A Data Use Agreement (DUA) is a contractual document used for the transfer of data that has been developed by nonprofit, government or private industry, where the data is nonpublic or is otherwise subject to some restrictions on its use. When the data is a necessary component of a research project, the agreement protects and restricts the use and disclosure of the data set being transferred. The University of Houston requires an agreement for both outgoing and incoming transfers of data. Additional guidance can be found here.
The chart below outlines the steps, the responsible office or person, and the time it typically takes to receive approval for a DUA. Note that the first four steps are done concurrently.
|Steps||Responsible Office or Person||Timing|
Submit the Data Use Agreement with a completed compliance questionnaire via email to Dorcontracts@listserv.uh.eu
|Congruency check and approvals for data with Human Subjects, Animal Care, and Conflicts of Interest concerns||Office of Research Integrity and Oversight (RIO)||~ 5 business days, May be longer if approved protocol is not in place|
|System security review for agreements with Information Technology (IT) security standards for safeguarding data||Information Technology Office||~ 5 business days|
|Protected Health Information (PHI) review for agreements with health and financial information, education records, and other related protected information||University Office of the General Counsel||~ 5 business days|
|Review and negotiation of general legal terms and conditions of the agreement as needed||Office of Contracts and Grants||~ 3-5 business days|
|Approval for exception to standard terms and conditions that normally cannot be accepted by UH||Vice President for Research||Additional 2-3 business days|
|Finalize agreement, obtain signatures (execute) and distribute to relevant parties||Office of Contracts and Grants||Additional 2-3 business days|
Some repositories, such as the Bureau of Labor Statistics (BLS) Restricted Data Access Letter of Agreement and the NIH database of Genotypes and Phenotypes (dbGaP) Data Access, require online registrations. After the internal routing and review of the printed documentation, OCG will login online to approve and submit the agreement.
Data from a Sponsored Research Project
When a sponsor claims ownership of the data and/or restricts disclosure and use of the data, check the terms and conditions of the award before setting up a collaboration that requires data transfers. In such cases a DUA may be recommended to flow down the limitations and restrictions placed on UH’s use and disclosure of the data.
Export Controlled Material
Under U.S. export control laws, a license may be required from the Bureau of Industry and Security of the Department of Commerce for the export of certain data. Anyone who is planning to transfer controlled material by the Department of Commerce or the Department of State outside of the United States, should work with the UH Export Control Officer, Sandy Ulmer, to obtain the required license. In addition, transfers of certain propriety information to foreign entities and collaborators may require further review and consideration.