Skip to main content

Data Use Agreement

A Data Use Agreement (DUA) is a contractual document used for the transfer of data that has been developed by nonprofit, government or private industry, where the data is nonpublic or is otherwise subject to some restrictions on its use. When the data is a necessary component of a research project, the agreement protects and restricts the use and disclosure of the data set being transferred. The University of Houston requires an agreement for both outgoing and incoming transfers of data. Additional guidance can be found here.

The chart below outlines the steps, the responsible office or person, and the time it typically takes to receive approval for a DUA. Note that the first four steps are done concurrently.

Steps Responsible Office or Person Timing

Submit the Data Use Agreement with a completed compliance questionnaire via email to

Principal Investigator
Congruency check and approvals for data with Human Subjects, Animal Care, and Conflicts of Interest concerns Office of Research Integrity and Oversight (RIO) ~ 5 business days, May be longer if approved protocol is not in place
System security review for agreements with specific, Information Technology security standards for safeguarding data Information Technology Office ~ 5 business days
Protected Health Information (PHI) review for agreements with health and financial information, education records, and other related protected information University Office of the General Counsel ~ 5 business days
Review and negotiation of general legal terms and conditions of the agreement as needed Office of Contracts and Grants ~ 3-5 business days
Approval for exception to standard terms and conditions that normally cannot be accepted by UH Vice President for Research Additional 2-3 business days
Finalize agreement, obtain signatures (execute) and distribute to relevant parties Office of Contracts and Grants Additional 2-3 business days

Other Considerations

Online Approvals

Some repositories, such as the Bureau of Labor Statistics (BLS) Restricted Data Access Letter of Agreement and the NIH database of Genotypes and Phenotypes (dbGaP) Data Access, require online registrations. After the internal routing and review of the printed documentation, OCG will login online to approve and submit the agreement.

Data from a Sponsored Research Project

When a sponsor claims ownership of the data and/or restricts disclosure and use of the data, check the terms and conditions of the award before setting up a collaboration that requires data transfers. In such cases a DUA may be recommended to flow down the limitations and restrictions placed on UH’s use and disclosure of the data.

Export Controlled Material

Under U.S. export control laws, a license may be required from the Bureau of Industry and Security of the Department of Commerce for the export of certain data. Anyone who is planning to transfer controlled material by the Department of Commerce or the Department of State outside of the United States, should work with the UH Export Control Officer, Sandy Ulmer, to obtain the required license. In addition, transfers of certain propriety information to foreign entities and collaborators may require further review and consideration.