A good deal of the most useful data is not a download link. The access routes are well established and more open to industry than people assume — they just take time you should start spending early.
The four levels of gate
Worth distinguishing, because the effort differs by orders of magnitude and so does what you are agreeing to.
| Gate | What it involves | Typical time | What you agree to |
|---|---|---|---|
| Click-through | accept terms, maybe log in | minutes | the stated licence, often redistribution limits |
| Request form | state who you are and your purpose | days | the stated purpose, which constrains later reuse |
| Credentialed | training course plus a signed DUA | days to weeks | a real contract with named obligations |
| Institutional | ethics approval and a negotiated agreement | weeks to months | a bespoke contract, often site-specific |
Credentialed access is more accessible than it looks
Several of the richest clinical and behavioural repositories use this model: complete a recognised human-subjects research training course, then sign a data use agreement.
The training is a genuine course of a few hours covering research ethics and participant protection, and the certificate is reusable across repositories. Many people assume it is restricted to academics; frequently it is not, and industry researchers are accepted with an appropriate affiliation and stated purpose.
What you sign up to in the agreement typically includes: not attempting re-identification, not redistributing the data, limiting access to named individuals, using it only for the stated purpose, and sometimes citation and publication requirements. These are real obligations with real consequences for breach. Depending on the repository they bind you personally, your organisation, or both — PhysioNet's credentialed agreement, for example, is signed by the individual, who undertakes not to share access with anyone else — which is why the next section matters.
Read what the agreement constrains downstream
The clauses that catch people are not about access but about what happens after.
Redistribution. Almost always prohibited. This includes putting the data in a public bucket, a shared drive accessible beyond named users, or a container image you publish — the last one is a genuinely common accident.
Derived outputs. Some agreements address whether models trained on the data may be released, and on what terms. This is the clause to read most carefully if you intend to ship something, and it is often the one nobody checks before training.
Named users. Access may be limited to individuals listed in the agreement, which has implications for how you store the data internally and what happens when someone leaves.
Purpose. If you stated a research purpose and later build a product, that may be outside the agreement. Describe your actual intended use when you apply — a broader stated purpose approved up front is far easier than a renegotiation later.
This is also the answer to a question people ask about Dataset Finder: a dataset being listed and being downloadable are different things, and the licence field tells you which.
When a request is likely to be declined
Honest guidance, because a declined request costs weeks.
Vague purposes get declined. “Machine learning research” is not a purpose; “training a segmentation model to measure lesion volume in multiple sclerosis” is. Specificity reads as competence and makes the reviewer's job possible.
Mismatched scope gets declined. Asking for a full clinical repository to prototype a demo is a poor trade for the data holder, and they know it.
No institutional backing is the common blocker for the heavier gates. A named organisation that can be held to an agreement is usually required — an individual with no affiliation has difficulty at the credentialed and institutional levels.
And unanswered questions about data handling get declined. Be ready to say where the data will live, who will access it, how it is secured, and when it will be deleted. Having those answers written down before you apply is most of the application.
Questions people ask
Can a company get credentialed access?
Frequently yes, with an appropriate affiliation and a clear stated purpose. The requirement is usually an accountable organisation and a signed agreement rather than academic status specifically. Check each repository's policy rather than assuming exclusion.
What if I lose access later?
Agreements can be time-limited or revocable, and many require deletion at the end of the stated purpose. Plan for it: keep your derived artefacts and documentation separate from the raw data, so that losing access does not cost you your ability to explain what you built.
Can I publish a model trained on gated data?
It depends on the agreement, and this is the clause to read before training rather than before release. Some address derived works explicitly; some are silent, in which case ask the data holder rather than assuming.
Is it worth the effort versus using open data?
If the gated data is substantially better for your task, yes — the paperwork is a few hours and the waiting parallelises with other work. If an open dataset would do, use it: fewer obligations, no renewal, no deletion deadline, and nothing to explain to a reviewer.