Skip to main content

Data Use Agreements (DUA)

About DUAs

A Data Use Agreement (DUA) is a written contract used to govern the transfer of research data between organizations. These agreements can be set up between academic institutions, government agencies and/or corporate entities. DUAs can be classified into two different categories depending on the nature of the data being transferred:
  • Non-human subject data or completely de-identified human research participant data (as determined by Northwestern’s IRB Office.)
  • Human research participant data which includes Protected Health Information. This includes data which constitutes a Limited Data Set as defined by HIPAA.  Transfers which fall into this category are subject to HIPAA regulations and may require IRB approval. Questions regarding IRB approval, guidelines and policies should be directed to irb@northwestern.edu.
A DUA is established between a provider institution and recipient institution to document the data being transferred and terms and conditions with respect to issues such as ownership, permitted uses of the data, publication of results, development of inventions, disposal of the data and liability. Establishing conditions prior to the transfer of data avoids issues and misunderstandings after research has begun.

Processing Procedure

Requests for DUAs should be submitted via CERES. Sponsored Research will review each request and work with the other institution to finalize the DUA and facilitate the signature process.

Important Information

Northwestern University investigators cannot sign DUAs on behalf of the University. The agreement needs to be set up as a contract between institutions and signed by an Authorized Official who is capable of binding the University to the terms.  Northwestern PIs are often required to sign DUAs as Read and Understood. Northwestern strongly encourages its PIs to thoroughly read through DUAs before signing. Not all DUAs are the same and it is very important that Northwestern PIs and lab members understand and abide by the terms and conditions outlined in the agreement.
 

Situations When You May Not Need a DUA

List of situations when a DUA may not be needed

Incoming Transfer of Data

Outgoing Transfer of Data
  • Public or Open-Access Data
    • Freely available from repositories (e.g., NIH, government open data portals)
    • Shared under open data licenses (e.g., Creative Commons)
  • Truly De-Identified Data Without Restrictions
    • No direct or indirect identifiers
    • No legal, regulatory, or institutional constraints from the provider
  • Internal Transfers When Data Was Created at Northwestern and Informed Consent Form (ICF) Allows
    • Data shared between university departments, labs, or researchers within the same institution
  • Covered by Another Agreement
    • A sponsored research agreement, collaboration agreement, or IRB approval already governs the data.
  • Open or Public Data
    • Data is already published or placed in open repositories with no restrictions.
  • Internal Use
    • Sharing within the university or affiliated institutions under existing policies
  • Covered by Existing Agreement
    • Data use terms are already addressed in a research contract, subaward, or data sharing clause in a grant.

Note: Even if the above applies always consult Sponsored Research at mta@northwestern.edu if:

  • The data involves human subjects, health data, or student records (HIPAA, FERPA, etc.).
  • The data contains proprietary or confidential information.
  • There is any risk of re-identification.
  • The data is being shared internationally (GDPR or export control laws may apply).
  • You're not sure if an existing agreement already governs the data.