Where do you get it?
See the UFA process and talk to your department about the purchase.
The IRB's expectations for safely storing research data are laid out in this web page.
When you word your IRB, Imagine being in the shoes of a person reviewing the application for the first time. The description of how sensitive data handled from start (when it is gathered from participants) to finish (when it is expunged or archived) should be clear and complete. It could say something like this:
Note the language "as permitted by U-M's sensitive data guide" intentionally implies that the study team is using the service in the way stipulated in the sensitive data guide.
IRB Data Security Guidelines apply the same way for the personally owned computer if you are a student. It will take more to assure that the personal computer is appropriately secured. SPG 601.33 puts the onus on the student to secure the computer. The sensitive data guide provides some guidance as well.
Additionally, LSA TS offers consulting. Reach out if you have questions or you need to bring in secure data with restrictions on its use or disclosure.
Sometimes you may need funding to get your research data purchased or collected. Look to the following resources:
UFA Research Data Scraping OCR