What it has to establish
Three things: what data underlie the results, where they are, and on what terms someone else can get them. The statement is short — usually two or three sentences — but it must be specific enough to act on.
The strongest version names a repository and gives a persistent identifier: a DOI or accession number pointing to a deposited dataset. That is checkable, it survives you changing institution, and it is what open-science policies are pushing towards.
Where data are already public — an existing database, a published dataset — say so and cite it properly. Reusing public data is entirely normal and the statement simply records the provenance.
The gold standard is a repository DOI. A named location beats a promise, because it still works when you change job.
When data cannot be shared
Legitimate restrictions exist and journals accept them. Human participant data may be restricted by ethics approval or consent terms. Data may be commercially confidential, legally protected, or third-party licensed.
Say which applies. "Data are not publicly available due to restrictions in the ethics approval governing participant consent" is a real statement an editor can accept. "Data are not available" without a reason is not.
Where the restriction permits it, describe a controlled access route — an application to a data access committee, or a request to the institution rather than to an individual. Something a reader could actually pursue.
Why "available on request" is losing ground
For a long time "data are available from the corresponding author on reasonable request" was the default. Journals are moving away from it, and the reason is evidence: studies attempting to obtain data promised this way have found that a substantial share of requests go unanswered.
Some journals now refuse the phrase outright, or require a justification for why deposit is not possible. Others accept it but flag it.
If it is genuinely the only option, strengthen it: name a role rather than a person, since people move on, and state what you will provide and under what conditions. Better still, deposit what you can — many repositories support restricted-access deposit where the metadata is public and the data itself is gated.