A data use agreement (DUA) is a contractual document used for the transfer of non-public or restricted use data. Examples include records from governmental agencies, institutions or corporations, student records information, and existing human research subjects’ data.
IRB Requirements for DUAs
- The UMass Amherst’s Office of Research Compliance serves as the campus signatory for data use agreements. DUAs must be routed through the Data Use or Access Kuali Build form. The Office of Research Compliance should be the first office to review any DUA terms and conditions. Please note that there is usually a minimum of a 2-week turnaround on review and signing of these agreements.
- If a data use agreement is a part of the project you are submitting to the IRB, it should be noted in the protocol application and a copy of the signed DUA should be included in the Attachments section.
- The IRB can provide conditional approval of your protocol if it is needed in order to get a data use agreement signed, but final approval will not be granted until a copy of the signed data use agreement is submitted to the IRB.
- For human subjects research purposes, only the Office of Research Compliance is authorized to enter into contractual agreements, including DUAs, on behalf of the university. Researchers cannot sign (including electronic signature) data use agreements on behalf of the institution. DUAs should not be signed by university faculty or staff members in the absence of institutional approval from the Office of Research Compliance.
- Researchers are not authorized to negotiate or sign agreements on behalf of the university. When a researcher signs such an agreement, they could be subjected to legal and financial risks.
- It is important for researchers to read the terms of a DUA before forwarding it to the Office of Research Compliance. It is the researcher’s responsibility to understand and follow the terms of the agreement and to only use data for purposes specified. HRPO assumes that a researcher who transmits a DUA has read and agrees to conform to those terms, whether or not the researcher’s signature is required on the DUA itself.
Importance of DUAs
- DUAs address important issues such as limitations on use of the data, liability for harm arising from the use of the data, publication, and privacy rights that are associated with transfers of confidential or protected data and data security measures that must be met in order to ensure that the data is kept secure.
- Assures that the recipients are using the data in accordance with applicable law.
- Contractually obligates the recipient to use the data only for the purpose described in the DUA
- Prevents the inappropriate use of protected or confidential information that could cause harm to research subjects, the investigator or the university.
For Human Subject Data, a DUA is typically required when:
- Disclosure of data is for research purposes, and
- Individual authorization for disclosure to this recipient is not/has not been obtained (i.e. through use of a subject-signed informed consent authorization), and
- When no other form of contract concerning the data transfer exists between the provider and the recipient (i.e. sub-award agreement or a contracted services agreement)
Examples of Data that might be exchanged under a DUA include:
- Records from governmental agencies or corporations
- Student record information
- Existing human research subject data
For Human Subject Data, a DUA is NOT typically required:
- When data is publically available in public domain
- When data is exchanged that is not subject to a legal or other restriction on its use
- If a research subject signs a consent authorization form that authorizes data sharing with the recipient
- When another agreement, such as a sub-award agreement or a contracted services agreement is in place
- Data transfer as part of such a collaborative research project is often addressed in the study protocol or in the funding agreement terms and conditions (i.e. grant, contract, sub-award, contracted services agreement, etc.). In these cases, a separate DUA is generally not necessary.
Source material for this policy guidance was provided by the University of Wisconsin-Madison Education and Social/Behavioral Science IRB.