Process for security exception to access private data

If the researcher is a supervisor requesting their staff or student's data, use the full procedure below.

If the researcher wants to hand off data to their supervisor, start at "create a task..."

1. Before the researcher requests the approval, make sure to point them to https://docs.rc.uab.edu/data_management/research_data_responsibilities/#security-exceptions-for-accessing-former-uab-personnel-data and let them know to request /data/user, /home/ and /scratch/ all at once, as appropriate.
2. Receive approval for the security exception from Enterprise Information Security in the form of an RITM assigned to our "Assignment Group".
3. Create a TASK describing what needs to be done and notify rc-ops-team.
4. Copy the requested storage to another storage location and grant access to the requester or their delegate. We won't grant access to multiple people. If multiple people need access, the single requester/delegate can copy the data out to another location where those others can view it.
   1. Copy requested directories (ideally this will be all of /data/user/$USER, /home/$USER/, and /scratch/$USER) to /rstore/share/RITM########/. Simply copy the full paths.
   2. Recursive chown $requester on the RITM# directory.
   3. Recursive chmod u+rwx for directories and chmod u+rw for files starting at .../RITM#/.
5. Notify the user of the path and give them 2 calendar weeks (??) before we delete, and request notification when they have completed their work. (Can we automate access revocation with a single cron trigger, is it worth it? Happy to document this.)
6. Delete the copy when we hit the time limit or when they notify us.

Start by reviewing the linked security-exceptions guidance and the existing devops-docs structure to find the appropriate documentation page. Document the approval, TASK, copy, permission, notification, and deletion steps from the issue, then confirm the retention period and whether access revocation should be automated with maintainers.