# Data use agreement (DUA)

URL: https://aidataforsale.com/glossary/data-use-agreement
Publisher: AI Data For Sale (Marketing Signals Ltd)
Updated: 2026-11-10

A contract that sets out what a recipient may and may not do with data it receives, often used for research and health data.

## What a DUA covers

A data use agreement governs how shared data may be used. It usually covers permitted purposes, who may access the data, security, publication rules, bans on re-identification, onward sharing, retention and what happens at the end.

## DUAs and HIPAA

Under HIPAA, a covered entity may share a [limited data set](https://aidataforsale.com/glossary/protected-health-information), which still contains some dates and locations, only under a data use agreement. Fully de-identified data does not need one under HIPAA, but parties often sign one anyway to control use.

## DUA or license?

The terms overlap. A DUA is mostly about restrictions and is common in research. A [data license](https://aidataforsale.com/glossary/data-license) grants commercial rights, including payment. AI data deals often combine both: a license for the rights and price, with DUA-style restrictions on privacy and security.

## Key clauses

- Permitted purpose, stated narrowly
- Named users and access controls
- No re-identification and no linking with other data
- No onward disclosure without consent
- Security standards and breach notice
- Return or destruction at the end

## Sources

- [eCFR: 45 CFR 164.514, other requirements relating to uses and disclosures of protected health information](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514)