Data Use Agreements
Data and Data Use Agreements (DUAs)
A Data Use Agreement (DUA) is a contract that governs the terms and conditions around the transfer of data into or out of Harvard. DUAs are commonly used when researchers, institutions, or companies wish to share data, especially if the data contains sensitive, confidential, or protected information (such as personally identifiable information).
The project PI is responsible for ensuring that any future approved access is compliant with a DUA, including updating the data provider before approving access, if required. A researcher cannot sign a DUA on behalf of Harvard; the signature must come from HU-OSP, regardless of funding considerations. Prior to review, negotiation, and signature, the officer assigned to a specific DUA will require evidence of IRB protocol review, level of security, and IT approved protections for the data. The fully executed DUA is sent to the sponsoring data provider by HU-OSP.
Full University guidance about how DUAs are processed at Harvard
Promoting Successful Submission of New DUA Requests
A complete and accurate system record in the Agreements-DUA system, in most cases, will provide the OSP negotiator with the information they need to initiate the agreement review process. The below guidance is intended to provide clarity around common issues and emphasize practices that best facilitate efficient processing of DUA requests. In general, records in the system require completed data fields or data fields with sufficient information to inform a negotiation appropriately to advocate for researcher/PI, project and HGSE needs. An incomplete record will require additional diligence. This will result in delays in processing and potentially impact the negotiator’s ability to follow up in a timely manner on other GSE negotiations.
Common Issues
No IRB and/or DAT linked to the record
- Use the “Manage Related Projects” menu option to add the DAT and/or IRB once each has been submitted
- Uploading a copy of the IRB protocol to the DUA record is not sufficient, the IRB-ESTR record must be linked; if a project does not include human subjects, the researcher should attach a completed self-certification worksheet
- Note that all DUAs require a DAT/Data Safety approval, regardless of whether human subjects research
- Both IRB (if applicable) and DAT records must be in a final/approved state before the DUA may be executed by Harvard.
- Incomplete/vague project descriptions
- Project descriptions should include a synopsis of the research as well as any intended outputs utilizing the data
- If requested data will be combined with other data sets, this should be indicated
- All individuals who will require access to the data should be named in the project record. This includes any non-Harvard collaborators.
- Incomplete/vague descriptions of data being requested
- The description of the data should provide sufficient information for the OSP negotiator to ascertain the sensitivity and scope.
- Requested durations that far exceed industry standards (e.g., 99 years)
- Typically, the initial term of a DUA runs from 2-5 years
- Lack of information on related projects/agreements
- This includes sponsored awards and associated subawards as well as unfunded agreements (e.g., collaboration agreements, other DUAs)
- Filling in parts of the form with references to other documents rather than the information requested (e.g., a data description referring the negotiator to “See IRB protocol”)
- [Anticipating common questions that Officers ask to be sure the terms are acceptable or not – can we provide some more information here? I am thinking things like “What outputs might you make using these data? Other than publications, what else might you create with these data?” ][See above revisions]
Other Considerations
- Each DUA record is kept up to date with the current status of the negotiation. Checking the record first will eliminate unnecessary e-mail correspondence.
- When emailing OSP about a DUA record, include the system email as a recipient (dua_notification@harvard.edu) AND the submission number at the start of the email subject (for example “DUA12-9989: title”)
- For new multi-site projects (e.g. PIER), rather than enter a placeholder or request a template via the Agreements-DUA system, coordinate with GSE Research Administration to schedule a conversation with the OSP negotiator regarding anticipated needs.
- For DUAs which have connections to other agreements (e.g., a DUA is being done with the same organization with which there will also be a subaward for related work), please provide that information in the DUA record so the OSP negotiator is aware and can coordinate with those who may be working on such other agreements. (NOTE: Not all GSE agreements are handled by the same OSP negotiator, so do not assume the assigned negotiator has knowledge of any overlapping projects/agreements.)
- For all DUAs on which a student is serving as the lead researcher/PI, the researcher should list their faculty advisor and anticipated graduation date in the description of the project.
Harvard / HGSE Data Use Agreements (DUAs): How‑To
A Data Use Agreement (DUA) is a contract that governs transfer of confidential, proprietary, or otherwise sensitive data into or out of Harvard for research, academic, or educational use.
You typically need a DUA when:
- You are receiving restricted data (e.g., identifiable, or limited human‑subjects data, proprietary datasets, or any dataset subject to security or confidentiality requirements).
- You are sharing / sending data outside Harvard that is not fully public.
- The data provider asks for an agreement to govern the sharing of their data (may be called a DUA, MOU/MOA, license, or similar).
If you are unsure about this determination, please reach out to Tiffany Blackman and/or your HGSE OSP Portfolio grant manager. To be clear, most of this determination is driven by the data owner/data collector.
System Tools
- WAIT Tool – “What Agreement Is This?” helps you identify whether an agreement that you have received from a counterparty is a DUA, an NDA, a services agreement, etc.
