Data License Agreement

Data license agreements (DLA), or data use agreements (DUA) are documents that describe what kind of data is being shared with recipients. DLAs specify clearly the purpose and duration of access being provided to the recipient, along with restrictions and security protocols that the recipient of the data must follow. Other contracts, such as a non-disclosure agreement (NDA), may be used to guarantee confidentiality of sensitive data.

Read First

• A non-disclosure agreement (NDA) is an agreement signed by a member of the research team stating clearly that they will not share any sensitive information with anyone outside the research team.
• A data license agreement (DLA) usually has two parties - one who provides the data, and the other who requests access to that data.
• Projects that have multiple sources of data will require multiple data license agreements.
• Members of the research team must follow certain best practices when developing a DLA.
• The World Bank uses the following DLA template.

Overview

Every data license agreement (DLA) involves at least two sides: one, the researcher or organization providing the data (data provider), and two, the researcher or organization requesting access to the data (data requestor). The data provider is responsible for permitting access to the data as a representative of the research subjects or the data collecting agency. The data provider is also bound by laws and policies that deal with providing access to PII data and other sensitive data such as test scores, health conditions, and so on. In some cases, the data provider can use a third-party like a data intermediary or data custodian to offer data on their behalf. Custodians and intermediaries support access to data and reduce the burden on data providers by ensuring compliance with laws, and coordinating between multiple requestors and providers.

Scope

Further, while DLAs can differ in terms of structure and the level of detail, they must clearly state the following:

• The legal framework within which access to the data will be provided
• Scope of the study for which requestor needs access to the data
• Restrictions on what the requestor can do with the data
• Constraints on publishing sensitive information and PII data

In addition to this, the data requestors must also submit their DLA to their organization's information security specialists for an internal review. In general, it is a good practice for the data requestor to prepare some form of documentation for data access, even if the data provider does not require it.

Timeline and Costs

While discussing the data license agreement (DLA), the data provider and the data requestor should carefully discuss the timelines and costs involved for both parties. This includes the following:

• Time of data delivery to the requestor
• Method of extracting data that is to be shared with the requestor
• Expenses that might arise while the data-sharing agreement is in effect, including fees charged by administrative agencies for facilitating the agreement

In addition to this, both parties should keep in mind the following with regards to timeline and cost of preparing and carrying out a data-sharing arrangement:

• Negotiations: Negotiating agreements like the DLA can take up to a year, from the drafting stage to the execution stage, especially if there is no history of the two parties exchanging data before.
• Pending requests: Even if the requestor and the provider have previously exchanged data before, there could be pending requests with the provider that can cause delays.
• Interim: Even after signing a DLA, requestors should aaccount for the time after approval, but before data delivery, since the processes for fulfilling the request can take a significant amount of time to be completed. For example, data providers will need time to document and format the requested data. They may also need time to extract the data from multiple databases, or carefully encrypted storage
• Publication: The data requestor may also need to notify the data providers before any releasing any outputs or publications. This would take additional time.
• Transparency: Finally, if both parties are transparent about the timeline and costs, and focus on making the DLA as clear as possible, then it makes it easier to carry out the data-sharing arrangement.

Drafting DLAs

Creating DUAs can be time-intensive. In some cases, negotiations fall apart after months or years of discussions. Advance planning can help both researchers and data providers achieve sound DUAs. DUAs can be initiated by the researcher or data provider.36 Data providers may have different or expedited procedures when sharing data with a researcher, an evaluator, or contractor working on their behalf.

If a data provider has an established data request process, a researcher must review their terms and requirements, offering additions or edits as appropriate. Data providers should be aware of the laws, regulations, and policies permitting use of their data, and, upon receiving a first request, determine whether data request procedures already exist in their organization. Data providers (such as government agencies or private companies) may have Offices of General Counsel that have preferred templates or formats. Some data providers will be reluctant or unable to modify their request processes. Data request and access procedures may not always be publicly available, though some agencies and organizations have data request procedures on their websites, and this can significantly speed up and simplify the request process.

Related Pages

Click here for pages that link to this topic.

Additional Resources

• JPAL, Handbook on Using Administrative Data for Research and Evidence-based Policy]
• World Bank, World Bank's Data License Agreement