What is a data use agreement, and how is it different from a data license?
Short answer. A data use agreement is a contract that limits what a recipient may do with data it receives: the purpose, who may see it, how it is protected and what happens at the end. In US health privacy law it has a specific meaning tied to limited data sets. A data license is broader, because it grants rights to use the data, often for payment, and the use terms are only one part of it.
General information, not legal advice.
Where the term comes from
The phrase is used loosely in business, but it has a precise home in the HIPAA Privacy Rule. A limited data set is health information with direct identifiers such as names, street addresses and phone numbers removed, while dates and some place details may remain. Under 45 CFR 164.514(e), a covered entity may share a limited data set only for research, public health or health care operations, and only after the recipient signs a data use agreement.
The rule lists what that agreement must say: the permitted uses, who may use or receive the data, a promise not to use or disclose it beyond the agreement, safeguards, reporting of any misuse, the same terms for any agent, and a promise not to identify or contact the people in it. Outside health care, many research groups and government agencies borrowed this shape for their own agreements.
How it differs from a license and an NDA
A nondisclosure agreement keeps information secret. It is signed early, often before any data moves, and mostly protects what is said in talks. A data use agreement goes further: it governs data that has been handed over and fences in what may be done with it. A license goes further again, because it grants a right, sets a fee, and deals with ownership of what is built from the data.
In an AI data deal the three can appear in order. An NDA covers the first conversations and any sample. The license is the main contract. Use restrictions inside the license, or a separate use agreement for a test set, then limit how the lab handles the records day to day.
What a use agreement usually contains
Most contain the same building blocks. The purpose clause states the one thing the data may be used for. An access clause names the teams or roles that may see it. A security clause sets storage, encryption and access logging. A no re-identification clause bars attempts to work out who is in the data. Onward sharing is either banned or allowed only on the same terms. The end clause says whether data is returned or destroyed, and how that is confirmed.
For a company licensing operating records, the no re-identification clause and the onward sharing clause matter most. They are what stand between a de-identified set and a person being linked back to it, and they decide whether a version of the records can reach a third party.
When a company meets one
A medical practice, lab or clinic is the obvious case, since health records fall under the rule above. A company outside health care meets the term when a lab asks to evaluate a set before licensing it, or when part of the data comes from a partner who requires one. In each case the agreement should match the de-identification that was actually done, and it is drafted and reviewed by counsel, not by a broker.
Follow-up questions
Does every data deal need a separate data use agreement?
No. Many licenses carry the use limits inside them. A separate agreement is common for health data, for evaluation sets shared before a license, and when an upstream partner requires one.
Is a limited data set the same as de-identified data?
No. Under HIPAA a limited data set is still protected health information, because dates and some location detail remain. De-identified data under the Safe Harbor or expert method is outside the rule.
Who signs it on the company side?
Someone with authority to bind the company, usually the owner or an officer, after counsel has read it. The person who prepared the data is often named as the contact for questions.
Didn't find your question? Ask us directly.