# Data Sharing Agreement Template for International Research ## Quick Answer - Use a data sharing agreement template that names the data owner, the recipient, the permitted uses, and the security controls before any transfer begins. - Build clauses that address jurisdiction, including which country's law governs the agreement and how disputes will be resolved. - A template cannot replace legal review, because international data transfers may trigger national privacy laws that vary by country. ## Understanding International Research Data Sharing International research collaborations depend on the movement of data across borders. A data sharing agreement is the document that defines the terms of that movement. It records who owns the data, who may use it, for what purposes, under what security measures, and for how long. Without such an agreement, researchers risk disputes over authorship, misuse of data, privacy violations, and loss of control over their own research outputs. The need for a formal agreement grows when data crosses national boundaries. Different countries have different legal frameworks for privacy, intellectual property, and research ethics. A template that works for a domestic collaboration may fail to address the legal requirements of another country. Researchers who rely on informal email exchanges or verbal understandings expose themselves and their institutions to significant risk. This article provides a practical template structure for international research data sharing. It explains the clauses that matter, the decisions researchers must make, and the limitations of any template. The guidance draws on established research integrity principles and official data management policies, but it does not replace the advice of a qualified attorney. ## Core Principles of Data Sharing Agreements ### Data Ownership and Control The first question any data sharing agreement must answer is who owns the data. Ownership is not always straightforward in research. Data may be generated by multiple investigators, funded by multiple agencies, or derived from human participants who retain certain rights over their information. The agreement should define ownership in clear terms. It should state whether the data is owned by a single institution, shared jointly, or licensed to the recipient. It should also address what happens to the data when the collaboration ends. Some agreements require the recipient to return or destroy the data after a specified period. Control is related to but distinct from ownership. A researcher may own data but grant another party the right to use it for a specific purpose. The agreement must distinguish between the owner of the data and the parties who have permission to access it. This distinction matters for publication, secondary analysis, and future research projects. ### Permitted Uses and Restrictions A data sharing agreement must specify what the recipient may do with the data. Permitted uses might include analysis for a named research project, validation of published findings, or teaching purposes. Restrictions might prohibit commercial use, transfer to third parties, or use beyond the stated research scope. The level of detail matters. A vague clause that permits "research use" leaves room for interpretation and dispute. A precise clause that names the project, the research question, and the expected outputs reduces ambiguity. The agreement should also address whether the recipient may create derivative datasets and who owns those derivatives. ### Security and Confidentiality International data transfers raise security concerns because data may pass through jurisdictions with different legal protections. The agreement should specify the security measures the recipient must maintain. These might include encryption, access controls, secure storage, and breach notification procedures. Confidentiality clauses protect data that is not publicly available. They should define what constitutes confidential information, how it must be handled, and what happens if a breach occurs. The agreement should also address the obligations of the recipient's staff and any subcontractors who may access the data. ### Ethical Use and Human Subject Protections Research involving human participants carries additional obligations. The agreement should confirm that the data was collected with appropriate informed consent and that the recipient's use complies with the original consent terms. It should also address whether the recipient needs approval from their own institutional review board or ethics committee. The [NIH Data Management and Sharing Policy](https://sharing.nih.gov/data-management-and-sharing-policy) describes expectations for managing and sharing research data funded by the National Institutes of Health. Researchers who receive NIH funding must plan for data sharing and describe their approach in a data management plan. An international data sharing agreement should align with these expectations when the research is NIH-funded. ## The International Dimension ### Jurisdiction and Governing Law The most complex aspect of international data sharing is determining which country's law applies. The agreement should specify the governing law and the forum for resolving disputes. This clause is often negotiated carefully because each party prefers their own legal system. Governing law clauses are not always enforceable. A court may refuse to apply a chosen law if it conflicts with fundamental public policy or mandatory provisions of local law. Researchers should understand that a governing law clause provides certainty but does not guarantee that a foreign court will honor it. ### Data Protection and Privacy Regulations Many countries have enacted data protection laws that regulate the transfer of personal data across borders. The European Union's General Data Protection Regulation is one example, but it is not the only one. Other countries have their own privacy frameworks with different requirements. A data sharing agreement for international research should