# Data Transfer Agreement Template for Research (With Examples) By the end of this article you will be able to recognize when your project needs a data transfer agreement (DTA), fill out a working DTA template line by line, adapt a completed example to your own collaboration, and route the document through the right institutional office for signature. You will need three things on hand before you start: the name and address of both the sending and receiving institutions, a short written description of the dataset (what it contains, its format, and whether it identifies people), and the name of your institution's research office or technology transfer office, which almost always holds signature authority. ## What a Data Transfer Agreement Is and When You Need One ![Four-step decision path asking whether data crosses institutions, holds sensitive data, sits in a subaward, or is already covered by an agreement.](/article-images/illustrations/data-transfer-agreement-template-research-dta-triage.webp) A data transfer agreement is a written contract between two institutions that governs how one party sends research data to another. It defines what data may be shared, what the receiving party may do with it, who owns what, how confidentiality and security are handled, and when the data must be returned or destroyed. A material transfer agreement (MTA) is a related contract that covers physical research materials such as cell lines, reagents, or compounds. Many institutional templates handle both cases with small modifications, but you should name the agreement correctly at the start because the governing offices differ. The moment you need a DTA is easier to check than most researchers expect. Librarians and data services staff at medical centers have built institutional decision trees for exactly this purpose, and a widely shared example walks researchers through a sequence of questions to determine when a data transfer or use agreement is required before any dataset leaves or enters the institution [1]. The general logic of those decision trees works like this: 1. Is the data leaving your institution or entering it from another institution? If no, you probably need internal approvals only. 2. Does the dataset contain identifiable human information, protected health information, or restricted commercial data? If yes, a formal agreement is nearly always required. 3. Is the transfer part of a funded subaward with its own terms? If yes, ask whether the subaward already covers data sharing, because a separate DTA may be duplicative. 4. Does an existing agreement between the institutions already cover this dataset? If yes, request an amendment rather than a new agreement. If you answer yes to any of the first two questions and no to the last two, plan on drafting a DTA. Multi-institutional collaborations are now the default in many fields rather than the exception, and cross-disciplinary work introduces obstacles from diverse administrative structures, differences in expertise, and communication barriers that make informal data sharing risky [2]. A written agreement is the tool that converts those informal arrangements into something both offices can audit. ## Who Signs, Who Drafts, and Why It Is Never the Individual Scientist ![Five-step flow from investigator contacting the provider's research office through both offices signing and data being sent only after signatures.](/article-images/illustrations/data-transfer-agreement-template-research-signature-route.webp) A frequent point of confusion is signature authority. A DTA binds institutions, not individuals. The professor who wants the dataset cannot legally bind the university, and neither can a postdoc or lab manager. The document must be executed by an authorized institutional official, usually in the Office of Research, the Office of General Counsel, or the technology transfer office. The practical workflow looks like this: 1. The requesting investigator contacts the data provider's research office with a short description of the project and the data. 2. The provider's office sends its standard DTA template or accepts a negotiated version. 3. The investigator supplies the scientific details: dataset description, permitted uses, and the named personnel. 4. Both offices review, negotiate if needed, and sign. 5. Only after both signatures is the data actually sent. That last step is the one people skip. Sending the file before signature, even as a draft for review, can put the provider in breach of its own privacy obligations. Research integrity officers and journal editors who examined how institutions handle sensitive information converged on a related principle: confidential or sensitive data should not be disclosed unless there is a defined need to know [3]. A DTA is where the need to know gets written down, person by person. ## The Data Transfer Agreement Template (Research Format) The following free data transfer agreement template research template is a plain-language working format suitable for drafting. It is not legal advice, and your institution's template takes precedence wherever the two differ. Use it to prepare your position before the first negotiation call. ``` DATA TRANSFER AGREEMENT 1. PARTIES Provider: [Institution name], [address] Recipient: [Institution name], [address] 2. EFFECTIVE DATE AND TERM Effective: [date] Term ends: [date] or upon written termination by either party 3. DESCRIPTION OF DATA [Dataset title and short scientific description] Format: [for example, de-identified CSV, DICOM imaging files] Volume: [approximate size] Contains direct identifiers: [yes/no] Contains indirect identifiers or re-identification risk: [yes/no] 4. PERMITTED USE Recipient may use the data only for: [project title and specific aims] Recipient may NOT: identify individuals, attempt re-identification, sell the data, share it with third parties not named in Section 6, or use it for any purpose outside Section 4. 