Can a Data Use Terms be signed electronically?

Yes. Electronic signatures meet ESIGN and UETA requirements where applicable (15 U.S.C. §7001; UETA). Ensure the signing method records intent, attribution, consent, and retention for evidentiary value.

When is a notary or witness required?

Notarization is uncommon for Data Use Terms, but certain state rules or specific contract forms may require it. Check state statutes if the agreement must be recorded or attached to real property.

How should I handle HIPAA-covered data?

If PHI is involved, include a Business Associate Addendum, require HIPAA-compliant safeguards, and specify breach notification consistent with HIPAA rules and 45 CFR provisions.

What if a counterparty refuses specific security terms?

Document the negotiation, seek compensating controls, and consider conditional access or escrow arrangements. Escalate unresolved gaps to legal counsel before granting access.

How long must signed Data Use Terms be retained?

Retention depends on the data type and applicable law. For PHI retain at least 6 years (45 CFR §164.530(j)). Financial record retention may follow IRS rules where relevant.

How can the agreement be revoked or amended?

Include termination and amendment clauses specifying notice, data return or destruction steps, and any continuing obligations post-termination to avoid confusion.

Data Use Terms

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

DATA USE TERMS

This Data Use Terms (the "Agreement") is entered into by and between:

Provider Name: Provider Address: Recipient Name: Recipient Address:

Effective Date:

RECITALS

WHEREAS, Provider collects, curates, or otherwise controls certain data sets and datasets, including but not limited to proprietary records, metadata, and derivatives (the "Data"), and is willing to grant limited rights to Recipient for the purposes and subject to the terms set forth herein.

WHEREAS, Recipient desires to receive, access, or use the Data for the purpose of: and Provider is willing to permit such use under the conditions set forth in this Agreement.

WHEREAS, the parties intend to define the scope, security, payment, and permitted uses of the Data by these Data Use Terms.

SCOPE OF WORK

Provider will make available to Recipient the Data described below and Recipient will use such Data only as permitted by this Agreement and any appendices.

Description of Data to be Provided: Scope of Use (recipient obligations and limitations):

PAYMENT TERMS

In consideration for access to the Data, Recipient shall pay Provider the fees and follow the payment schedule set forth below.

Fee Amount (USD): Payment Schedule and Invoicing: Late Payment Fee:

TERM AND TERMINATION

This Agreement commences on the Start Date and, unless earlier terminated in accordance with this section, continues until the End Date.

Start Date: End Date:

Notice Period for Termination Without Cause (days):

Either party may terminate this Agreement for material breach by the other party that remains uncured after written notice and the expiration of the cure period specified in such notice; termination for material breach shall be without prejudice to remedies accrued prior to termination.

CONFIDENTIALITY

"Confidential Information" means nonpublic information disclosed by Provider to Recipient that is designated confidential or that reasonably should be understood to be confidential. Confidential Information expressly includes the Data and any nonpublic terms of this Agreement.

Recipient shall: (a) use Confidential Information solely for the purposes expressly permitted by this Agreement; (b) restrict disclosure of Confidential Information to its employees, contractors, or agents who have a need to know and who are bound by confidentiality obligations no less protective than those in this Agreement; and (c) take commercially reasonable administrative, physical, and technical safeguards to protect Confidential Information from unauthorized use or disclosure.

Confidentiality Duration (years):

The foregoing obligations do not apply to information that: (i) is or becomes generally known to the public other than through a breach by Recipient; (ii) was known to Recipient prior to disclosure as evidenced by written records; (iii) is rightfully received from a third party without restriction; or (iv) is independently developed by Recipient without use of Confidential Information.

DATA SECURITY AND BREACH NOTIFICATION

Recipient shall implement and maintain administrative, physical, and technical safeguards appropriate to the sensitivity of the Data, including but not limited to access controls, encryption in transit and at rest where applicable, and logging sufficient to demonstrate compliance with this Agreement.

Breach Notification Timeframe (days):

In the event of a confirmed unauthorized access to or disclosure of the Data, Recipient shall notify Provider promptly and, in any event, within the timeframe specified above, and shall cooperate with Provider in any required investigation, notification, remediation, and reasonable mitigation efforts.

PERMITTED USES; RESTRICTIONS

Recipient may use the Data solely for the purposes expressly set forth in this Agreement and shall not: (i) sell, sublicense, redistribute, or otherwise make the Data available to third parties except as expressly permitted; (ii) attempt to re-identify or de-anonymize individuals in anonymized data; or (iii) use the Data in a manner that violates applicable laws or third-party rights.

Permitted Uses (brief): Prohibited Uses (brief):

AUDIT RIGHTS

Provider may, upon reasonable prior notice, audit Recipient's compliance with the terms of this Agreement. Any audit shall be conducted during normal business hours, not more than once per calendar year except for reasonable cause.