acknowledge these regulations and include clauses that address them. The agreement might require the recipient to comply with the data protection laws of the country where the data originated. It might also require the parties to implement appropriate safeguards for cross-border transfers. The [National Library of Medicine's Research Methods Resources](https://www.ncbi.nlm.nih.gov/books) provide access to authoritative references on research methods, including considerations for handling research data. Researchers should consult these resources to understand the methodological and ethical dimensions of their data sharing arrangements. ### Institutional Requirements Many research institutions have their own policies governing data sharing. These policies may require institutional review, approval by a data governance committee, or execution of a specific agreement form. Researchers should check with their institution's research office before signing any data sharing agreement. Institutional requirements may also come from funders. The [NIH Grants and Funding](https://grants.nih.gov/) pages describe the expectations for grant applicants and awardees, including requirements related to data sharing and research conduct. A data sharing agreement that conflicts with funder requirements may jeopardize funding or create compliance problems. ## Template Structure for an International Data Sharing Agreement ### Preamble and Parties The agreement should begin by identifying the parties. This includes the full legal names of the institutions or individuals, their addresses, and their roles in the collaboration. The preamble should describe the research context and the purpose of the data sharing arrangement. The parties section should also identify the authorized representatives who may sign the agreement. In international collaborations, the parties may be located in different time zones and operate under different institutional structures. Clear identification of the parties reduces confusion about who is bound by the agreement. ### Definitions A definitions section is essential for international agreements because terms may have different meanings in different legal systems. The agreement should define key terms such as "data," "personal data," "confidential information," "derivative data," and "research purpose." Definitions should be precise and should reflect the actual use of the data. A definition of "data" that is too broad may capture information the parties did not intend to share. A definition that is too narrow may exclude important information from the agreement's protections. ### Data Description and Transfer Mechanism The agreement should describe the data to be shared with enough specificity that there is no doubt about what is covered. This description might include the dataset name, the variables or fields, the format, the date of transfer, and any associated documentation. The transfer mechanism should also be specified. Will the data be transferred by secure file transfer, physical media, or a shared repository? The agreement should address how the data will be transmitted and what security measures apply during transmission. ### Permitted Uses This clause should state the specific purposes for which the recipient may use the data. It should be drafted narrowly enough to prevent misuse but broadly enough to allow the research to proceed. The clause might include the research question, the methodology, and the expected outputs. The permitted uses clause should also address whether the recipient may share the data with collaborators or subcontractors. If sharing is permitted, the agreement should require the recipient to ensure that those parties comply with the same terms. ### Prohibited Uses A prohibited uses clause is the mirror image of the permitted uses clause. It should state what the recipient may not do with the data. Common prohibitions include commercial use, re-identification of individuals, transfer to third parties without consent, and use beyond the stated research purpose. The prohibited uses clause should also address attempts to circumvent the agreement's protections. For example, the recipient should not be permitted to combine the data with other datasets in a way that could identify individuals. ### Security Requirements The security clause should specify the technical and organizational measures the recipient must maintain. These might include encryption at rest and in transit, access controls based on the principle of least privilege, audit logging, and physical security for any storage media. The agreement should also address breach notification. If the recipient experiences a security incident that affects the data, they should be required to notify the data owner promptly. The notification should include a description of the incident, the data affected, and the steps taken to mitigate the harm. ### Confidentiality The confidentiality clause should protect information that is not publicly available. It should define what constitutes confidential information, how it must be handled, and the duration of the confidentiality obligation. The clause should also address exceptions to confidentiality. Information that is already public, independently developed, or received from a third party without restriction may not be subject to the confidentiality obligation. These exceptions should be stated explicitly to avoid disputes. ### Intellectual Property The intellectual property clause should address ownership of the data and any results derived from it. This includes publications, patents, software, and other outputs. The agreement should state whether the recipient obtains any intellectual property rights in the data or whether those rights remain with the owner. The clause should also address rights to publish. Researchers need to publish their findings, but the data owner may want to review publications before they are submitted. The agreement might include a review period during which the data owner can comment on proposed publications. ### Publication