1. Cloud-based storage

1.1. Supported cloud-based storage

The cloud-based storage services of OneDrive and Teams, linked to your '@bath.ac.uk' account, are University-supported and managed. These platforms provide a secure environment for storing University files and research data, including sensitive special category data.

Your University OneDrive account is named 'OneDrive - University of Bath.' If you have an additional OneDrive account linked to a personal email address, it will be named ‘OneDrive - Personal’ - staff should not store University files here.

OneDrive and Teams are suitable for storing documents and various file types. However, when storing exceptionally large research data files or those subject to frequent changes (e.g. EndNote files), the X: drive or your H: drive may be more appropriate due to how cloud storage synchronises files. Staff and students can also benefit from using files.bath for University files or research data, which offers secure file storage with the same ease of use.

1.2. Un-supported cloud-based storage

Staff and students should use caution before storing information on unsupported cloud service providers, for example, Google Drive. As a general rule, you should not use any unsupported third-party cloud service providers. Use of these platforms can increase the risk of legal or reputational consequences should the information you are storing or processing be lost, stolen, or seen by unauthorised persons or organisations.

When working with other organisations, such as universities, public bodies, or commercial partners, you may be given access to cloud services or file-sharing technologies managed by the partner organisation. You should verify that these services align with the requirements outlined in the research contract or data management plan before storing any data on such platforms.

DDaT will not install sharing applications onto PCs where there would be an unacceptable security risk, or would otherwise interfere with the network.

2. Considerations before deciding to store data in the cloud

2.1. Sensitivity

Although there is no way of guaranteeing the security of data anywhere, implementing best practice measures can significantly reduce the risks of data loss or breaches.

The data stored on files.bath is held on secure servers located on campus. This adds an extra layer of assurance to data security that unsupported cloud services (which might store your data anywhere in the world) cannot provide.

University-managed OneDrive and Teams both automatically provide encryption of data “at rest” (where data is stored) and “in transit” (when transmitted over the network) and ensure that data remains resident in the UK.

Our advice is to consider the nature of the information. If it includes sensitive personal, non-public information (e.g. addresses, financial information, health information, or confidential educational records) it must be stored on systems that are designed with security in mind and which typically use access control and encryption to prevent unauthorised access. If loss or unauthorised access of the data would be in breach of the Data Protection Act, or cause embarrassment or reputational damage to the University, it should not be placed with unsupported cloud service providers.

2.2. Value and Ownership

The University's research produces valuable intellectual property. If you have files or data that have high intellectual or financial value (e.g. original research papers or designs), unsupported cloud service providers should not be used. If you have data that would impact the University in any way should that data be lost or become unavailable, multiple, secure methods of data storage are recommended, of which files.bath and University-managed OneDrive and Teams are recommended by the University.

2.3. Research Restrictions

If you are undertaking research, there may be restrictions in place that would preclude the use of cloud technology. These include confidentiality agreements with partner organisations or research subjects, restrictions as part of your research grant, or import/export restrictions. You should check carefully before submitting files to a cloud service provider and ensure that all parties and stakeholders in the research are satisfied that your handling of the data is sufficiently robust. Good management of university research data, and data management plans are becoming increasingly important. Should you require support in developing your data management plan, you can contact the Research Data Service Team.