Data Management
Data Transfer
Legal requirements for sensitive data transfers
Researchers handling sensitive data must ensure that appropriate legal agreements are in place before data is accessed, transferred, or processed. Key contractual requirements include:
1. Informed Consent Forms - Must clearly explain how the participant’s data will be used, stored, shared, and protected. - Consent must be specific, freely given, informed, and documented. - For reuse of existing data or samples, secondary use must be covered.
2. Data Transfer and Use Agreements (DTUA / DUA) - Required when data is shared between institutions or across borders. - Must define: - Purpose and limits of use - Data ownership - Security measures - Retention and deletion terms
3. Data Processing Agreement (DPA) - Mandatory when working with third parties (e.g., cloud providers, subcontractors) who process personal data on behalf of the institution. - Must comply with Swiss FADP and, where applicable, GDPR. - Includes clauses on confidentiality, technical measures, and audit rights.
4. Collaboration Agreements - When working with external partners, this contract should clarify: - Roles and responsibilities - Compliance with applicable laws (FADP, HRA, GDPR) - Intellectual property and publication rights
5. Ethics Approval - Although not a contract, approval from an Ethics Committee (e.g., UEK) is often legally required. - Includes a review of consent processes, data handling plans, and compliance with the Human Research Act (HRA).
6. Cross-border Data Transfers - Transfers outside Switzerland or the EU require: - Adequate protection levels in recipient countries - Standard Contractual Clauses (SCCs) or equivalent safeguards under GDPR - Notification or approval from the Swiss Federal Data Protection and Information Commissioner (FDPIC) in some cases
Additional information
Data Transfer tools at sciCORE+
In this section you will find instructions on different methods for transferring data into your sciCORE+ secure project space.
If your data is coming from a Hospital, or another major Swiss Institution, you can consider checking if the Data Provider is already a member of the SPHN Data Providers Network. If in doubt, you can contact us at scicore-admin@unibas.ch, or the DCC at biomedit@sib.swiss
SETT
What is sett?
Developed under the BioMedIT project, sett (Secure Encryption and Transfer Tool) is a Rust-based application for packaging, encrypting, and transferring data. It’s available as both a desktop and command-line tool.
sett is open-source under the GPLv3 license, with code hosted on GitLab.
Installation
sett is available for Linux, macOS, and Windows as both a command-line and desktop application.
You can download sett here.
Using sett
For a quick introduction to using sett, see the Quick Start Guide.
For complete details, refer to the sett User Guide.
SFTP
Info
What is sftp: SFTP (Secure File Transfer Protocol) is a network protocol that allows users to transfer files securely between computers over the internet or a local network
SFTP using command line
sftp command line utility is installed by default in Linux and Mac systems and users can use it to transfer files from the command line.
Warning
In this example the username is pescobar and the server to connect to is demo-login.scicoreplus.unibas.ch
Make sure to use your username (you can find it in your profile in the portal) and the correct server hostname
which you can find in the resources section in the portal
Start the sftp connection and you will get in your shell the authentication url:
Copy this url to your browser to complete the EduID 2FA authentication:
Click on the SWITCH edu-ID button to introduce your credentials and the 2FA code:
Once you have sucessfully authenticated you will arrive to this page where you can authorize the sftp connection:
Once you get the message “Device Login Successful” you can come back to the terminal in your computer where you started the sftp connection and press ENTER to login:
After you press ENTER in your local terminal you will get a message like Connected to login-node.scicoreplus.unibas.ch
and you will get the sftp prompt
SFTP desktop application
If you prefer to use a graphical application for sftp transfer you can download FileZilla. Filezilla works on Windows, Linux and Mac.
Warning
In this example the username is pescobar and the server to connect to is demo-login.scicoreplus.unibas.ch
Make sure to use your username (you can find it in your profile in the portal) and the correct server hostname
which you can find in the resources section in the portal
First configure the site to connect as in the screenshot below. Make sure to use “Logon type: interactive” as this is very important in order to use 2-factor auth
Once you click on “Connect” you should get a window with the 2FA login url. Copy the provided url and paste it in your browser in order to complete the 2 factor authentication.
Once you paste the auth url in your browser you can follow the authentication procedure. Once you get “Device login successful” as in the latest screenshot you can come back to filezilla and click in OK.
Other data transfer possibilities at sciCORE+
Additionally to sett and sftp, it is possible to transfer data in and out of your sciCRE+ project space also with other tools. Those bear much higher risks for the data transfer, and it is in the responsibility of the Project Leader to assess and accept this risk, and properly inform and train the sciCORE+ project users on how to handle the data transfers.
In the table below you will find a summary of all methods available for data transfers to and from a sciORE+ project.
Additional Information
For further details on data transfer, please contact us at scicore-admin@unibas.ch
sciCORE+ recommended data transfer methods
| Transfer method | Description | Destination | Accessible to | Logs |
|---|---|---|---|---|
| sftp | Project Data Managers can open a sftp connection to the b-space using a sftp client, authenticate with 2FA and export to a selected location – only incoming sftp connections are be allowed. | External and sciCORE+ b-spaces | Data Managers only | Full |
Further options requiring a clear data transfer policy at project-level and written risk acceptance by the PL (closed by default)
| Transfer method | Description | Destination | Accessible to | Logs |
|---|---|---|---|---|
| sett | Project data managers can use the sett tool and initiate a data transfer to another b-space from within the b-space. Condition: Project needs to be register as a Data Provider with the DCC and initiate a DTR | Any b-space | Data Managers only | Partial |
| ssh | Projects with ssh access can transfer data using the scp and rsync commands on command line | External | Any user of the b-space | None |
| gitlab | Projects with access to external git repositories can transfer data using git commits | External | Any user of the b-space | None |
| OOD Apps | OOD file transfer module, RStudio, Jupyter Notebooks Apps can be provided upon request and include data export options | External | Any user of the b-space | None |