Data Use Agreement

Data Provider: [Organization Name] · Data Recipient: [Organization Name] · Dataset: [Description] · Date: [Date]

1. Data Provided

Data Provider will share the dataset described above with Data Recipient, for the sole purpose of: [Specific research/business purpose — be specific, as this defines the entire permitted scope of use].

2. Permitted Uses

Data Recipient will use the data solely for the purpose stated above and will not: re-identify any individuals within the data (if de-identified/limited data set), share the data with any third party, or use it for any purpose beyond what's described.

3. Data Security

Data Recipient will store the data securely, using [encryption at rest and in transit, access controls limiting use to authorized personnel], consistent with [applicable framework — e.g. HIPAA Limited Data Set requirements, if health data].

4. No Re-Identification

Data Recipient will not attempt to re-identify individuals within the data or link it to other datasets that could result in re-identification, and will not contact any individual identified or identifiable within the data.

5. Data Retention and Destruction

Data Recipient will retain the data only for as long as necessary for the stated purpose, and will [destroy/return] all copies upon completion of the project or termination of this Agreement, confirming destruction in writing if requested.

6. Breach Notification

Data Recipient will notify Data Provider immediately upon discovering any unauthorized access, use, or disclosure of the data.

7. Term

This Agreement runs for [Term/duration of the project] and the obligations regarding data security and non-disclosure survive termination.

Data Provider: ______________________ Date: ____________ Data Recipient: ______________________ Date: ____________

*This document is provided for informational and educational purposes only and does not constitute legal advice. If the shared data includes health information, HIPAA specifically defines a "Limited Data Set" category with its own required data use agreement terms — a generic data sharing agreement that doesn't meet those specific requirements doesn't satisfy the regulation, even if it looks similar.*