Data Use Agreements

If you anticipate a need to transfer data between institutions, chances are high that a Data Use Agreement (DUA) will be required.

Depending on the situation, CWRU may be the provider or the recipient of Data.

Frequently Asked Questions

  • When the provider requests one
  • When the provider wants to restrict use of data, secure publication review or acknowledgment rights, or otherwise direct or control use of data post-transfer
  • When the data contain protected health information (PHI), limited data sets (LDS), personally identifiable information (PII), or information that is protected by the Family Educational Rights and Privacy Act (FERPA)
  • Data collected under a UH IRB and that includes information about UH patients requires a DUA for transfer even if the data set is de-identified.
  • When other contractual obligations on the data exist

It is strongly recommended that you start your process as soon as you anticipate a need for the transfer of data, as the process can take weeks or months.

Contact Johnny Sams for questions at or to get the process started.

The IRB will need to make the official determination, even in cases where the answer seems obvious. Consulting with the IRB protects the human participants (if any), the investigator(s), and the university.

Contact Johnny Sams as soon as you anticipate a need for receipt or transfer of data.

Your case will be examined by experts across departments (IRB, CWRU Tech Transfer Office, and CWRU General Counsel) and processed until all requirements are met and the agreement is authorized. In cases where data would be received from another institution, the CWRU Tech Transfer Office’s DUA Review Form will need to be completed by the receiving PI. This form, along with other relevant documents (e.g., IRB approval, draft DUA from originating institution) will need to be submitted to the CWRU Tech Transfer Office before review can begin. In cases where data would be provided to another institution, the process is similar. However, CWRU would typically draft a DUA, as it would be the originating institution. Whether the need is to send or receive data, contact Johnny Sams to start the process.

Each case is different. The process can take weeks or months depending on the specifics of your case. This is why it is important to get started as soon as you anticipate a need for receipt or transfer of data.

No. Only an authorized signatory as determined by the CWRU Tech Transfer Office and/or CWRU Office of General Counsel can sign the agreement.

No. The DUA Review Form is used by the CWRU Tech Transfer Office to examine the preliminary specifics of your case and determine a course of action.

A DUA will need to be authorized before CWRU will authorize transfer of the data to the receiving institution. Should you elect to get the process started prior to your departure, contact Johnny Sams to get started.

A DUA may need to be authorized by designated officials from CWRU and the originating institution before CWRU can receive the data. Contact Johnny Sams.

The data belong to the originating institution.

No. CWRU’s processes are designed to protect the institution’s best interests and reduce the likelihood of adverse consequences for the receipt, transfer, and/or use of data. As such, CWRU’s processes require an investment of time by the parties involved in examining your case (IRB, Tech Transfer Office, General Counsel).

Attempting to circumvent the process in any form, including receipt, transfer, and/or use of data without having consulted with CWRU could result in severe consequences, including disciplinary action, termination of relationship with the university, and legal liability.