FDP Data Transfer and Use Agreement (DTUA)

The Data Transfer and Use Agreement (DTUA) is a family of standardized template agreements published by the Federal Demonstration Partnership (FDP) — a consortium of more than 230 U.S. academic institutions and 10 federal agencies working to reduce the administrative burden of federally funded research. The DTUA gives research institutions a pre-negotiated starting point for sharing research data with each other, in place of drafting a fully bespoke data-sharing contract for every collaboration.

Why the FDP built a standard template

Before the DTUA existed, each data transfer between institutions typically required its own custom-drafted agreement, with legal counsel on both sides negotiating terms — permitted uses, security safeguards, re-identification restrictions, publication rights, liability — essentially from a blank page. The FDP’s Data Stewardship Subcommittee (part of its Research Compliance Committee) built the DTUA to standardize that language across the FDP membership, explicitly to “increase consistency in terms and format of DTUAs, thus reducing associated administrative burden and negotiations.” The original template was released in 2017 by an FDP working group of representatives from roughly 30 member institutions and two federal agencies, who reviewed 15 real DTUAs in use across the membership and drew on language already established in other widely accepted templates, including the Uniform Biological Material Transfer Agreement (UBMTA) and the FDP’s own Research Subaward Agreement. The template went through a one-year pilot with nearly 40 FDP member organizations before wider release.

Structure: Face Page and Attachments

An FDP DTUA is modular rather than a single monolithic contract. It’s assembled from:

• Face Page — identifies the discloser (source institution) and recipient, the specific project, and is the document both institutions sign.
• Attachment 1 — the standard terms and conditions common to every DTUA (permitted use, security obligations, term/termination, publication, liability) plus project-specific information.
• Attachment 2 — selected based on the type of data being transferred: options exist for de-identified human subjects data, HIPAA-defined Limited Data Sets, and personally identifiable information governed by the Common Rule, HIPAA, or FERPA, each carrying the protections appropriate to that data type.
• Attachment 3 — used in some templates to capture additional provisions, such as information on third-party collaborators who will also access the data.

Because the baseline terms are already agreed upon at the FDP-membership level, institutional negotiation on a given transfer is typically limited to the project-specific fields and the Attachment 2 selection, rather than re-litigating the whole agreement — which is the core administrative-burden reduction the template is designed to deliver.

One-Way vs. Reciprocal DTUA

The FDP publishes two primary variants. The One-Way DTUA covers a transfer flowing from one discloser to one recipient. The Reciprocal DTUA covers a collaboration where data will flow in both directions between the same two parties over the course of a project, so a single agreement can govern both transfers instead of executing two separate one-way agreements. An Amendment Template is also available for modifying an executed DTUA (for example, to extend its term or add a data type) without re-executing the whole agreement.

Scope and who can use it

The DTUA templates are intended for transfers of research data between U.S.-based nonprofit and/or governmental organizations, for research or public health purposes. They are explicitly not scoped for transfers to for-profit entities or non-U.S. entities — those transfers require a different agreement type suited to the additional commercial, export-control, or cross-border considerations involved. Both FDP-member and non-member institutions can use the publicly posted templates.

Relationship to other data agreements

A DTUA is related to, but distinct from, a generic Data Transfer Agreement (DTA) — any institution can draft its own bespoke DTA, but “FDP DTUA” specifically refers to the FDP’s standardized, community-vetted template family. It’s also distinct from a HIPAA Business Associate Agreement (BAA): a DTUA’s Attachment 2 can incorporate Limited Data Set terms for HIPAA-regulated data, but it does not replace a BAA where one is separately required. Because subaward relationships and data transfers often arise on the same federally funded projects, institutions using the DTUA frequently also rely on the FDP’s FDP subaward templates and check counterparty status through the FDP’s Expanded Clearinghouse.

Maintenance and revision

The FDP’s Data Stewardship Subcommittee periodically reviews and updates the DTUA family with input from FDP membership and working groups; current published versions include the One-Way DTUA and a companion FAQ document. Because the FDP revises these templates on its own cycle, research administrators should always pull the current version from thefdp.org rather than reuse a saved copy from a prior project.