You must have a written agreement (contract) with the third party before you share any DU data. A technology review - in accordance with University Policy IT 13.10.040 - Technology Acquisition - is a pre-requisite step to contracting with a third party.
Following the completion of the technology review, you may initiate the contracting process as required by University Policy FINA 2.10.032 - Contract Management.
If you wish to share University Data in connection with research overseen by the Office of Research and Sponsored Programs you will need to coordinate with Office of Intellectual Property and Technology Transfer (OIPTT) to develop an approved Data Use Agreement.
Any written agreement for sharing University data must address data security, cyber liability insurance, applicable data protection laws (including, but not limited to FERPA, HIPAA, GDPR, and the CPA (Colorado Privacy Act).