Starting from the end: what to do when restricted data is released

Summary Repository managers can never be one hundred percent sure of the security ofhosted research data. Even assuming that human errors and technical faults will never happen, repositories can be subject to hacking attacks. Therefore, repositories accepting personal/sensitive data (or other forms of restricted data) should have workflows in place with defined procedures to be followed should things go wrong and restricted data is inappropriately released. In this paper wewill report on our considerations and procedures when restricted data from ourinstitution was inappropriately released.