Audit Notice Period (days):

INTELLECTUAL PROPERTY; OWNERSHIP

Provider retains all right, title, and interest in and to the Data and any associated intellectual property rights. Provider grants Recipient a limited, non-exclusive, non-transferable license to use the Data solely as permitted by this Agreement. Any derivative works that reproduce the substantive content of the Data remain subject to Provider's ownership rights to the extent they include Provider's Confidential Information.

INDEMNIFICATION; LIMITATION OF LIABILITY

Recipient shall indemnify, defend, and hold harmless Provider from and against any third-party claims arising from Recipient's breach of this Agreement, violation of law, or unauthorized use of the Data. Provider's liability to Recipient for any claim arising out of or relating to this Agreement shall be limited to direct damages not to exceed the total fees paid by Recipient under this Agreement in the twelve (12) months preceding the claim. Neither party shall be liable for indirect, special, consequential, or punitive damages.

GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of the state of without regard to conflicts of law principles.

ENTIRE AGREEMENT

This Agreement, together with any appendices or mutually executed statements of work, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements and understandings, whether written or oral.

No amendment or waiver of any provision of this Agreement shall be effective unless made in writing and signed by authorized representatives of both parties.

Provider (Printed Name):

Recipient (Printed Name):

By:

Date:

What the Data Use Terms Is and when it's used

A Data Use Terms is a written agreement that sets conditions for sharing, accessing, processing, or storing personal or sensitive data between parties. It defines permitted uses, data categories, security controls, retention limits, breach reporting, and responsibilities for compliance with applicable U.S. law. Typical parties include data owners, processors, and downstream recipients. The document is used where data transfers occur across departments, vendors, or research projects and complements privacy notices, DPAs, or HIPAA business associate arrangements when health data is involved.

Why a clear Data Use Terms matters for compliance and risk control

A precise Data Use Terms reduces regulatory risk, clarifies permitted processing, and allocates obligations for security, breach notification, and data deletion. It supports audits, defensible handling of subject requests, and demonstrates intent to comply with federal and state privacy frameworks.

Who typically prepares and signs Data Use Terms

Organizations and roles that commonly create or review Data Use Terms include privacy teams, legal counsel, vendor managers, and data stewards.

Privacy teams and DPOs who set policy and review compliance requirements for data sharing.
Vendor or contract managers who negotiate operational obligations with service providers.
Researchers, analysts, or product teams that require controlled access to datasets.

Final review usually involves legal counsel and an authorized signatory from each contracting party to ensure enforceability and alignment with statutory obligations.

Primary signers and approvers

Data Protection Officer

A DPO or privacy lead reviews scope, lawful basis, and retention; they verify technical and organizational measures meet regulatory standards and advise on breach notification obligations before execution.

Vendor Contract Manager

The contract owner ensures the vendor's operational controls match contractual promises, confirms insurance and indemnity language, and provides the authorized signature for the organization on procurement documents.

Core elements to include in professional Data Use Terms

A complete Data Use Terms structures the agreement so obligations, limits, and remedies are explicit and auditable.

Parties & Scope

Identify each legal entity by full legal name, describe covered datasets, and state the agreement's geographic and operational scope to avoid ambiguous obligations.

Permitted Uses

Specify allowed processing activities, prohibited secondary uses, and any purpose or project restrictions to prevent mission creep and unauthorized redisclosure.

Data Categories

List data types (PII, PHI, financial, de-identified), examples of fields, and the minimum data necessary to satisfy the stated purpose.

Security Requirements

Define baseline technical and organizational controls (encryption, access controls, logging), authentication levels, and any industry-specific standards required.

Retention & Disposal

Set retention periods, archival rules, deletion or return procedures, and evidence of destruction to meet legal and contractual obligations.

Breach & Liability

Allocate breach notification timelines, indemnity, limits on liability, and insurance expectations to manage post-incident responsibilities and costs.

Security and compliance checkpoints to record

Encryption: TLS 1.2/1.3 in transit; AES-256 at rest

Access Controls: Role-based access and least privilege

Audit Logging: Retention of signed audit trails

Breach Notification: Timelines and contact points defined

BAA Availability: BAA required for HIPAA-covered PHI

Data Minimization: Collect only necessary fields

Step-by-step: drafting through signed execution

Follow clear stages from drafting to execution to ensure the Data Use Terms is enforceable and aligned with operational controls.

01

Draft the clause set: Assemble scope, purposes, security, and retention terms.
02

Conduct internal review: Privacy, security, and legal validate obligations and risks.
03

Negotiate with counterparty: Clarify permitted uses, audit rights, and liability limits.
04

Execute and distribute: Obtain authorized signatures and circulate final copies to stakeholders.

Recommended online workflow settings for e-execution

Configure the signing workflow to enforce authentication, retention, and auditability when completing Data Use Terms online.

Field	Configuration
Authentication	Email link \| SMS code \| KBA as needed
Retention Setting	Retain signed record for 6 years
Access Controls	Role-based signer and viewer permissions
Audit Trail	Capture IP, timestamp, and actions

Where executed Data Use Terms should be routed

After signing, route final documents to legal, privacy, and the receiving operational team for implementation and recordkeeping.