and Authorship Publication and authorship are common sources of conflict in international collaborations. The agreement should address how publications will be handled, who will be listed as authors, and in what order. It should also address how disputes about authorship will be resolved. The [Committee on Publication Ethics Core Practices](https://publicationethics.org/core-practices) describe expectations for authorship, peer review, and publication ethics. Researchers should align their data sharing agreements with these practices to ensure that publications meet ethical standards. ### Duration and Termination The agreement should specify how long it remains in effect. It might continue for the duration of the research project, for a fixed term, or until the data is destroyed. The clause should also address how either party may terminate the agreement and what happens to the data upon termination. Termination clauses should address the recipient's obligations after the agreement ends. The recipient may be required to return or destroy the data, to confirm destruction in writing, and to ensure that any copies held by subcontractors are also destroyed. ### Dispute Resolution International agreements should include a dispute resolution clause. This clause might require the parties to attempt mediation or negotiation before pursuing formal legal action. It should also specify the forum for resolving disputes, such as a particular court or an arbitration tribunal. The dispute resolution clause should be realistic about the costs and practicalities of international litigation. Arbitration may be more practical than litigation in a foreign court, but it is also expensive. The parties should consider their resources and the value of the data when choosing a dispute resolution mechanism. ### Miscellaneous Provisions Standard boilerplate clauses should not be overlooked. These include provisions on amendments, waivers, notices, assignment, and severability. The agreement should also address whether it may be executed in counterparts and whether electronic signatures are acceptable. The miscellaneous section should also address the relationship between the parties. The agreement should state that the parties are independent and that nothing in the agreement creates a partnership, joint venture, or employment relationship. ## At a Glance | Clause | Purpose | Key Decision | | --- | --- | --- | | Data Ownership | Defines who holds legal rights to the data | Single owner, joint ownership, or license arrangement | | Permitted Uses | States what the recipient may do with the data | Narrow project-specific uses or broader research uses | | Security Requirements | Specifies protections for the data | Encryption, access controls, and breach notification | | Governing Law | Determines which country's law applies | Choice of law and dispute resolution forum | | Publication Rights | Addresses who may publish and in what order | Review periods and authorship criteria | | Duration and Termination | Sets the agreement's lifespan | Fixed term, project duration, or ongoing until data destruction | ## Practical Implementation Steps ### Step 1: Identify the Data and Its Sensitivity Before drafting an agreement, researchers should classify the data they plan to share. Is the data de-identified? Does it include personal information? Does it include proprietary or confidential information? The answers to these questions determine the clauses that are needed. Researchers should also consider whether the data is subject to any legal or regulatory requirements. Human subject data may be subject to privacy laws. Genomic data may be subject to special regulations. The agreement should reflect these requirements. ### Step 2: Determine the Legal and Ethical Framework Researchers should identify the laws that apply to the data in each jurisdiction. This includes the law of the country where the data was collected, the law of the country where the recipient is located, and any international agreements that may apply. The ethical framework is equally important. Researchers should consult the [EQUATOR Network](https://www.equator-network.org/) to identify reporting guidelines that apply to their research. Transparent reporting of data sharing arrangements is part of responsible research conduct. ### Step 3: Draft the Agreement Using the Template Using the template structure provided in this article, researchers should draft an agreement that reflects their specific circumstances. The template is a starting point, not a final document. Each clause should be reviewed and adjusted to fit the research project. The draft should be reviewed by all parties before it is finalized. Each party should have the opportunity to comment on the terms and to propose changes. The negotiation process is an opportunity to identify and resolve potential conflicts before they arise. ### Step 4: Obtain Institutional and Legal Review Most research institutions require review of data sharing agreements before they are executed. The review may be conducted by the research office, the legal department, or both. Researchers should submit the draft agreement for review well in advance of the planned data transfer. Legal review is particularly important for international agreements. An attorney with experience in cross-border data transfers can identify issues that a researcher might miss. The cost of legal review is small compared to the cost of a dispute. ### Step 5: Execute and Implement the Agreement Once the agreement is finalized, it should be signed by authorized representatives of all parties. The signed agreement should be stored in a secure location and made available to all researchers who need to reference it. Implementation is the final step. The parties should ensure that the security measures described in the agreement are actually in place. They should also establish procedures for monitoring compliance and for responding to any incidents. ## Records and Measurements ### What to Document Researchers should maintain records of all