What is a data use agreement (DUA) and when is it needed?

What is a data use agreement (DUA) and when is it needed?

• A. A standard lab protocol.
• B. A grant application for data collection.
• C. A data deletion policy.
• D. A legal contract specifying permissible data uses, privacy protections, and obligations when sharing data between entities.

Answer: (D)

A data use agreement is a written contract that sets out how data can be used, who can access it, and what privacy protections and obligations apply when data are shared between organizations. It specifies permissible data uses, security requirements, data retention and destruction rules, and responsibilities for handling data safely and reporting any breaches. This kind of agreement is needed whenever data are transferred across institutional boundaries or shared with external collaborators—especially when the data include sensitive or restricted information like personal identifiers or health data. The goal is to ensure compliance with privacy laws and institutional policies and to clarify issues such as data ownership and how findings or derived data can be published. A standard lab protocol is about how to perform experiments, not about sharing data; a grant application is about securing funding; and a data deletion policy governs removing data, not how data can be used or shared.

A data use agreement is a written contract that sets out how data can be used, who can access it, and what privacy protections and obligations apply when data are shared between organizations. It specifies permissible data uses, security requirements, data retention and destruction rules, and responsibilities for handling data safely and reporting any breaches. This kind of agreement is needed whenever data are transferred across institutional boundaries or shared with external collaborators—especially when the data include sensitive or restricted information like personal identifiers or health data. The goal is to ensure compliance with privacy laws and institutional policies and to clarify issues such as data ownership and how findings or derived data can be published. A standard lab protocol is about how to perform experiments, not about sharing data; a grant application is about securing funding; and a data deletion policy governs removing data, not how data can be used or shared.