Data Use Agreement (DUA): Definition

Ask about Data Use Agreement (DUA)

Answers are drawn from this dictionary entry and the rest of the CASRAI corpus, with a link to every source.

Answers are AI-generated from CASRAI’s own published pages and can be wrong, so check the linked sources before relying on one; your question is logged without personal data — never sold, never used to train a third-party model — to show us what CASRAI is missing, so please do not type personal or confidential details. How we use this

Worked examples

Is an instance

A health-services researcher requesting Medicare claims data from CMS executes a DUA committing to a defined cell-suppression threshold and approved secure-enclave use.

Is an instance

A genomics laboratory accessing controlled-access cases from dbGaP signs a Data Use Certification through the institutional signing official before download is permitted.

Looks similar, but isn't

Not an instance

Access to a fully public, de-identified, freely downloadable dataset under an open licence does not require a DUA.

Not an instance

Use of internally generated data that never leaves the originating institution is governed by internal data-governance policy rather than an inter-institutional DUA.

DUAs are most commonly used for HIPAA limited datasets (where the agreement is mandatory under 45 CFR §164.514(e)), for restricted-use data from federal statistical agencies, and for controlled-access datasets from repositories such as dbGaP and the UK Data Service. For university-to-university transfers of research data, many U.S. institutions instead start from the standard FDP Data Transfer and Use Agreement (DTUA). The agreement is signed by institutionally authorised officials on both sides and binds the recipient institution, not the individual researcher. Standard provisions include a defined research purpose, listed authorised users, no-attempt-to-re-identify language, prohibition on onward transfer, secure-storage and access-control requirements, and an obligation to destroy or return data on study completion.

References

HIPAA Privacy Rule 45 CFR §164.514(e) limited data set and data use agreement
NIH Genomic Data Sharing Policy and dbGaP Data Use Certification
ICPSR Restricted Data Use Agreement template

Use in your systems

JATS XML <role> element

xml

<role vocab="credit"
      vocab-identifier="https://casrai.org/dictionary/"
      vocab-term="Data Use Agreement (DUA)"
      vocab-term-identifier="https://casrai.org/dictionary/term/data-use-agreement" />

Schema.org DefinedTerm (JSON-LD)

json

{
  "@context": "https://schema.org",
  "@type": "DefinedTerm",
  "@id": "https://casrai.org/dictionary/term/data-use-agreement",
  "name": "Data Use Agreement (DUA)",
  "identifier": "https://casrai.org/dictionary/term/data-use-agreement",
  "description": "A contractual instrument required before a recipient may access an identifiable, restricted, or limited dataset that defines permitted uses, security obligations, re-disclosure prohibitions, destruction requirements, and breach-notification duties.",
  "inDefinedTermSet": "https://casrai.org/dictionary/domain/compliance-regulatory#set",
  "url": "https://casrai.org/dictionary/term/data-use-agreement",
  "sameAs": [
    "DUA",
    "data access agreement",
    "restricted-use data agreement"
  ],
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "publisher": {
    "@id": "https://casrai.org/#organization"
  },
  "dateModified": "2026-08-09T02:27:35",
  "inLanguage": "en"
}