5. PUBLICATION AND REPORTING Recipient may publish results derived from the data. Provider shall be offered [acknowledgment / review of manuscript X days before submission / co-authorship per ICMJE criteria]. No restriction shall be placed on publication of the findings themselves except as required to protect privacy. 6. PERSONNEL AND ACCESS CONTROL Named recipients: [names and roles] Access limited to these individuals on a need-to-know basis. 7. SECURITY Data stored on [approved institutional system or server]. Any suspected breach reported to Provider within [X] hours. 8. INTELLECTUAL PROPERTY Data remain the property of Provider. Results and inventions developed by Recipient belong to Recipient, subject to rights in the underlying data. [State whether Provider retains any license to derived results.] 9. RETURN OR DESTRUCTION On termination, Recipient shall return or destroy all copies and certify destruction in writing within [X] days. 10. NO COMMERCIAL REDISTRIBUTION Recipient shall not distribute the data to any party not named in Section 6 without Provider's prior written consent. 11. COMPLIANCE Recipient shall comply with all applicable regulations, institutional policies, and IRB requirements. 12. GOVERNING LAW [State or country] 13. SIGNATURES Provider authorized official: ______ Date: ______ Recipient authorized official: ______ Date: ______ Investigator (non-binding, scientific contact): ______ ``` Each numbered clause corresponds to a negotiation point. The next section walks through filling it out with a realistic example. ## Data Transfer Agreement Template Research Example: A Filled-In Case Consider a concrete scenario. Dr. Reyes, an epidemiologist at a university school of public health, wants de-identified hospital discharge records from a regional health system to study readmission after heart failure. The health system's office of research sends its template, and Dr. Reyes prepares the scientific sections. Here is how the completed agreement reads, abbreviated to the clauses that change from project to project. ``` DATA TRANSFER AGREEMENT 1. PARTIES Provider: Lakeshore Regional Health System, 400 Medical Dr Recipient: State University School of Public Health, 21 Campus Rd 2. EFFECTIVE DATE AND TERM Effective: 2026-12-01 Term ends: 2028-11-30 or upon written termination 3. DESCRIPTION OF DATA De-identified inpatient discharge records, 2019-2025, for adult patients with principal diagnosis of heart failure. Format: CSV, one row per admission, ICD-10 coded. Volume: approximately 40,000 records. Contains direct identifiers: no (names, MRNs, dates removed, ages top-coded at 89). Contains indirect identifiers or re-identification risk: yes, admission and discharge dates and five-digit ZIP retained. 4. PERMITTED USE Recipient may use the data only for: "Predictors of 30-day readmission in heart failure," specific aims 1 and 2 of the approved IRB protocol. 6. PERSONNEL AND ACCESS CONTROL Named recipients: A. Reyes (PI), J. Okafor (analyst), M. Tran (graduate student). 7. SECURITY Data stored on the Recipient's institutional secure enclave. Suspected breach reported to Provider within 24 hours. 9. RETURN OR DESTRUCTION On termination, destroy all copies and certify in writing within 30 days. ``` Three clauses deserve special attention because they cause most of the delay. In Section 3, the acknowledgment that indirect identifiers exist (admission dates, ZIP codes, ages) is what allows the provider's privacy office to say yes. In Section 4, tying permitted use to a specific IRB protocol prevents scope creep. In Section 5, the publication clause is where scientists get hurt if they do not read carefully. A provider may request a 30 or 60 day manuscript review period, which is normal. A provider may not reasonably restrict your right to publish the findings. If a draft demands veto power over publication, send it back. ## Key Parameters Compared | Clause | Common option A | Common option B | What it changes | |--|--|--|--| | Permitted use | Single named project only | Broad research use | Whether a second paper or grant needs a new agreement | | Manuscript review | Acknowledgment only | 30 to 60 day review before submission | Timeline from analysis to submission | | Intellectual property | Recipient owns derived results | Provider retains license to derivatives | Whether derived datasets or models can be shared onward | | Duration | Fixed term, 1 to 3 years | Until purpose complete | Administrative renewal burden | | End of term | Destroy | Return or destroy at recipient's choice | Whether you must retain a certification of destruction | | Identifiers | Fully de-identified | Limited data set with dates and geography | Privacy office review depth and re-identification risk | ## A Numbered Walkthrough From Request to Signed Agreement 1. **Write a one-paragraph data description before contacting anyone.** Include format, record count, identifier status, and the scientific question. This paragraph becomes Section 3 and saves at least one round of email. 2. **Check for an existing agreement.** Many institutions already hold framework agreements with frequent partners. A quick email to your research office can turn a six-week negotiation into a one-week amendment. 3. **Send the request to the provider's research office, not to the individual scientist.** The scientist on the other end usually wants to share the data and is waiting for exactly this paperwork. Copying their office removes the bottleneck. 4. **Draft your permitted-use clause narrowly.** Name the project and the specific aims. If you later want to do a secondary analysis, an amendment is far cheaper than negotiating a broad clause up front, and a narrow clause is what makes the provider agree quickly. 