ODISSEI Five Safes License: Sharing Sensitive Data with Confidence

30 March 2026

Written by Tadas Bernotas (in collaboration with Angelica Maineri)

Why sensitive data needs its own license

“As open as possible, as closed as necessary”. This principle sits at the heart of Open Science and FAIR. For many datasets, applying this principle is straightforward. Data about neighbourhood pollution or flight patterns at Schiphol, for example, can often be shared using standard, permissive licenses (you can read more about common licenses in our previous post). These licenses clearly specify the conditions for reuse, making it easy for providers to share and for users to engage with the data.

But what about sensitive data? Hospital records, location data, employee numbers—even when pseudonymized, these datasets require a different approach. Most data providers are understandably uncomfortable applying a standard permissive license to such information. They need more control. Some datasets demand an even higher level of protection, such as being analysed only within secure environments or requiring formal verification of each user’s identity.

So, how can organisations share valuable but sensitive data to foster innovation and research, while still protecting privacy and maintaining control? To solve this challenge, we at ODISSEI have developed a new tool designed specifically for this purpose: The ODISSEI Five Safes License.

The gap the ODISSEI Five Safes License fills

The idea came from conversations with data holders, particularly non-institutional providers like private companies, who are often willing to share data but face significant barriers. Banks, websites and other organisations that collect data are frequently open to sharing it for research purposes. However, they often have three requirements:

  1. Simplicity: They usually lack a dedicated data protection officer or legal team for data sharing. The process needs to be as simple as possible.
  2. Clarity: They have a general desire to protect their data, maintain control, and prevent uncontrolled redistribution, but they lack a specific set of data access and reuse terms.
  3. No standard exists: Creative Commons licenses are not designed for, and cannot be used with, sensitive data. Existing institutional licenses, such as the ones offered by DANS, are tied to a specific archive and cannot be used by other providers.

The ODISSEI Five Safes License fills this gap. It provides a standardised, ready-to-use tool that gives data providers the control they need, while remaining simple enough for organisations without specialised expertise to adopt with confidence.

How the ODISSEI Five Safes License works

As the name suggests, the ODISSEI Five Safes License is built upon the Five Safes framework—a proven approach for sharing sensitive data, developed by the UK’s statistical office and successfully implemented for over a decade. The framework is organised around five core principles:

  • Safe Data: Ensuring the data itself is appropriately de-identified and protected.
  • Safe Projects: Verifying that the intended use of the data is legitimate and serves the public good.
  • Safe People: Confirming that researchers have appropriate training and authorisation.
  • Safe Settings: Controlling the environment in which data is accessed and analysed.
  • Safe Outputs: Reviewing research results to prevent disclosure of sensitive information.

The License translates this framework into a standardised, binding agreement and spells out the conditions under which sensitive datasets can be accessed and used.

In practice, the license requires three key elements:

  1. Secure Environment: The data must be analysed within a Trusted Research Environment (TRE), such as SANE, ensuring that the data never leaves a controlled space.
  2. Eligible Researchers: Access is limited to researchers affiliated with approved research organisations, such as universities.
  3. Formal Agreement: The researcher must formally agree to the conditions set out in the license with the data controller.

What does the ODISSEI Five Safes licence mean for researchers and data providers?

The ODISSEI Five Safes License does more than standardise paperwork. For data providers, it removes the administrative burden that keeps valuable datasets locked away, with no need to build a framework from scratch or hire specialist expertise. The license offers an instant, trusted framework that handles the complexity for them.

For researchers, it means more data becomes accessible. Data that were once locked away, because providers simply didn’t have the time, expertise, or resources to share them, can now be opened up for research that benefits society. In short, the license turns a complicated, often intimidating process into something straightforward. It gives providers confidence to share, and researchers access to the data they need.

What’s coming next for the ODISSEI Five Safes License

We’re currently translating the license into a machine-readable format using ODRL (Open Digital Rights Language). This will allow the license to be understood and enforced by automated systems, such as the Data Access Broker (DAB), making it even easier for data providers to manage access and for researchers to discover and request datasets.

 If you’re interested in using the license or would like to stay updated on our progress, we would love to hear from you via fairsupport@odissei-data.nl.

Relevant links

Photo by Claudio Schwarz on Unsplash