A data use agreement lets a recipient use your data for one stated purpose and nothing else. It names who may use the data, bans re-identifying or contacting people, requires safeguards, flows the same terms down to subcontractors, controls what may be published, and ends with deletion. HIPAA requires one for limited data sets.
- Write the permitted use narrowly; everything else is excluded.
- Ban re-identification and contact, including by combining with other data.
- A data use agreement usually has no fee. When the recipient pays for rights, use a licence.
FREE WORKING TOOL · NO ACCOUNT REQUIRED
Draft a data use agreement outline and download your CSV
Add a row for each clause. State the permitted use narrowly, then record what the recipient must and must not do. Counsel turns the agreed outline into contract wording.
This builder creates the file in your browser. Your entries are not submitted by this tool and disappear when you leave or reload. Use descriptions and invented examples, without private records or access details.
1 row in your working file. Save a download before leaving this page.
To share the tool, link to this page. Your downloaded file is a working document; it does not establish approval, rights, eligibility or an outcome.
Download the data use agreement template.
Use the free CSV builder on this page, or open the data use agreement template with nine example clauses. No email or account is required.
This is a working template, not legal advice. Use it to organize facts and questions, then have qualified counsel review anything you sign, adopt or delete.
Describe the dataset before drafting. Name the record category in the company data inventory and define its fields with the data dictionary template.
The clauses, in plain language
The example positions below suit a short evaluation project. Adjust each one to the project and record what is still open.
| Clause | What it settles | Our position |
|---|---|---|
| Permitted use | The one project or purpose the data may be used for | Evaluation of a scheduling model on the described dataset only |
| Authorized users | Who at the recipient may use or receive the data | Named project team; no contractors without approval |
| No re-identification or contact | The recipient may not identify people in the data or contact them | Prohibited, including by combining with other data |
| Safeguards | How the recipient protects the data | Access controls, encryption and an access log |
| Reporting misuse | What the recipient must tell you if something goes wrong | Written notice of any use outside the agreement |
| Agents and subcontractors | Whether others who touch the data are bound by the same terms | Same restrictions flow down in writing |
| Outputs and publication | What the recipient may publish or keep from its work | Aggregate results only; no record-level extracts |
| Term, return and destruction | When use ends and what happens to copies | Delete all copies at the end of the project and certify it |
| Fees | Whether either side pays | UNKNOWN |
Where the term comes from: HIPAA limited data sets
In US health privacy law the data use agreement has a defined content. Under 45 CFR 164.514(e), a covered entity may disclose a limited data set, protected health information that excludes listed direct identifiers, only for the purposes of research, public health, or health care operations, and only "if the covered entity enters into a data use agreement with the limited data set recipient".
The regulation says the agreement must establish the permitted uses and disclosures and who may use or receive the data, and must require the recipient to:
- Not use or further disclose the information other than as the agreement permits or the law requires.
- Use appropriate safeguards to prevent any other use or disclosure.
- Report to the covered entity any use or disclosure not provided for by the agreement that it becomes aware of.
- Ensure that any agents it provides the data to agree to the same restrictions and conditions.
- Not identify the information or contact the individuals.
Using the same structure outside health care
Outside HIPAA there is no prescribed form, but the same clauses work for research partnerships, pilots and model evaluations. They keep the recipient to one purpose and make the end of the project a deletion event.
For personal information of California consumers, section 1798.100 of the California Civil Code requires a business that sells or shares it with a third party to have an agreement that specifies it is disclosed "only for limited and specified purposes". A narrow permitted-use clause is where that usually sits.
A data use agreement is not a sale. When the recipient wants lasting rights, such as training models it keeps, and is paying for them, the terms belong in a licence. Compare the data sharing agreement template and what a data licensing agreement should include.
Before you send a dataset
Agree the outline internally, confirm customer and employee commitments allow the use, and decide who checks deletion at the end. Send nothing until the agreement is signed.
Origin Data Partners is an independent data partner that helps companies get their data bought. If an AI developer has asked about your records, you can check whether your company could qualify with company details only.
Common questions
What is a data use agreement?
A data use agreement is a contract that lets a recipient use a dataset for a stated purpose only, with limits on who may use it, safeguards, no re-identification and deletion at the end.
When is a data use agreement required?
Under HIPAA, a covered entity may disclose a limited data set for research, public health or health care operations only under a data use agreement. Elsewhere it is common practice rather than a legal requirement.
What must a HIPAA data use agreement include?
The permitted uses and disclosures, who may use or receive the data, and commitments from the recipient to use safeguards, report misuse, bind its agents to the same terms, and not identify or contact individuals.
What is the difference between a data use agreement and a data sharing agreement?
A data use agreement limits one recipient to a stated use. A data sharing agreement sets rules for organizations exchanging data, often in both directions. See the data sharing agreement template.
Can a data use agreement include payment?
It can, but when a recipient pays for lasting rights in your data, a data licensing agreement is the better structure. Describe the records first with the data dictionary template.
Is this data use agreement template legal advice?
No. It is a working template for agreeing positions internally. Have counsel draft and review the final agreement.