Legal & Privacy: Store executed copy for compliance and audits.
Vendor Management: Attach agreement to vendor profile and SOW.
Operational Teams: Provide data access instructions and controls.
Retention Archive: Preserve signed records per retention schedule.

Technical formats and integrations to support e-execution

Ensure your platform supports required file formats, signer authentication, and retention of tamper-evident audit trails.

Accepted Formats: PDF, DOCX, and plain text
Integrations: Salesforce, NetSuite, Google Workspace
Authentication: Email, SMS, or stronger MFA

Choose a platform that preserves audit logs, supports export to PDF/A, and can integrate with contract repositories and GRC systems to simplify compliance oversight.

Key timelines and required response windows

Define enforceable dates and response times in the Data Use Terms to meet legal and operational obligations.

Effective Date:

The date when processing permissions and obligations begin as stated in the agreement.

Term and Renewal:

Specify fixed term and renewal mechanics to avoid indefinite access rights.

Data Subject Requests:

State response windows; HIPAA rules and many state laws require prompt responses, often within 30 days.

Breach Notification:

Require immediate notice to data owner and regulators per applicable law; HIPAA obligations may apply.

Record Retention:

Set retention periods consistent with legal requirements and the parties' operational needs.

Consequences of incorrect or incomplete Data Use Terms

Regulatory Fines: Potential enforcement penalties under privacy laws

Contract Liability: Indemnity or damages from breach of obligations

Operational Disruption: Loss of data access or forced remediation

Reputational Harm: Public exposure or customer trust erosion

Civil Litigation: Class actions or individual claims possible

Data Loss Costs: Incident response and remediation expenses

Real-world examples illustrating Data Use Terms in practice

Concrete examples show how organizations applied Data Use Terms to operationalize secure data sharing and compliance.

Tech Data — Vendor Integration

Tech Data needed secure sharing with third-party integrators

Negotiated specific encryption and audit access
The agreement tied technical controls to contract milestones and reduced disputes during integration.

Fertility Centers of Illinois — Patient Data

A medical practice required safe sharing of patient records for lab partners

Added HIPAA BAA clauses and breach protocols
This ensured partners met PHI safeguards and clarified notification duties after incidents.

How Data Use Terms compare to related agreements

Compare Data Use Terms with other common contractual instruments to determine the appropriate document type for your transfer.

Criteria	Data Use Terms	DPA
Scope	operational use limits	processor activities only
Applicable Law	contractual privacy rules	data protection law focus
Typical Parties	researchers, recipients	controllers and processors
Security Clauses	standard security obligations	technical and audit-rights detailed

Typical eSignature vendor pricing and feature comparison for signing Data Use Terms

Vendor pricing varies by plan and feature needs. Pick a solution that supports HIPAA BAAs, audit trails, and bulk workflows when signing many agreements.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

Practical tips for accurate and efficient completion

Apply standard drafting and execution practices to reduce ambiguity and enforcement risk.

Define narrow purposes and data fields

Be specific about permitted activities and list exact data elements. Narrower scopes reduce legal risk and simplify access controls and audits.

Align contractual security with operational controls

Confirm that the security measures described in the agreement are implemented and tested in practice, and document evidence of compliance.

Include clear breach procedures and timelines

State notification steps, responsible contacts, and required evidence; align timelines with HIPAA or state laws where applicable to avoid regulatory exposure.

Record execution and retention consistently

Store signed copies in a central repository, ensure tamper-evident audit logs, and enforce retention and destruction schedules to meet obligations.

Frequently asked questions about Data Use Terms

Answers to common questions help avoid mistakes during drafting, execution, and post-signature management.

Need help? Contact support

Can a Data Use Terms be signed electronically?
Yes. Electronic signatures meet ESIGN and UETA requirements where applicable (15 U.S.C. §7001; UETA). Ensure the signing method records intent, attribution, consent, and retention for evidentiary value.
When is a notary or witness required?
Notarization is uncommon for Data Use Terms, but certain state rules or specific contract forms may require it. Check state statutes if the agreement must be recorded or attached to real property.
How should I handle HIPAA-covered data?
If PHI is involved, include a Business Associate Addendum, require HIPAA-compliant safeguards, and specify breach notification consistent with HIPAA rules and 45 CFR provisions.
What if a counterparty refuses specific security terms?
Document the negotiation, seek compensating controls, and consider conditional access or escrow arrangements. Escalate unresolved gaps to legal counsel before granting access.
How long must signed Data Use Terms be retained?
Retention depends on the data type and applicable law. For PHI retain at least 6 years (45 CFR §164.530(j)). Financial record retention may follow IRS rules where relevant.
How can the agreement be revoked or amended?
Include termination and amendment clauses specifying notice, data return or destruction steps, and any continuing obligations post-termination to avoid confusion.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now