You found the dataset you need. It's not on a public website; it's available "under a data use agreement." That usually means a PDF, a signature line for someone at your university you've never met, and a wait you can't predict. Researchers often hit this a week before a deadline and then learn the agreement can't be signed by them at all.
This guide explains what a data use agreement (a DUA) is, the clauses that matter, who signs, why it takes so long, and how to make the process shorter. It's written for researchers and for the staff who support them. It isn't legal advice; your research office or counsel has the last word on any contract.
What a data use agreement is
A DUA is a contract between a data provider and the organization that wants the data. It sets the conditions: what you may do with the data, what you may not do, how you'll protect it, and what happens when the project ends. The provider might be a government agency, a hospital, a survey archive, a company, or another university.
You'll see related documents with similar jobs. A material transfer agreement covers physical samples. A nondisclosure agreement covers confidential information in general. A data sharing agreement or data transfer agreement is a close cousin, often used between partner institutions. The names overlap, so read what the document actually requires before assuming which kind it is.
When you'll need one
Providers ask for a DUA when the data carry some risk if they're misused. Common cases:
- Restricted-use research data. Archives such as ICPSR hold datasets that can't be downloaded freely because respondents might be identifiable. You apply, accept the terms, and usually describe how you'll secure the files.
- Health data. Under HIPAA, a covered entity can share a "limited data set" (direct identifiers removed, but dates and some geography kept) for research only if the recipient signs a data use agreement. The rule is at 45 CFR 164.514(e).
- Administrative records. School district, state agency, or employer records about identifiable people almost always come with one.
- Commercial data. Vendors license data with terms that restrict redistribution and sometimes restrict what you can publish.
- Partner data. A collaborator at another institution shares data they collected, and both sides want the terms in writing.
The agreement can also work in the other direction. If you want to share data you collected and can't release it publicly, a DUA is how a repository or your own office lets qualified people use it. The consent language guide covers when that kind of controlled access fits what participants agreed to.
The terms worth reading closely
Most DUAs follow a similar pattern. These are the clauses that cause trouble or get negotiated.
Permitted use
The agreement names a project and a purpose. If you later want to use the same data for a second question, that may require an amendment. Check whether the wording is narrow ("for the study titled...") or broad ("for research purposes"), and whether the people listed can be changed when a student graduates or a collaborator joins.
No re-identification and no linking
Nearly every DUA bans attempts to identify individuals and many ban linking the file to other datasets without approval. That second part matters more than people expect. Merging a restricted file with a public dataset you already use can be a breach if it wasn't described in the application. Say what you plan to link, up front.
Security requirements
Providers vary from "store on a password-protected institutional drive" to a written data security plan, encryption at rest, no cloud storage, and no access from outside the U.S. These requirements decide where the analysis can happen. If your plan was to run it on a laptop or a public cloud account, find out now. Campus research computing or a secure enclave is often the answer, which is one reason this topic belongs next to de-identification and reproducibility planning.
Redistribution and who may see the data
You usually can't pass the files to anyone not named in the agreement, including a co-author at another school or a student who hasn't been added. Plan the team before you apply, not after.
Publication and review
Some providers ask to see a manuscript before it's submitted, to check for disclosure of individuals or small cells. Others require acknowledgment or a citation in a set format, which is a good reason to know how to cite a dataset. A few reserve the right to delay publication. A delay clause is the one to raise with your office if you have a thesis or tenure clock running.
Breach notice and liability
You'll be asked to report unauthorized disclosure, often within a stated number of days. Some agreements also make the institution responsible for costs or indemnify the provider. Public universities and many private ones can't accept open-ended indemnification, and this clause is the usual source of delay. It's the office's job to negotiate it, not yours.
Term, return, and destruction
When the agreement ends, you'll typically have to destroy or return the data and sometimes certify that you did. That can conflict with grant rules that require you to keep records, which is the same tension covered in the retention guide. Ask the provider what counts: some allow you to keep derived results and code, but not the raw files.
Who signs
The researcher is almost never the right signer for the institution. The contract binds the university, so an authorized official signs: often someone in sponsored programs or research administration, sometimes the general counsel's office, sometimes a contracts office. The researcher usually signs too, as a user who has read and accepted the terms.
This is the single most common surprise. A PI signs the form, uploads it, and the provider rejects it because it came from the wrong person. Before you apply, ask who handles data agreements on your campus and whether there's a standard template or a preapproved list of providers. [Placeholder: name the office at your institution that reviews DUAs, if you want this section to point readers to the right door.]
Why it takes so long, and how to shorten it
A DUA passes through at least two review queues: the provider's and yours. If the provider's template includes terms your institution can't accept, the document goes back and forth until both sides agree on the wording. None of it is visible to you, and little of it is fast.
What helps:
- Start before the project does. Request the agreement as soon as you know you need the data, not when the grant is funded.
- Get IRB status settled first. Many providers want an IRB approval or exemption letter with the application.
- Write the data security plan once. Keep a reusable description of where restricted data are stored, who has access, and how files are protected, so each application doesn't start from scratch.
- List everyone who will touch the data. Include students and collaborators now. Adding names later means paperwork.
- Ask your office which clauses they won't sign. If indemnification or governing law is a known sticking point, they can contact the provider early.
- Keep a copy and a calendar entry. Note the end date and the destruction requirement. Lost agreements and missed deadlines are how institutions end up out of compliance.
Questions to ask before you apply
Run through these with the provider or your office, and you'll avoid most of the rework.
- What exactly am I allowed to do with the data, and what needs an amendment?
- Where may the data be stored and analyzed? Is a laptop acceptable, or does it have to be a specific environment?
- Who must sign for the institution, and who for me?
- How long does the agreement last, and what must I destroy at the end?
- Do I have to share results or manuscripts before publishing?
- Can my students and collaborators be added, and how?
If you support researchers
DUAs sit between the library, the IRB, sponsored programs, and IT, and nobody owns the whole path. A short campus page that says who signs, which provider templates are already reviewed, what the secure analysis options are, and how long each step usually takes would save researchers weeks. It's a natural companion to DMP review for an office that's starting research data services. I help institutions put this kind of practical guidance together; get in touch if it would be useful on your campus.
Common questions
What is the difference between a data use agreement and a data sharing agreement? In practice the names are used loosely. Both are contracts that set the conditions for moving or using data that isn't public. 'Data use agreement' usually means a provider is giving you data and limiting how you use it, while 'data sharing agreement' often describes a two-way arrangement between partners. Read the terms, not the title.
Who signs a data use agreement, the researcher or the university? Usually both. The researcher agrees to the terms and the institution signs through an authorized official, typically in the sponsored programs, research administration, or general counsel office. Most institutions don't let individual faculty sign contracts on the university's behalf.
How long does it take to get a data use agreement approved? Plan on weeks, and sometimes months. The time goes to the provider's review queue and to back-and-forth over terms your institution can't accept, so start before your grant deadline or project start date, not after.
Do I need a data use agreement for de-identified data? Often not for truly public or fully de-identified data, but providers frequently require one anyway if there's any re-identification risk. HIPAA also requires one for a limited data set, which strips direct identifiers but can keep dates and some geography.