Data use agreements, data sharing agreements and data licenses

Data use agreements, data sharing agreements and data licenses are often treated as the same thing, and buyers' drafts sometimes carry whichever label the legal team had to hand. They come from different worlds. A data use agreement comes from research and health care, a data sharing agreement from privacy law and public bodies, and a data license from commercial deals. Which one you sign changes what you're agreeing to.

The four agreements compared

What a data use agreement is

A data use agreement limits what a recipient may do with data it receives. Universities and research institutions use them for almost every dataset that comes in or goes out, and the MIT handbook on administrative data publishes model agreements for that purpose (MIT Handbook on Using Administrative Data for Research).

In US health care the term has a specific legal meaning. A HIPAA covered entity may share a limited data set, meaning health information with direct identifiers removed but some details such as dates and towns kept, only if the recipient signs a data use agreement (Electronic Code of Federal Regulations). That agreement has to:

• Set out the permitted uses and who may use or receive the data
• Bar any use or disclosure beyond what the agreement allows or the law requires
• Require appropriate safeguards and the reporting of any unauthorized use
• Make anyone the recipient passes the data to agree to the same conditions
• Forbid identifying the individuals or contacting them

Outside those settings, "data use agreement" is just a label. What matters is whether the document contains the terms your deal needs.

What a data sharing agreement is

A data sharing agreement records how two or more organizations will share personal data and stay within privacy law while they do. The UK Information Commissioner's code of practice recommends one as good practice and describes what it should cover (UK Information Commissioner's Office), including:

• The purpose of the sharing and the organizations involved
• The data items to be shared and the lawful basis for sharing them
• How individuals' rights will be handled and who answers their requests
• Security, retention and deletion
• When the arrangement will be reviewed

These are sensible terms, but a data sharing agreement assumes both sides share data for a common purpose. It doesn't deal with payment, exclusivity, model training or what a model may reproduce, so it can't stand in for a license.

Where the data processing agreement fits

If personal data is involved and one party processes it on the other's instructions, GDPR requires a contract with specific terms between them (EUR-Lex). In a licensing deal that usually comes up when the buyer runs the redaction for you after transfer. Once the data is properly anonymized, it is no longer personal data and the processing terms stop applying to it. Our guide to de-identification vs anonymization explains where that line is.

Which one an AI training deal needs

A paid deal needs a data license, because only a license deals with what you're actually agreeing: what the buyer may do with your records, whether anyone else can have them, what you're paid and when, what happens to the copies, and what the trained model may not reproduce. Our data licensing agreement guide goes through those terms clause by clause.

If a buyer sends a data use or data sharing agreement for a commercial deal, check that it covers at least these, whatever it's called:

• A written schedule of exactly what is licensed
• Permitted use limited to training and evaluating the buyer's models
• No resale or sublicensing without your consent
• Exclusivity, if any, with a price and an end date
• Payment amounts, milestones and acceptance criteria
• Deletion of raw and cleaned copies, with written confirmation
• No reproduction of your records in model outputs

Common questions

What is a data use agreement?

A contract that sets out how a recipient may use data it receives, usually for a specific research project. Under HIPAA, a data use agreement is required before a covered entity can share a limited data set, which is health information with direct identifiers removed.

Is a data sharing agreement legally required?

Not always. For personal data shared between organizations in the UK, the ICO's code of practice treats a data sharing agreement as good practice rather than a strict legal requirement. Some arrangements do need specific contracts by law, such as a data processing agreement when one organization processes personal data on another's behalf under GDPR.

Can we use a data use agreement template for an AI training deal?

It's the wrong starting point. Data use agreement templates are written for research projects, so they usually have no payment terms, no exclusivity and nothing about models or their outputs. A paid AI training deal needs a data license, plus a data processing agreement if any personal data is involved.