- Agreements / DUA Portal – Start, track, and manage DUA requests:. This includes requests to draft a new DUA (incoming or outgoing) or for review of a DUA that you have received from a data provider.
- Data Safety – Coordinate IT security review in connection with incoming data
- IRB / ESTR – Required if the DUA governs the exchange of human‑subjects data. IRB protocol is reviewed and approved by the Committee on the Use of Human Subjects (CUHS). CUHS also determines if the human subjects data is “Sensitive” or “Non-Sensitive” which informs the Data Safety review.
Key Offices
- HGSE‑IT (or school‑level IT / HUIT) – Assigns a Harvard Research Data Security Policy (HRDSP) level for Sensitive data. For all projects, confirms that your data security plan and associated systems meet the HRDSP level and any additional requirements in the DUA.
- HU‑OSP Reviews and negotiates DUA terms and signs on behalf of Harvard.
- HGSE-OSP- Facilitates the processing of DUAs and routing in the DUA system, and provides general support and resolution for DUA issues.
A. Prior to engaging in the DUA system, clarify the project and dataset
- Define the research purpose and specific data needed. For further guidance on common issues that need to be defined for successful handing of a DUA, see above.
- If you are a student or postdoc, identify a faculty mentor/PI who will be the official requestor and supervisor.
B. Request the data from the provider
- Submit the provider’s application or request form, describing:
- Study purpose and methods.
- Exact dataset(s) being requested.
- If asked for an institutional contact, use the appropriate OSP official, Dana LoSasso (not yourself).
*Note the next 3 steps may be pursued concurrently*
- Submit or update your IRB protocol in IRB-ESTR describing use of the data.
- The IRB will:
- Review and approve the protocol
- Issue a determination as to whether data is sensitive or non-sensitive
- If project does not involve human subjects research, complete investigator self-certification form. If unsure, CUHS should be consulted.
- Create new review request in Data Safety system for routing to GSE IT/SSO. Request should include:
- Data description and sensitivity.
- Copy of DUA (if available)
- Work with HGSE-IT to define where and how data will be stored, accessed, and shared (e.g., secure servers, encrypted storage, access controls).
- Create a new request in the Agreements-DUA system utilizing “Create Agreement” function
- Provide all information requested in the system form, including:
- Funding source(s) and related awards or agreements.
- Collaborations with the data provider.
- Whether data are covered by HIPAA, FERPA, or other privacy regulations.
- Whether you will merge the data with other datasets, create derivatives, or publish results.
- Additional related agreements (NDAs, licenses, MTAs, etc.).
- Key provider contacts (OSP will reach out to this contact for negotiation, so be sure that you put the correct person and note any additional contacts that should be included)
- Students/Postdocs: List your faculty mentor/PI (students and postdocs) and anticipated graduation date (students only)
- Make sure all relevant documentation is attached to the submission, this includes the provider’s draft DUA (if applicable), a copy of your request to the data provider, and any other attachments
- Link your IRB-ESTR and Data Safety-DAT records to the DUA record using the “Manage Related Projects” function
- HU-OSP reviews the DUA for:
- Alignment with Harvard policies (IP, confidentiality, use of name, publication rights, governing law, liability/indemnification, international issues, etc.).
- Consistency with your IRB approval and IT security plan.
- As needed, HU-OSP consults:
- OTD – for intellectual property terms.
- OGC – for legal issues.
- OVPR -- for publication terms/country of concern issues
- HU-OSP negotiates changes with the data provider; you may be consulted but do not negotiate or sign on your own.
For common negotiation issues with DUA and related Harvard or school policy, go here: OSP DUA NEGOTIATION TERM TABLE
Once all reviews are complete:
- The authorized HU-OSP signatory signs the DUA (you may also be asked to sign an acknowledgment as researcher/PI if required by the data provider).
- The fully‑executed DUA is returned to the data provider; a copy is stored in the Agreements system and shared with you.
The DUA may not be signed by HU-OSP until both the IRB-ESTR and Data Safety-DAT reviews have been completed.
- Data are transferred only after the DUA is fully executed and the IT environment is approved.
- Use, store, and share the data strictly according to:
- The DUA terms (purpose, users, sites, sharing limits, duration, destruction/return).
- Your IRB protocol and approved security plan.
- Request amendments or extensions through the Agreements portal if scope, users, or end date change.
- You may not sign a DUA for Harvard. Only HU-OSP (or other formally delegated officials) can bind the institution.
- Students and postdocs must have a faculty PI/mentor listed on the DUA and IRB and must be supervised in using the data.
- Always start early; IRB, IT, and OSP reviews happen in parallel but can take time, especially if terms need negotiation.
- Use the WAIT tool or consult HGSE OSP/Finance if you are unsure whether the document is a DUA, services agreement, gift, subaward, NDA, etc.
- When in doubt, ask HGSE OSP or duahelp@harvard.edu before promising data access or beginning work.