Getting access: the Data Use Certification (DUC)

Getting access: the Data Use Certification (DUC)#

Last reviewed: October 2026. Official source: NBDC Data Access Process and NBDC FAQs.

To use ABCD data you need an approved Data Use Certification (DUC) from the NIH Brain Development Cohorts (NBDC) Data Hub. Access is free, but it takes paperwork, a signature from your institution, and a short training.

Note

Coming from the NDA? The NIMH Data Archive (NDA) stopped accepting new and renewal ABCD requests on June 2, 2025. An existing NDA DUC still covers release 5.1 and earlier until it expires. After that, you need a new NBDC DUC, and any data you downloaded under the NDA DUC must be deleted. Releases 6.0 and later are only on NBDC. (abcdstudy.org data sharing)

Who can apply?#

You need:

  • a research need for the data,

  • an affiliation with an NIH-recognized institution that has an active Federalwide Assurance (FWA),

  • approval from your institution’s Signing Official (SO). Not sure who that is? Ask your research/sponsored-programs office, or see eRA’s SO role description.

  • a computing environment that meets NIST SP 800-171 (or ISO/IEC 27001/27002) security requirements. Talk to your IT/security office. NBDC has announced a non-NIST workflow with compute-in-place in a secure NBDC environment. As of this review it was expected in Fall 2026, so check the abcdstudy.org data-sharing page for status.

International researchers are eligible if their institution has an active FWA (ABCD FAQ).

Individual vs. group DUCs (read this if you’re a trainee)#

Individual DUC

Investigator-led group DUC

Who

One researcher

A Lead PI plus named people at the same institution

Trainees

Not allowed

Trainees must be on a group DUC

Notes

Adding people requires the SO to re-sign; added members can’t download until the Lead PI has passed training

A person can be listed on only one DUC. If you’re a student or postdoc, your first step is to ask your PI whether the lab already has (or will create) a group DUC, and to be added to it.

Step by step#

Requests are made in the DUC module of the NBDC Data Access Platform.

  1. Sign in through RAS using your institutional email address. The applicant, all people listed on the DUC, and the SO must use emails from the same institution. Personal emails (e.g., Gmail) are generally blocked.

    Warning

    The system treats each email + login provider combination (e.g., Login.gov vs. ID.me) as a separate user. Always sign in the same way, or you may appear to “lose” your access. (NBDC FAQs)

  2. Form 1, Lead recipient information.

  3. Form 2, Research Data Use Statement (max 250 words). Describe the scientific purpose, the data domains you’ll use, how you’ll manage the data, and how you’ll delete it at the end. Tip: write it broadly enough to cover the projects you realistically plan this year, but concretely enough that a reviewer understands what you’ll do.

  4. Form 3, Security attestation. Confirm NIST SP 800-171 (or ISO 27001/27002) compliance.

  5. Form 4, Signing Official. Give the SO’s name and email. For group DUCs, list team members’ names and institutional emails here.

  6. DocuSign. You sign, then your SO signs and confirms NIST compliance.

  7. Review by the NBDC Data Access Committee (DAC). No official turnaround time is published, so build in buffer time before deadlines.

  8. Training. After approval you’ll get an email for the NBDC Responsible Data and Biospecimen Use Training. You must score ≥ 90% on the quiz (retakes allowed). The slides are available as a PDF (v1.2.0).

Once approved and trained, you can use DEAP, the Data Access Platform, the Sandbox, and Globus downloads (see Accessing the data).

Renewal, changes, and expiration#

  • Duration: one year from approval. Training must also be renewed yearly.

  • Renewal opens 3 months before expiration and requires a Progress Report listing your publications, presentations, and other outputs, so keep a running list as you go. Reminder emails come at 1 month, 1 week, and 3, 2, and 1 day(s) before expiration.

  • If it lapses before you submit a renewal, access is suspended and you must file a new request.

  • Changing institutions: DUCs don’t transfer. Email nbdc@mail.nih.gov and submit a new DUC at the new institution. A group DUC can name a replacement Lead PI.

  • When the project ends or the DUC expires (whichever comes first): permanently delete downloaded data (DUC §12).

Special cases#

  • American Indian/Alaska Native (AI/AN) data. If you will report results for AI/AN participants separately (in presentations, preprints, publications, website posts), you need an additional A-DUC. It’s requested after your main DUC and expires with it. Including AI/AN counts in a demographics table doesn’t require one. (NBDC FAQs)

  • Biospecimens are requested separately through the NBDC Biobank Portal.

  • HBCD. The NBDC DUC text covers the NIH Brain Development Cohorts, including both ABCD and HBCD.

  • Exploring before you’re approved. You can browse the data dictionary in DEAP and use the semantic search tool without a DUC.

Key rules from the DUC#

These are summarized from the General Group DUC v1.0.0. Read the full text yourself, because this is not legal advice and the DUC was under revision in 2026.

Rule

What it means in practice

DUC §

No redistribution

Don’t share raw or derived individual-level data with anyone not on your DUC, and don’t put ABCD data into large language models / generative AI tools (e.g., ChatGPT).

4

Collaborators

You may share with authorized users at your institution. Collaborators at other institutions need their own access and must use NBDC’s secure-sharing mechanism. You may display (not hand out) individual-level data for teaching.

5

No re-identification

Never attempt to identify or contact participants. Minimum cell size of 10 in all public reporting (papers, posters, talks).

6

Stigmatization

Don’t use the data to stigmatize individuals or groups.

8

Security

No shared accounts, no internet-exposed storage, encryption, patched software, NIST 800-171. Report breaches to NIH within 24 hours.

2, 11

Destruction

Delete downloaded data when research ends or the DUC expires. Storing data on the platform instead of downloading is encouraged.

12–13

Preregistration

Strongly encouraged (e.g., OSF) before analysis.

15

Publications

Register publications with NBDC once they have a DOI/PMID; share code (encouraged).

16

Acknowledgment

Cite the release DOI and use the acknowledgment statement. See Disseminating your work.

17

Also see NIH’s Security Best Practices for Users of Controlled-Access Data.

Contents