What a DUA covers
A data use agreement governs how shared data may be used. It usually covers permitted purposes, who may access the data, security, publication rules, bans on re-identification, onward sharing, retention and what happens at the end.
DUAs and HIPAA
Under HIPAA, a covered entity may share a limited data set, which still contains some dates and locations, only under a data use agreement. Fully de-identified data does not need one under HIPAA, but parties often sign one anyway to control use.
DUA or license?
The terms overlap. A DUA is mostly about restrictions and is common in research. A data license grants commercial rights, including payment. AI data deals often combine both: a license for the rights and price, with DUA-style restrictions on privacy and security.
Key clauses
- Permitted purpose, stated narrowly
- Named users and access controls
- No re-identification and no linking with other data
- No onward disclosure without consent
- Security standards and breach notice
- Return or destruction at the end