Data Use Agreements
What is a DUA?
A DUA is an agreement that outlines the terms of transfer of non-public or restricted data between organizations for a specified purpose. The DUA informs data users of their limitations on uses and disclosures, and obligations to safeguard the data as required by law, policy, or practice.
Do I need a DUA?
A DUA is not required by Stanford University in the following situations:
- Stanford is receiving data only - no Stanford data will be shared; OR
- Stanford is sharing data and
- The data is not in a data category subject to the DOJ Bulk Data Rule;
Note: The rule’s prohibitions and restrictions on data transactions apply regardless of whether the data is anonymized, pseudonymized, de-identified, or encrypted; OR
- The data is not in a data category subject to the DOJ Bulk Data Rule and data is de-identified as determined by the Stanford University Privacy Office; OR
- The recipient is not a foreign entity; OR
- There is another agreement (e.g. a sponsored project or collaboration agreement) already in place that addresses the terms and conditions of data transfer between the organizations
An agreement is required if Stanford will be sharing data under the following conditions:
- The data transfer is not in a category for which a DUA is not needed (see above);
- The data is proprietary; or
- That data is subject to confidentiality or other restrictions on transfer and use
An agreement should be considered if
- Principal Investigator wants to formalize the roles and responsibilities of the parties, e.g. restricting third party transfers, publication or acknowledgement expectations, specify reporting/deliverables requirements, etc.
Not sure if an agreement is needed? Contact the Office of Research Administration at osr_intake@stanford.edu
Who will handle my DUA?
In most situations, a DUA must be signed by someone who has authority to act on behalf of Stanford University.
The Office of Research Administration (ORA) handles DUAs on behalf of Stanford University through its Research Related Agreement (RRA) process unless the agreement is
- Related to an industry sponsored clinical trial - CTRMG
- Related to the acquisition of commercially available data, even if no funding is being transferred - Procurement
However, there are specific situations as outlined in the Faculty Guidance Memo from Ann Arvin (05/15/2015) when faculty can sign an agreement for incoming data in their individual capacity.
How do I request one?
The SeRA Research Related Agreement Request (RRR) is a streamlined single point of intake for Research Related Agreements and gathers the details necessary to draft and/or review a DUA. There are two ways to initiate an RRR:
- If you prefer to submit your own request - Additional guidance on submitting an RRR can be found here:
- If you would like assistance in creating and submitting the request - Submit the following documents along with the name of the Principal Investigator (PI) to ORA at osr_intake@stanford.edu and we will use the information to create the RRA record in SeRA. A RRA Request Form will be routed to the PI to complete the PI certification.
- Draft agreement
- Scope of work
- List of data elements or data dictionary