Data Use Agreements in Biomedical Research
Data use agreements (DUAs) are legally binding contracts that govern how a researcher may access, use, and share a biomedical dataset. They specify who can use the data, for what purposes, how long it may be kept, and what security and privacy protections must be in place. Without a DUA, most controlled-access repositories and biobanks will not release data, and researchers who share data without one risk violating privacy laws and losing future access.
Why DUAs Exist
Biomedical data often contains sensitive information about individuals—genetic sequences, health records, and lifestyle details—that can identify a person even after names and direct identifiers are removed. Laws such as the U.S. Health Insurance Portability and Accountability Act (HIPAA), the General Data Protection Regulation (GDPR) in Europe, and various national research ethics rules require that data be shared under agreements that protect participants. DUAs also address the interests of the data producers, who may have invested years in collecting and curating the data and want credit, control, and recognition for their work.
Beyond legal compliance, DUAs create trust. Participants who donate biospecimens or health information expect that their data will be used responsibly. A DUA is the formal mechanism that translates that expectation into enforceable terms.
What a Typical DUA Contains
While every agreement is different, most DUAs include the following core elements:
- Data description: Exactly which dataset or files are covered, including version and date.
- Authorized uses: The specific research purposes allowed, such as “studies of cancer genetics� or “development of diagnostic algorithms.�
- Prohibited uses: Activities like attempting to re-identify individuals, using data for commercial purposes, or sharing raw data with third parties.
- Data security requirements: Minimum technical safeguards, such as encryption, access controls, and secure storage.
- Data retention and destruction: How long the data may be kept and what must be done at the end of the project (e.g., destroy or return).
- Publication and authorship: Whether the data provider must be acknowledged or offered co-authorship.
- Liability and breach notification: Who is responsible if data is leaked or misused, and how breaches must be reported.
- Governing law and dispute resolution: Which jurisdiction’s laws apply and how disagreements will be settled.
Some DUAs also include “publication embargo� clauses, meaning the recipient cannot publish results until the data provider has had a chance to review them or publish first. This is common in large genomic consortia.
How DUAs Differ from Other Agreements
Researchers often confuse DUAs with related agreements. A material transfer agreement (MTA) covers physical biological materials like cells or tissues, while a DUA covers digital data. A memorandum of understanding (MOU) is a broader, often non-binding statement of intent, whereas a DUA is legally binding. A data processing agreement (DPA) is a GDPR-specific contract for data controllers and processors, and may be required in addition to a DUA when the researcher is acting as a processor. Finally, a collaboration agreement governs the overall research partnership, and a DUA may be one of its attachments.
In practice, a single project may need multiple agreements. For example, a study using genomic data from one repository, imaging data from another, and clinical records from a hospital would need separate DUAs with each source.
How to Get a DUA
The process typically follows these steps:
- Identify the data source: Find the repository or institution that controls the data (e.g., dbGaP, UK Biobank, a hospital network).
- Review the data access policy: Most repositories have a public website explaining what data is available and the application process.
- Submit a research proposal: Describe the research question, methods, and how the data will be secured. This is often done through an online portal.
- Get institutional approval: Your institution’s office of research or technology transfer will review the proposed DUA and may negotiate terms.
- Sign the agreement: Both parties—often the data provider’s authorized signatory and your institution’s signatory—must sign.
- Receive the data: Once signed, you will be given access credentials or a download link.
Many institutions have a dedicated team that handles DUAs. If you are a student or postdoc, you usually cannot sign the agreement yourself; your institution must sign on its behalf.
Common Problems and How to Avoid Them
One frequent issue is scope creep: a researcher initially receives data for one project, then wants to use it for a different study. Most DUAs require a new amendment or a separate agreement for each new use. The fix is to plan ahead and describe all potential uses in the initial proposal, or be prepared to wait for an amendment.
Another problem is data sharing with collaborators. A DUA often prohibits the recipient from sharing data with anyone not listed in the agreement. If you add a new collaborator, you must get approval from the data provider. This is a common source of violations.
Data security breaches are another concern. If a laptop with unencrypted data is stolen, the DUA may require you to notify the data provider within a specific timeframe. Failing to do so can lead to legal action and loss of access for your entire institution.
Finally, misunderstanding “de-identified� data is a misconception. Even if the data has been stripped of obvious identifiers, it may still be considered identifiable under GDPR if it can be re-identified using other information. DUAs often require you to treat the data as if it were identifiable, regardless of the de-identification level.
Costs and Time
DUAs themselves are usually free, but the process can take time. Negotiating terms between two institutions’ legal teams can take weeks or months, especially if the data is from a foreign country or involves multiple parties. Some repositories charge a data access fee to cover the cost of curation and distribution, but this is separate from the DUA. For large-scale datasets, the costs are often funded by grants, so researchers should budget for potential fees and for the time required to obtain the agreement.
Alternatives to Traditional DUAs
Some researchers avoid DUAs by using open-access data that is freely available without restrictions. For example, the 1000 Genomes Project and the Cancer Genome Atlas (TCGA) have open tiers for some data. However, open data may have less detailed clinical information, and users must still comply with the terms of the repository’s data use policy, which is often a click-through agreement.
Another alternative is data sharing through federated analysis, where the data stays at the source and researchers send their code to be run remotely. This reduces the need for a DUA because the data never leaves the provider’s environment. However, this approach is not always possible for all types of analysis.
Frequently Asked Questions
Can I use data from a DUA for a new project that wasn’t in the original proposal?
No, not without approval. Most DUAs restrict the data to the specific research purpose described in the application. If you want to use the data for a new project, you must contact the data provider and request an amendment or a new DUA. Using the data for an unapproved purpose is a breach of contract and could result in legal penalties and loss of data access.
What happens if I share data with a collaborator who isn’t on the DUA?
This is a violation of the agreement. You must ensure that all individuals who will access the data are listed or approved under the DUA. If you need to add a collaborator, you must obtain written permission from the data provider first. Unauthorized sharing can lead to termination of the agreement and legal action.
Do DUAs expire?
Yes, most DUAs have a defined term, often 1–5 years, after which you must either destroy the data or request a renewal. The agreement will specify the exact expiration date and the process for renewal. It is your responsibility to track these dates and comply.
Is a DUA the same as IRB approval?
No. Institutional Review Board (IRB) approval is a separate ethical review of your research protocol to protect human subjects. A DUA is a legal contract about data use. You typically need both: IRB approval to conduct the research, and a DUA to access the data. The DUA may require you to provide proof of IRB approval before data is released.
Can I use DUA-protected data for commercial purposes?
Usually no. Most DUAs explicitly prohibit commercial use, meaning you cannot use the data to develop a product or service for profit. If you want to do so, you must negotiate a separate commercial license with the data provider. Academic researchers often assume they can commercialize findings, but the data itself cannot be used for that purpose without permission.
What should I do if I discover a data breach?
You should immediately notify the data provider and your institution’s privacy office, following the procedures in your DUA. Many agreements require notification within a specific timeframe, such as 72 hours. You should also take steps to mitigate the breach, such as revoking access and securing the data. Do not attempt to hide the breach, as this can result in severe penalties.
Related
Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.