Standardising Access to Sensitive Data with Machine-Actionable Access Conditions
TL;DR
A framework for standardising access governance using machine-actionable access conditions that addresses key challenges identified in the Dutch context — including fragmentation, administrative burden, and inconsistent decision-making — and is applicable across European data infrastructures is presented.
Abstract
Abstract Introduction While many countries have invested heavily in secure technical infrastructures such as Trusted Research Environments (TREs), the rules that determine who may access which data, under what conditions, and for which purposes are still expressed primarily as natural language legal and administrative documents, with little or no accompanying machine-readable representation. This limits automation, interoperability, and scalability, particularly for research that spans multiple data holders. Objectives This paper examines these challenges through the Dutch social science data landscape and presents a framework for standardising access governance using machine-actionable access conditions, with the aim of bridging the gap between secure technical environments and scalable access governance. Methods Building on the Open Digital Rights Language (ODRL), we propose a library of reusable access condition templates and a Data Access Broker service. The framework was developed through iterative consultation with data holders in the Dutch SSH domain and draws on ongoing developments within the European Open Science Cloud (EOSC) and related data sharing initiatives. Results We demonstrate that machine-actionable access conditions can operationalise legal and organisational oversight in a transparent, auditable, and interoperable way without replacing it. The proposed framework addresses key challenges identified in the Dutch context — including fragmentation, administrative burden, and inconsistent decision-making — and is applicable across European data infrastructures. Conclusions The approach does not replace legal or organisational oversight, but operationalises it in a transparent, auditable, and interoperable way. While grounded in the Dutch context and the ODISSEI infrastructure, the challenges addressed are common across Europe. The paper presents a concrete implementation pathway supporting ongoing developments within EOSC and related data sharing initiatives.