5. **List personnel by name and role.** Research offices look for this. A clause saying "the study team" will be returned for revision. 6. **Route the draft through your own institutional system.** Multi-institutional project management platforms exist precisely to track these workflows, and one informatics platform described in the biomedical collaboration literature integrates a role-based workflow with domain experts and services to monitor the life cycle of a research project, tracking thousands of investigators and tasks [2]. If your institution has a similar request management system, submit the DTA through it so the signature request and the eventual data transfer are both auditable. 7. **Verify IRB coverage.** If the data concern human subjects, your IRB must have the transfer in its file. Some institutions require an IRB determination or reliance agreement before the research office will sign. Academic librarians who support research [data management](/blog/guides/data-management-basics-principles-processes-and-best-practices) describe institutional decision trees that pair the data transfer question directly with the IRB review question for secondary data analysis, because the two determinations are intertwined [1]. 8. **Store the signed agreement where the team can find it.** A shared institutional repository or project workspace is better than one person's inbox. 9. **Transfer the data only after both signatures exist**, using an approved secure channel rather than email attachments. 10. **Calendar the end date.** A DTA that expires quietly leaves you holding data with no governing document. ## Where Trust and Communication Fit In Contract language does the legal work, but the collaboration around it runs on trust, and trust has measurable components. A multi-institution study of community and academic research partnerships used concept mapping with community members, healthcare providers, and academics to define the determinants of trust in research partnerships. The analysis produced five clusters, including authentic, effective and transparent communication, mutually respectful and reciprocal relationships, sustainability, committed partnerships, and communication, credibility and methodology to anticipate and resolve problems [4]. Read against a DTA, those findings translate directly into drafting behavior. Explain the purpose of each clause you add rather than sending a redline silently. Tell the other side why you need a 60 day review period or why the personnel list cannot include a new hire without an addendum. Partnerships run better when guiding principles like transparency, trust, and proactiveness are applied across the life of the collaboration, a pattern documented across expert workshops on multi-actor research partnerships. International collaborations add another layer. An autoethnographic case study of a multiyear Vietnam beef cattle research project involving institutions in two countries found that success depended on long-term relationship building and trust, distributed and culturally sensitive leadership, and multi-level communication systems that crossed sociocultural, institutional, and relational boundaries [5]. For cross-border transfers, that means budgeting extra time for translation of the agreement, for local institutional sign-offs you did not anticipate, and for clarifying which country's law governs Section 12. ## Choosing Research Collaboration Tools for the Transfer Itself The agreement governs the data. The tooling governs the transfer and the record of what happened. Choose tools in three layers: - **Institutionally approved storage and transfer platforms.** Most research offices maintain a list. Librarians at medical centers have built matching tools that identify appropriate data transfer platforms for specific data characteristics and scenarios, because a platform suitable for genomic sequence files is not the right one for a small de-identified spreadsheet [1]. Use the institutional list first. Consumer file-sharing accounts rarely satisfy the security clause you just signed. - **Shared storage for multi-institutional teams.** For collaborations moving large volumes across campuses, purpose-built distributed infrastructure exists. The OSiRIS project, funded through a national science program, built distributed storage across multiple universities so researchers at each campus could read, write, manage, and share data directly from their own computing locations [6]. If your collaboration involves terabyte-scale data, ask your campus research computing group whether comparable infrastructure is available before agreeing to move copies around. - **Workflow and request tracking.** A request management system that logs investigators, tasks, and agreements keeps the paper trail consistent across institutions [2]. Even a simple shared tracker with dates for request sent, draft received, legal review complete, and signed beats email archaeology. When data must be comparable across sites, standardize the variables before the transfer, not after. A consensus-driven process used to build a trauma research repository assembled a multidisciplinary workgroup that reviewed established data elements and ran a three-round Delphi survey with an 80 percent agreement threshold before adding elements to a shared data dictionary [7]. Adopting common data elements across sites in advance reduces the harmonization work that would otherwise consume the first months of analysis. ## Common Mistakes and Limitations **Sending data before signature.** The most common and most consequential error. The provider's privacy obligations usually attach at disclosure, not at signature. If you must share a sample for discussion, send the codebook, not the data. **Confusing a DTA with an MTA or a subaward.