Data and Data Use Agreements (DUA)

Preface

Before any data which is considered confidential, proprietary, or otherwise considered sensitive can be stored on the FASRC cluster, it must be properly classified and any data use agreements must be in place and available.

The project PI is responsible for ensuring that any future approved access is compliant with any DUA or data use other agreement, including updating the data provider before approving access, if required.

Human or Animal Data

If you are collecting or using data from humans or animals, you should contact Harvard’s Institutional Review Board (IRB) and/or Institutional Animal Care and Use Committee (IACUC) first.

Any data of this type which does not have an IRB determination cannot be transferred to the FASRC cluster until that process is complete. 

• LEVEL 3/DSL3: Please note that only the FASRC FASSE Secure environment is rated for Level 3/DSL3. The main cluster is rated only for Level 2 or below.
• LEVEL 4/DSL4: If you require a Level 4 environment, you can contact FASRC to discuss your project, but please be aware that FASRC does not currently provide a Level 4 secure environment. The FASRC cluster, including FASSE, is not suitable for DSL4 projects.

Where to start: HRDSP: Harvard Research Data Security Policy site HRDSP: Applications Summary and Order of Reviews See also: Committee on the Use of Human Subjects – Investigator Manual: https://cuhs.harvard.edu/you-begin-prepare-your-irb-application Office of Regulatory Affairs and Research Compliance – Investigator Manual: https://www.hsph.harvard.edu/regulatory-affairs-and-research-compliance/investigator-manual/

Data Use Agreements (DUA)

Many data sets require a Data Use Agreement which must be on file at Harvard and adhere to the requirements and duration of that agreement. This should be completed prior to transferring any such data to the FASRC cluster.

“The transfer of data between organizations is common in the research community. When the data is confidential, proprietary, or otherwise considered sensitive, the organization providing the data (“Provider”) will often require that the organization receiving the data (“Recipient”) enter into a written contract to outline the terms and conditions of the data transfer. Such a contract is usually referred to as a Data Use Agreement (DUA), although it may also be referred to as a License Agreement, Confidentiality Agreement, Non-Disclosure Agreement, Memorandum of Understanding, Memorandum of Agreement, or other names if these agreements include data sharing or data transfer requirements.” – Source

To submit, manage, and review DUA requests, you will use Harvard’s DUA Agreements System

Where to start:
HRDSP: Harvard Research Data Security Policy site
HRDSP: Applications Summary and Order of Reviews

• Harvard Biomedical Research Data Management
• Office of the Vice Provost for Research – DUA page
• Harvard Research Data Security Policy (HRDSP)
• HRDSP Order of Review Documentation
• Data Use Agreement Guidance
• Harvard DUA Policy
• Agreements-DUA Submission Guide
• FASRC FASSE Secure Environment