types: quantitative (survey responses, measurements, counts), qualitative (transcripts, field notes, images), experimental (spectroscopy files, sensor logs), or computational (code, model outputs).
• Volume: approximate file sizes and number of items. This informs storage planning later.
• Source: are you generating new data, reusing existing datasets, or combining both? Reused datasets carry their own licensing conditions — state them here.
• Existing data: check whether datasets already exist that could reduce collection burden. Repositories such as Zenodo, the UK Data Service, or Dryad may already hold relevant data.

Step 2 — Specify formats and metadata standards

Funders and repositories favour open, non-proprietary formats because they remain readable without specialist software. For each data type, state your preferred format and a long-term archival format if they differ:

Alongside formats, specify the metadata standard you will use so that others can understand your data without asking you. Generic options include Dublin Core and DataCite. Discipline-specific standards include DDI (social sciences), EML (ecology), and MIAME (genomics). Good metadata is the foundation of FAIR data principles — making your data Findable, Accessible, Interoperable, and Reusable.

Step 3 — Plan storage and security during the project

This section addresses where data will live while your project is active and who can access it. Common institutional storage options include:

• University network drives — typically managed IT infrastructure with regular automated backups and access controls. Often the safest default for sensitive data.
• Cloud services (OneDrive, SharePoint, Google Drive) — convenient for collaboration but check whether your institution’s data governance policy permits storing personal or sensitive data on these platforms.
• Repository pre-upload — services like the Open Science Framework (OSF) allow private project spaces that can be made public at a later date.

State access controls clearly. For sensitive or personal data, only named individuals should have read/write access. Describe any encryption in place — for example, AES-256 encryption at rest for files containing personally identifiable information (PII). Note whether data is collected on portable devices, as laptops and USB drives require full-disk encryption.

Step 4 — Define your backup strategy

The standard recommendation is the 3-2-1 rule: three copies of your data, stored on two different types of media, with one copy held offsite. In practice for a thesis student this usually means:

1. Primary copy on your laptop or desktop.
2. Second copy on an external hard drive or university network storage.
3. Third copy in cloud storage (OneDrive, Google Drive, or institutional provision).

Your DMP should state how frequently backups run (daily is ideal for active data collection periods) and who is responsible for checking backup integrity. Document version control too: for code and text-based data, a Git repository with meaningful commit messages constitutes excellent version control. For a practical walkthrough of the 3-2-1 rule applied to thesis files, see our guide on how to back up your thesis safely.

Step 5 — Address ethics and legal compliance

This is one of the most scrutinised sections, especially for research involving human participants. Cover the following points:

• Ethical approval: state the approving body (university ethics committee, IRB, NHS REC) and the reference number. If no formal approval is needed — for example, for fully anonymised secondary data — explain why. Our guide on when you need ethics approval for secondary data covers the exemption criteria in detail.
• Informed consent: describe how participants were informed about data use, storage, and sharing, and how consent was recorded (signed form, electronic tick-box, verbal consent with audio record).
• Personal data and GDPR: for EU/UK researchers, state your legal basis for processing personal data under GDPR (usually consent or legitimate interest) and confirm that your data processing is registered with your institution’s data protection officer.
• Anonymisation and pseudonymisation: explain the steps taken to protect participant identity in stored files — for example, replacing names with participant codes, removing IP addresses, or aggregating location data.
• Data sensitivity classification: categorise your data (open, restricted, highly sensitive) and ensure storage and access controls match the sensitivity level.

Step 6 — Describe data sharing and open access

Most funders now expect research data to be as open as possible and only as closed as necessary. Your DMP should specify:

• Which data will be shared: not all data can or should be open — raw audio files containing voices, datasets with small sample sizes that risk re-identification, and commercially sensitive data are legitimate exceptions. Be specific about what you will and will not share.
• Where data will be deposited: name a trusted repository appropriate to your discipline. Zenodo and Figshare accept all data types; Dryad focuses on life sciences; the UK Data Service handles social science data; the European Genome-phenome Archive handles sensitive genomic data.
• Licence: Horizon Europe requires CC BY or CC0. UKRI recommends CC BY. For code, an MIT or Apache 2.0 licence is conventional.
• Timeline: state when data will be deposited — typically at the time of publication or thesis submission. Some funders allow an embargo period of up to 12 months for commercially sensitive work.
• Access route: open (immediately downloadable), restricted (access on request with justification), or embargoed (open after a set date). For more on crafting the accompanying statement, see our guide on how to write a data availability statement.

Step 7 — Plan for long-term preservation

After your thesis is submitted and your project ends, data needs a home. This section addresses what happens next:

• Retention period: UKRI requires data underlying publications to be retained for at least ten years after last access or publication. Horizon Europe requires at least five years after project end. Clinical data may have longer legally mandated periods.
• What will be kept: define selection criteria. Raw data, cleaned data, analysis code, and codebooks should typically be archived. Intermediate processing files and failed pilot data may be deleted.
• Where it will be stored: a trusted digital repository with persistent identifiers (DOIs) is best. Avoid leaving data only on a personal hard drive or university server account that will be deactivated when you leave.
• Who is responsible: for a thesis, you are usually the primary data steward; confirm whether your supervisor or institution shares any custodial responsibility.

Step 8 — Align with funder-specific requirements

Each major funder has its own DMP template, word or page limits, and submission timeline. The table below summarises the key requirements for the three funders most relevant to thesis students in 2026:

If your thesis does not have an external funder, check your institution’s own requirements. Many UK, Australian, and Canadian universities now require doctoral students to submit an institutional DMP — often using the DCC’s 13-question checklist as a generic template in DMPonline when no funder template applies.

Frequently asked questions