** A subaward governs money and effort. It sometimes covers data sharing, but often does not. Ask the grants office directly rather than assuming either way. **Drafting a broad permitted-use clause.** A clause allowing "research purposes" invites months of legal review on the provider side. A narrow clause tied to a named project and IRB protocol moves faster. **Omitting the personnel list.** Agreements get returned for this constantly. Name every individual with access and their role. **Treating de-identification as binary.** Records stripped of names can still carry re-identification risk through dates, geography, and rare diagnoses. State in Section 3 which indirect identifiers remain so the provider's privacy office can make its own determination. **Ignoring the end-of-term clause.** Destruction certifications are real documents. If Section 9 requires one, calendar the deadline and produce the certificate. **Assuming the same template fits every partner.** A community organization, a foreign university, and a pharmaceutical company need different terms. Each negotiation is its own relationship. Reviews of methodological practice in multi-institutional research emphasize that administrative structures differ enough that mechanisms must be established deliberately for each collaboration rather than copied [8], and early work on multi-institution clinical studies described the work of establishing shared mechanisms as a project in itself [9]. **A limitation on this article.** This guide explains the standard structure and workflow of data transfer agreements. It is not legal advice, it does not substitute for your institution's own template, and any individual agreement, particularly one involving identifiable human data or cross-border transfer, needs review by your institutional research office or counsel. ## Frequently Asked Questions ### What is a data transfer agreement in research? A data transfer agreement is a contract between two institutions that sets the terms under which one sends research data to the other, covering permitted use, confidentiality, security, intellectual property, publication, and return or destruction of the data. ### When does my project need a DTA instead of just emailing a file? You need a DTA whenever data crosses institutional boundaries and contains identifiable human information, protected health information, or restricted commercial or proprietary data, or whenever either institution's policy requires a written agreement for external data sharing. ### Who is allowed to sign a data transfer agreement? Only an authorized institutional official, typically in the research office, general counsel's office, or technology transfer office. The individual investigator serves as the scientific contact but cannot bind the institution. ### Is a DTA the same as a material transfer agreement? No. An MTA covers physical research materials such as cell lines, antibodies, or compounds, while a DTA covers data. Some institutions use one combined template, but the governing rules and review paths often differ. ### Can I publish papers using data I received under a DTA? Usually yes, and most agreements explicitly permit publication of findings. Read the publication clause carefully because providers commonly ask for a review period before submission or for acknowledgment language, but they cannot reasonably block publication of the results themselves. ### What should the permitted use clause say? It should name the specific project, the specific aims, and where applicable the approved IRB protocol. A narrow clause speeds negotiation and keeps the agreement aligned with what your IRB actually approved. ### What happens to the data when the agreement ends? Section 9 of the template controls this. Most agreements require the recipient to return the data, destroy all copies, or both, and to certify destruction in writing within a set number of days. ### Do I need a new DTA for every dataset from the same partner? Not necessarily. Many institutions hold framework agreements or can amend an existing DTA for a new dataset from the same partner, which is faster than negotiating from scratch. Ask your research office to check for an existing agreement before starting a new one. ## Sources 1. [Academic librarians as navigators of institutional data policies: developing resources to facilitate compliant research data management.](https://pubmed.ncbi.nlm.nih.gov/42889530/) 2. [RMS: a platform for managing cross-disciplinary and multi-institutional research project collaboration](https://pubmed.ncbi.nlm.nih.gov/25433526/) 3. [Enhancing Partnerships of Institutions and Journals to Address Concerns About Research Misconduct: Recommendations From a Working Group of Institutional Research Integrity Officers and Journal Editors and Publishers.](https://pubmed.ncbi.nlm.nih.gov/37378978/) 4. [Conceptualizing trust in community-academic research partnerships using concept mapping approach: a multi-CTSA study](https://pubmed.ncbi.nlm.nih.gov/29053983/) 5. [International research partnerships and cross-cultural project management: a Vietnamese beef cattle agribusiness autoethnographic case study](https://doi.org/10.3389/fsufs.2026.1918085) 6. [OSiRIS: a distributed Ceph deployment using software defined networking for multi-institutional research](https://doi.org/10.1088/1742-6596/898/6/062045) 7. [Adopting common data elements (CDEs) for the National Trauma Research Repository (NTRR): the results of a social determinants of health Delphi survey.](https://pubmed.ncbi.nlm.nih.gov/42404533/) 8. [Methodological Challenges in Multi-Investigator Multi-Institutional Research in Higher Education](https://doi.org/10.1007/S10734-006-9007-7) 9. [Establishing mechanisms to conduct multi-institutional research--fatigue in patients with cancer: an exercise intervention.](https://pubmed.ncbi.nlm.nih.gov/9766292/)