What kind of legal agreement do we have to solicit from user research participants prior to involving them in a user study? I'm specifically interested in diary studies, but I guess it's pretty much the same in all methods.
Caveat: I am not a lawyer, I am a user researcher. If you are concerned about what legal agreement is necessary before you conduct research, you should talk to a lawyer.
In general, most user research has a Non-Disclosure Agreement in place with the participant that states that the research participant will not discuss the research that they took part in with anyone else. This is done to protect your intellectual property. If you work for a company, you should have your legal counsel draw up a NDA (if they don't have one already).
If your research participants are professionals who will be completing the research representing their company (for example, if you were doing diary studies with medical professionals in a hospital), the individual might not be empowered to sign an NDA. It will probably need to go through their company's legal department. In this case, you will probably need to let your legal counsel talk to their legal counsel.
If you are dealing with participants in an enterprise environment, or healthcare, or any other research in which they could be revealing their own confidential information to you, you might also need to sign an NDA that you will not reveal anything confidential either. This is to protect the company's intellectual property, as well as deal with any privacy concerns either on the part of the individual who is participating in our research or any information that the individual has access to about others. To go back to my medical professional example, they will probably want to ensure that you don't reveal anything about their hospital's practices, as well as anything else that you could encounter during the course of your research. If you have to do this, you should talk to your legal counsel to ensure that the NDA is compatible with the research that you want to do.
In short, you should talk to a lawyer. If you work for a company, talk to your employer's lawyers. If you are an individual, you should talk to a lawyer that specializes in intellectual property law to ensure that your IP is protected and that you are not doing anything that could run you afoul of any relevant IP, privacy, or other laws.
I agree with nadyne's answer that you should consult with a lawyer regarding proprietary information regarding the organization and NDA.
However, I'd also add that users should sign a usability test consent form. This will be necessary if you are recording the session (audio and/or video). The form should include how the participant's data will be used, what the session will consist of and allowing the participant to end the session at any time. There are a couple of stock consent forms around the internet. I hope this helps!