data transfers. This includes the date of transfer, the method of transfer, the data files transferred, and the individuals who received access. These records provide evidence of compliance with the agreement and support audits or investigations. The agreement itself should be documented in the research records. Researchers should also document any amendments, waivers, or other changes to the agreement. This documentation should be maintained for the duration of the agreement and for a reasonable period afterward. ### How to Measure Compliance Compliance with a data sharing agreement can be measured through regular reviews. The parties should periodically confirm that the recipient is using the data only for permitted purposes and that security measures remain in place. The [ORCID for Researchers](https://info.orcid.org/researchers) pages describe how researchers can maintain their professional records and link their research outputs to their identity. Linking data sharing agreements and related publications to researcher profiles supports transparency and accountability. ## Common Failure Patterns ### Vague Language The most common failure in data sharing agreements is vague language. Terms like "reasonable efforts," "appropriate security," and "research purposes" are open to interpretation. When a dispute arises, each party may have a different understanding of what these terms mean. The solution is to be specific. Define the security measures, name the research purposes, and describe the data with precision. The agreement should be detailed enough that a third party could read it and understand the parties' obligations. ### Missing Jurisdiction Clause International agreements that fail to address jurisdiction are difficult to enforce. If a dispute arises, the parties may spend significant time and money litigating where the case should be heard. A jurisdiction clause provides clarity and reduces this risk. The jurisdiction clause should be realistic. A clause that requires disputes to be heard in a country with no connection to the parties or the data may not be enforceable. The parties should choose a forum that is practical and accessible. ### Inadequate Security Provisions Security provisions that are too general may not provide meaningful protection. A clause that requires "appropriate security" without specifying what that means gives the recipient little guidance and the data owner little recourse. The security clause should be specific about the measures required. It should also address how security will be verified and what happens if a breach occurs. The parties should agree on these details before the data is transferred. ### Failure to Address Termination Agreements that do not address termination leave the parties in an uncertain position. If the collaboration ends, the recipient may retain the data indefinitely. The data owner may have no way to compel the return or destruction of the data. The termination clause should be clear about the recipient's obligations. It should specify the timeline for return or destruction and the consequences of failure to comply. The clause should also address what happens to derivative data created by the recipient. ## Limitations of a Template ### Legal Review Is Required A template is a starting point, not a substitute for legal advice. The laws governing international data transfers are complex and change frequently. A template cannot account for the specific legal requirements of every jurisdiction. Researchers should obtain legal review before executing any data sharing agreement. The cost of legal review is justified by the potential consequences of an inadequate agreement. An attorney can identify issues that a template does not address and can draft clauses that comply with applicable law. ### Institutional Policies May Differ Institutional policies on data sharing vary widely. Some institutions have standard agreement forms that must be used. Others require review by specific committees. Researchers should consult their institution's research office before drafting an agreement. The template in this article may not comply with a particular institution's requirements. Researchers should adapt the template to their institution's policies and should not assume that a template is acceptable without review. ### Ethical Considerations Extend Beyond the Agreement A data sharing agreement addresses legal and practical issues, but it does not address all ethical considerations. Researchers have ethical obligations to research participants, to the scientific community, and to the public. These obligations may extend beyond what is written in an agreement. The [Committee on Publication Ethics Core Practices](https://publicationethics.org/core-practices) describe expectations for ethical conduct in research and publication. Researchers should consider these expectations when designing their data sharing arrangements, even when they are not legally required. ## Welfare and Safety Context ### Protecting Research Participants International data sharing can affect the welfare of research participants. If data is transferred to a jurisdiction with weaker privacy protections, participants may be at risk of harm. The agreement should include safeguards that protect participants regardless of where the data is processed. The agreement should also address the risk of re-identification. Even de-identified data can sometimes be combined with other data to identify individuals. The agreement should prohibit attempts to re-identify participants and should require the recipient to use appropriate technical measures to prevent re-identification. ### Protecting Researchers Researchers also have interests that should be protected. The agreement should protect the data owner's ability to publish, to pursue future research, and to control the use of their data. It should also protect the recipient's ability to conduct the research without unreasonable restrictions. The agreement should be fair to both parties. A one-sided agreement that heavily favors