This guide explains data use agreements and how they are used.
What Is a Data Use Agreement?
According to the NNLM Data Glossary:
A Data Use Agreement (DUA) is a legal contract between the entity that owns access to a data source, typically a dataset or database, and a secondary entity that will receive the data, or a subset of it, for reuse. A DUA outlines terms and limitations on how the shared data can be used, and the secondary entity may need to meet certain criteria, such as their affiliated institution, their faculty status, and IRB (Institutional Review Board) approval for their research study. Examples of limitations include restricting access to the shared data, requiring that any research dissemination include citation of the data and its originating entity, requiring that data files are destroyed at the completion of research period, and restrictions on data use for commercial purposes. DUAs are frequently required for access to data that contain protected health information (PHI).
Sometimes DUAs are referred to as Data Sharing Agreements (DSAs). There are many example DUAs available online – for example, this one for genetic data from NCBI or this one from Dataverse.
Why Are DUAs Important?
A DUA is a legally binding contract that research entities often require when sharing data with another party, especially in the case of data that involves human subjects, is proprietary, or is otherwise sensitive. Public or non-sensitive data (e.g., from mouse studies) would not generally be subject to a DUA before sharing. Your institution may require a DUA when you are sending data and may need to review any DUAs that you receive to negotiate terms. After you sign a DUA, you must abide by the terms of the contract, so it is important to review them thoroughly.
Sending or Receiving a DUA
Normally, the entity that is sharing data will send a DUA to the party who wants access. If you are sharing data, an official at your institution will need to generate the contract and, if necessary, negotiate terms with the receiving organization. Similarly, if you receive a DUA from a research partner, someone will need to sign on behalf of your organization.
Most research organizations have an established process for handling outgoing and incoming DUAs. Often you will need to consult with an administrative office, such as the General Counsel, Office of Sponsored Programs, or Compliance Office in order to create a DUA or have an incoming DUA signed.
Additional Resources
Examples of DUA Processes
Sources
NNLM Data Glossary. “Data Use Agreement.” Accessed December 28, 2023. https://www.nnlm.gov/guides/data-glossary/data-use-agreement.
Offices of Sponsored Programs and Grants Management – Stony Brook. “Data Use Agreements (DUA).” Accessed December 28, 2023. https://www.stonybrook.edu/commcms/osp-ogm/contracts_negotiation/Types_Contracts/data_use.php.