What kinds of agreements are needed when using data from external or commercial sources?

When Indiana University researchers utilize data from external or commercial sources, they often require formal agreements to specify how the data may be accessed, used, stored, and shared. These typically include RCData Use Agreements (DUAs), Licensing Agreements, or, in some cases, Material Transfer Agreements (MTAs) ORA reviews, negotiates, & signs non-monetary agreements related to research RC Data Use Agreements (DUAs), Licensing Agreements, or, in some cases, Material Transfer Agreements (MTAs)  if the data is considered a tangible product. These agreements are essential for establishing legal and ethical parameters, ensuring compliance with institutional and sponsor policies, and protecting both the data provider and IU from liability.

A DUA generally specifies the nature of the data, its intended use, and any security, privacy, or publication restrictions. For example, commercial providers may prohibit redistribution, require encrypted storage, or impose limitations on how data may be analyzed or published. DUAs are often necessary when using proprietary or administrative datasets from companies, government agencies, or community organizations. Because these agreements can affect project timelines, publication plans, and data management strategies, it’s important to review and negotiate them before receiving the data.

Even if an agreement isn’t strictly required, it’s best practice to establish one, particularly if you’re the data provider. A DUA can define rules for data sharing, use, authorship, and acknowledgment, and may require that you review any resulting publications.

At IU, these agreements must be signed by an authorized institutional official, not by individual researchers. To initiate the process, submit a request via the RCOffice of Research Administration (ORA) Contract Request FormForm to submit non-monetary contract requests RC Office of Research Administration (ORA) Contract Request Form . Start early, as review and negotiation can take time to ensure alignment with IU policies (such as RCDM-01IU policy regarding the management of institutional data RC DM-01 and RCDM-02IU policy regarding disclosure of institutional information to third parties RC DM-02 ), security standards, and legal obligations. If the data is sensitive, researchers should also consult with SecureMyResearch for guidance on secure storage and access.