在开放科学深化科研数据管理实践的背景下，数据馆员处理个人信息需应对法律、伦理与实践挑战以平衡开放与保护，本研究旨在提供相应规范与策略。本研究首先系统梳理了个人信息保护相关的法律法规体系及相关核心概念，探讨了科研活动中独特的伦理考量与实践特殊性。随后，深入分析了数据馆员在个人信息获取、组织、共享与发布等关键环节中应遵循的操作规范、面临的主要风险与实践挑战。在此基础上，参照相关法律要求与标准，提出了一个涵盖组织、人员、物理和技术四个维度的、面向数据馆员的个人信息综合安全管理体系框架。研究发现，数据馆员在实践中面临多重困境：将法律原则应用于复杂科研场景时的操作难点；满足高于法律底线的伦理要求；调和开放科学与个人信息保护之间的内在矛盾。研究强调个人信息风险贯穿数据全生命周期，并呈现显著的学科差异性，凸显了构建系统化、多维度综合安全管理体系的必要性与紧迫性。本研究为数据馆员处理个人信息提供了清晰的法律边界、伦理指引和风险识别框架。提出的综合安全管理体系可作为实践参考，有助于提升数据馆员及所在机构的个人信息保护能力与合规水平，从而在保障数据主体权益的基础上，推动负责任、可持续的开放科学发展。

In the context of open science deepening research data management practices, data librarians processing personal information need to address legal, ethical, and practical challenges to balance openness and protection. This study aims to provide corresponding guidelines and strategies. This study first systematically reviews the legal and regulatory framework related to personal information protection, as well as relevant core concepts, and explores the unique ethical considerations and practical particularities in research activities. Subsequently, the study conducts an in-depth analysis of the operational norms that data librarians should follow, the major risks they face, and the practical challenges encountered in key processes such as the collection, organization, sharing, and release of personal information. On this basis, and with reference to relevant legal requirements and standards, the study proposes a comprehensive personal information security management framework for data librarians, covering four dimensions: organizational, personnel, physical, and technical. The study finds that data librarians face multiple dilemmas in practice: operational difficulties in applying legal principles to complex research scenarios; meeting ethical requirements that often exceed legal minimums; and reconciling the inherent conflicts between open science and personal information protection. The research highlights that personal information risks permeate the entire data lifecycle and exhibit significant disciplinary differences, underscoring the necessity and urgency of establishing a systematic, multi-dimensional, comprehensive security management system. This study provides data librarians with clear legal boundaries, ethical guidance, and a risk identification framework for processing personal information. The proposed comprehensive security management system can serve as a practical reference, helping to enhance the personal information protection capabilities and compliance levels of both data librarians and their institutions. Thereby, on the basis of safeguarding the rights and interests of data subjects, it promotes the development of responsible and sustainable open science.