Sending data to an external analyst: what to check before the files move
Consent, controlled access, transfer mechanics and deletion — the practical checklist for getting human sequencing data to someone outside your institution without creating a problem.
Do this on your own data: if the data cannot leave the institution, you can still get a read on it without sending anything. Five numbers, computed in your browser — nothing uploaded, stored or logged: omics.hstgenomics.com/qc-self-check. What a finished analysis looks like before you decide what to share: omics.hstgenomics.com/sample.
Want it done rather than explained? We do analysis only — send a count matrix, an h5ad or Seurat object, Cell Ranger output or a public accession and get publication-ready results with the code that produced them, at a fixed price agreed before any work starts: omics.hstgenomics.com/quote.
Most of the friction in outsourcing analysis is not scientific. It is the twenty minutes nobody schedules for working out whether the data is allowed to leave, and in what form. Here is that twenty minutes, in order.
1. Establish what kind of data you have
Three categories behave very differently. Non-human data — mouse, plant, microbial — rarely carries transfer restrictions beyond your own institution's policy. De-identified human expression data (count matrices without genotype-level information) is usually straightforward but still governed by your consent forms. Human data with genetic identifiability — raw reads, variant calls, anything from a controlled-access repository — is the category where mistakes are expensive, and the answer is often that the data does not leave, and the analysis comes to it instead.
2. Read the consent, not the summary of the consent
Look for what participants were told about who would access their data. Language limiting analysis to "the study team" or to a named institution means an external analyst needs either an amendment or a data-processing arrangement that makes them an extension of the team. This is the single most common thing discovered too late.
3. Reduce what you send
Count matrices instead of FASTQ removes most identifiability concerns and most of the transfer time at once. Strip anything you do not need: sample identifiers can be pseudonymised, clinical annotations reduced to the variables the analysis actually uses. An analyst does not need dates of birth to model a treatment effect.
4. Get the paperwork proportionate
For routine de-identified work, a mutual NDA plus a written statement of what the analyst may do with the data, how long they keep it, and when it is deleted is normally enough. For personal data under GDPR-like regimes, a data processing agreement is the instrument, and it should name sub-processors — including any cloud provider used for compute. Ask directly where the analysis will run.
5. Move the files sensibly
- Institutional transfer services or a cloud bucket with time-limited access beat email attachments and personal Dropbox links.
- Checksums on both ends. Silent truncation of a large matrix is more common than people expect, and it produces analysis results that look plausible.
- Credentials over a separate channel from the link.
- Record what you sent and when. A year later, "which version of the matrix did they analyse?" is a real question.
6. Agree the ending before the beginning
Deletion timetable, what happens to intermediate files, whether the analyst retains the code (they should — it is what makes the work reproducible for you), and who owns the outputs. Written answers to those four take a paragraph and prevent the entire class of awkward conversations that happen after publication.
The short version
Send the least identifiable form that answers the question, know what your consent allows, put deletion and ownership in writing, and verify the transfer. Everything else about outsourcing is easier than this part, and this part is a checklist rather than a judgement call — what to send technically is here, and our own data-handling terms are here.