Federal Updates & Resources - This site provides federal agency updates and policy guidance related to sponsored projects and research administration as it becomes available.

Stanford
Office of Research Administration

Data Agreements

What is the difference between a Data Access Agreement and a Data Use Agreement?

Data Access Agreements (DAAs) – Commercially Available Data

A Data Access Agreement (DAA) governs Stanford's purchase of access to commercially available data from an outside vendor, even when the cost is $0. These agreements apply to data that an external entity offers for sale or subscription as part of its normal business activity.

Commercially available data is valued for its breadth and marketable applications. Common examples include:

  • Market research and survey data
  • Financial data and stock market reports
  • Consumer demographics and spending patterns
  • News feeds and online activity trends
  • Traffic, transportation, and real estate data
  • Health statistics
  • Weather and environmental data

How to request a DAA: DAAs are managed by Procurement Services. To request one, submit it through SmartMart Contracts as an IT Services agreement.

Data Use Agreements (DUAs) – Sensitive, Non-Public Data

A DUA governs the exchange of sensitive, non-public data and grants defined use rights for information that isn't commercially available. One is required when Stanford shares sensitive data with an outside entity, receives it from an entity that doesn't provide such data commercially, or when HIPAA requires it before using or disclosing a limited data set.

Sensitive data is typically unique information that is neither publicly accessible nor available for purchase. Examples include:

  • Protected Health Information (PHI), such as medical records
  • Personally Identifiable Information (PII), such as student records
  • Government data restricted for national security or privacy reasons
  • Confidential research data from NGOs or research institutions
  • Proprietary or confidential business data, including customer information and system log files

How to request a DUA: DUAs are managed by the Office of Research Administration and can be requested through SeRA or by submitting documents to osr_intake@stanford.edu. See "How do I request one?" below for details.

Do I need a DUA?

A DUA is not required by Stanford University in the following situations:

Note: The rule’s prohibitions and restrictions on data transactions apply regardless of whether the data is anonymized, pseudonymized, de-identified, or encrypted; OR

  • The recipient is not a foreign entity; OR
  • There is another agreement (e.g. a sponsored project or collaboration agreement) already in place that addresses the terms and conditions of data transfer between the organizations

An agreement is required if Stanford will be sharing data under the following conditions:

  • The data transfer is not in a category for which a DUA is not needed (see above);
  • The data is proprietary; or
  • That data is subject to confidentiality or other restrictions on transfer and use

An agreement should be considered if 

  • Principal Investigator wants to formalize the roles and responsibilities of the parties, e.g. restricting third party transfers, publication or acknowledgement expectations, specify reporting/deliverables requirements, etc.

Not sure if an agreement is needed? Contact the Office of Research Administration at osr_intake@stanford.edu

Who will handle my Data Agreement?

In most situations, a DUA must be signed by someone who has authority to act on behalf of Stanford University.  

The Office of Research Administration (ORA) handles DUAs on behalf of Stanford University through its Research Related Agreement (RRA) process unless the agreement is

  • Related to an industry sponsored clinical trial - CTRMG
  • Related to the acquisition of commercially available data, even if no funding is being transferred - Procurement

However, there are specific situations as outlined in the Faculty Guidance Memo from Ann Arvin  (05/15/2015) when faculty can sign an agreement for incoming data in their individual capacity. 

How do I request one?

The SeRA Research Related Agreement Request (RRR) is a streamlined single point of intake for Research Related Agreements and gathers the details necessary to draft and/or review a DUA. There are two ways to initiate an RRR: 

  1. If you prefer to submit your own request - Additional guidance on submitting an RRR can be found here:
  2. If you would like assistance in creating and submitting the request - Submit the following documents along with the name of the Principal Investigator (PI) to ORA at osr_intake@stanford.edu and we will use the information to create the RRA record in SeRA. A RRA Request Form will be routed to the PI to complete the PI certification.
    • Draft agreement
    • Scope of work
    • List of data elements or data dictionary

Other Resources

Common Questions OSR Will Ask When Considering a DUA

DUA Project Description  Updated February 1, 2022

NIH Security Best Practices for Users of Controlled-Access Data