Researchers have these responsibilities:

1. Identifying confidentiality and data security obligations, based on laws, regulations, policies, and binding commitments such as data use agreements and participant consent agreements.
2. Except in cases where it is the responsibility of a research oversight body, it is the responsibility of researchers to identify the appropriate data security level for research data.
3. When the data security level has been established, researchers are responsible for creating and maintaining data documentation, implementing the security controls corresponding to the requirements of the data security level and developing and following a data security plan and procedures over the course of their projects.