{"id":3138,"date":"2026-03-09T19:03:58","date_gmt":"2026-03-09T23:03:58","guid":{"rendered":"https:\/\/www.bu.edu\/asir\/?page_id=3138"},"modified":"2026-04-15T12:22:09","modified_gmt":"2026-04-15T16:22:09","slug":"data-use-agreements","status":"publish","type":"page","link":"https:\/\/www.bu.edu\/asir\/data-use\/data-use-agreements\/","title":{"rendered":"Data Use Agreements"},"content":{"rendered":"
\n
\n
\n
This page works alongside Protecting & Sharing Data<\/a> at BU. The main sharing page helps you classify, minimize, authorize, and secure data sharing. This page helps you determine when a formal review pathway, including a Data Use Agreement, may be required and what is typically approved, limited, or declined.<\/div>\n<\/div>\n<\/div>\n
\n
\n
When a DUA is often needed<\/div>\n
A DUA may be needed when a request involves broader sharing, more sensitive information, increased privacy risk, cross-system analysis, research use, or an external audience. Requests are reviewed by AS&IR and the relevant Data Trustee, and some requests may need to be narrowed or revised before they can proceed.<\/div>\n
\n
Start here<\/div>\n
If your use case involves identifiable or sensitive data, data combined across systems or populations, research or publication, external sharing, or a request that goes beyond routine role-based access, you should plan to complete a Data Use Agreement.<\/div>\n
If your request matches the types of scenarios described on this page, the next step is the<\/div>\n
Complete Data Use Agreement
\n<\/a><\/div>\n\n\n\n
\n
\n
Internal requests with added sensitivity<\/div>\n
A DUA may be appropriate when a request includes identifiable records, sensitive data elements, small populations, or combinations of data that increase re-identification risk.<\/div>\n<\/div>\n<\/td>\n
\n
\n
Cross-system or cross-population use<\/div>\n
Requests that combine data from multiple systems, offices, or populations often need additional review to confirm stewardship, scope, and approval pathways.<\/div>\n<\/div>\n<\/td>\n
\n
\n
Research, publication, or external sharing<\/div>\n
Requests connected to research, dissertations, theses, publication, vendors, or external collaborators may require both research compliance review and institutional approval.<\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n
\n
\n
How data access decisions are made<\/div>\n
Submitting a request does not guarantee approval. Review focuses on whether the request is appropriate, necessary, aligned to role and mission, and structured in a way that protects privacy and supports responsible use.<\/div>\n\n\n\n\n
\n
\n
Purpose<\/div>\n
Is there a clear institutional, operational, academic, or research need for the data?<\/div>\n<\/div>\n<\/td>\n
\n
\n
Data minimization<\/div>\n
Is the request limited to the minimum data necessary, or could aggregate or de-identified data meet the need?<\/div>\n<\/div>\n<\/td>\n
\n
\n
Role alignment<\/div>\n
Does the request align with the requester\u2019s official responsibilities, approved project role, or institutional function?<\/div>\n<\/div>\n<\/td>\n<\/tr>\n
\n
\n
Privacy and risk<\/div>\n
\n

Does the request involve sensitive, identifiable data or FERPA protected data <\/span>or create unnecessary re-identification risk?<\/p>\n<\/div>\n<\/div>\n<\/td>\n

\n
\n
Institutional benefit<\/div>\n
Will the work support a broader institutional need, such as a reusable report, dataset, dashboard, or analytic resource?<\/div>\n<\/div>\n<\/td>\n
\n
\n
Compliance readiness<\/div>\n
If the request is for research, have the appropriate IRB steps been completed in addition to institutional review?<\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n
\n
\n
Typical approval and denial patterns<\/div>\n
These examples do not guarantee an outcome, but they show the conditions that commonly support approval or lead to limitation, revision, or denial.<\/div>\n\n\n\n
\n
\n
More likely to be approved<\/div>\n
    \n
  • The request supports a legitimate institutional, administrative, or approved research purpose.<\/li>\n
  • The data requested is aggregated, de-identified, masked, or otherwise limited to what is necessary.<\/li>\n
  • The request aligns with the requester\u2019s role and responsibilities.<\/li>\n
  • The request supports academic, operational, compliance, or strategic priorities.<\/li>\n
  • Required IRB review or approval is documented, when applicable.<\/li>\n
  • The work may produce a reusable institutional dataset, dashboard, report, or analytic tool.<\/li>\n<\/ul>\n<\/div>\n<\/td>\n
\n
\n
May be limited or declined<\/div>\n