the data owner may discourage collaboration. A one-sided agreement that favors the recipient may expose the data owner to unacceptable risks. ## Professional Escalation Criteria Researchers should escalate data sharing issues to institutional authorities in specific circumstances. These include situations where the data involves sensitive information, where the recipient refuses to comply with the agreement, or where a breach has occurred. The [NIH Grants and Funding](https://grants.nih.gov/) pages describe the responsibilities of funded researchers and the consequences of noncompliance. Researchers who receive NIH funding should be aware that data sharing failures may have implications for their grants. Researchers should also escalate issues when they are uncertain about the legal or ethical requirements. An institutional research office, legal department, or ethics committee can provide guidance. It is better to ask for help than to proceed with an inadequate agreement. ## Frequently Asked Questions ### What is the difference between a data sharing agreement and a material transfer agreement? A data sharing agreement governs the transfer of data, while a material transfer agreement governs the transfer of physical research materials such as cell lines, reagents, or biological samples. Some agreements combine both types of transfers, but they address different types of resources. ### Do I need a data sharing agreement for publicly available data? Publicly available data may not require a data sharing agreement because there is no restriction on access or use. However, researchers should check the terms of the public repository or database. Some public data sources have their own use restrictions that must be respected. ### Can I use a template from one country for a collaboration in another country? A template from one country may not comply with the legal requirements of another country. Data protection laws, intellectual property laws, and research regulations vary by jurisdiction. The template should be reviewed and adapted to the specific countries involved in the collaboration. ### What should I do if the recipient refuses to sign the agreement? If the recipient refuses to sign a data sharing agreement, the data owner should not transfer the data. The refusal may indicate that the recipient does not intend to comply with the terms. The parties should discuss the reasons for the refusal and attempt to reach an agreement on acceptable terms. ### How long should I keep records of data transfers? Records of data transfers should be kept for the duration of the agreement and for a reasonable period afterward. The retention period may be specified by institutional policy or by law. Researchers should consult their institution's records retention policy for guidance. ### What happens if a data breach occurs? If a data breach occurs, the recipient should notify the data owner promptly. The notification should describe the incident, the data affected, and the steps taken to mitigate the harm. The parties should also consider whether the breach triggers any legal notification requirements. ### Can a data sharing agreement be amended after it is signed? A data sharing agreement can be amended if all parties agree to the amendment. The amendment should be in writing and signed by authorized representatives of all parties. Oral amendments are generally not enforceable and should be avoided. ### Who should sign the data sharing agreement? The agreement should be signed by authorized representatives of each party. For institutional agreements, this may be a research administrator, a legal officer, or another designated individual. Individual researchers should not sign on behalf of their institution unless they have authority to do so. ## Using the Evidence | Source | Best use in this topic | Important limitation | |---|---|---| | [Research Methods Resources](https://www.ncbi.nlm.nih.gov/books) | official guidance | Check the linked page for current local requirements | | [EQUATOR Network](https://www.equator-network.org/) | official guidance | Check the linked page for current local requirements | | [Core Practices](https://publicationethics.org/core-practices) | official guidance | Check the linked page for current local requirements | ## Related Articles - [Data Management Plan Template: A Practical Guide for Researchers](/blog/guides/data-management-plan-template-a-practical-guide-for-researchers) - [The Role of the Research Ethics Committee: What Researchers Need to Know](/blog/guides/the-role-of-the-research-ethics-committee-what-researchers-need-to-know) - [Research Collaboration Agreements: Aligning Roles, Data, and Authorship Early](/blog/miscellaneous/research-collaboration-agreements-aligning-roles-data-and-authorship-early) - [Research Ethics in Data-Intensive Biology: Questions to Ask Before Sharing](/blog/miscellaneous/research-ethics-in-data-intensive-biology-questions-to-ask-before-sharing) - [Data Visualization for Biological Research: Choosing Figures That Preserve Meaning](/blog/guides/data-visualization-for-biological-research-choosing-figures-that-preserve-meanin) ## References and Further Reading - [Research Methods Resources](https://www.ncbi.nlm.nih.gov/books). National Library of Medicine. - [EQUATOR Network](https://www.equator-network.org/). EQUATOR Network. - [Core Practices](https://publicationethics.org/core-practices). Committee on Publication Ethics. - [NIH Grants and Funding](https://grants.nih.gov/). National Institutes of Health. - [ORCID for Researchers](https://info.orcid.org/researchers). ORCID. - [Data Management and Sharing Policy](https://sharing.nih.gov/data-management-and-sharing-policy). National Institutes of Health. - [NCBI Literature Resources](https://www.ncbi.nlm.nih.gov/). National Center for Biotechnology Information. - [PubMed](https://pubmed.ncbi.nlm.nih.gov/). National Library of Medicine. > This article is educational and does not replace institutional policy, professional advice, or applicable safety and regulatory requirements.