Data Sharing Agreement Template

In plain language: Identifies the data disclosing party and the data receiving party by their full legal names, states the commercial context for the agreement, and defines key terms used throughout.

Common mistake: Using trade names instead of registered legal entity names. If an enforcement action becomes necessary, proceedings against the wrong entity name create jurisdictional problems that delay or defeat the claim.

In plain language: Specifies exactly which data sets, categories, fields, or data types are covered — including format, volume, and the technical method of transfer.

Common mistake: Describing data too broadly with phrases like 'all customer data.' Overly broad scope exposes the discloser to liability for data the recipient never needed and creates disproportionate security obligations on both sides.

In plain language: States the specific purposes for which the recipient may use the data and explicitly prohibits all other uses, including sale, re-identification, and profiling.

Common mistake: Listing permitted purposes at a high level of abstraction — e.g., 'research and analytics' — without defining what falls inside or outside those categories. Disputes almost always arise at the boundary of a vaguely drafted purpose clause.

In plain language: Requires the recipient to implement and maintain specific security controls proportionate to the sensitivity of the data, and to document those controls on request.

Common mistake: Requiring 'industry-standard security' without specifying what that means. Vague security obligations are unenforceable and leave the discloser unable to audit compliance or establish a breach of contract.

In plain language: Prohibits the recipient from passing the data to any third party without written consent, and — if sub-processors are permitted — requires them to be bound by equivalent obligations.

Common mistake: Allowing onward transfer to 'affiliates' without defining the term or requiring the affiliate to be bound by equivalent data obligations — creating an uncontrolled chain of data access.

In plain language: Sets the maximum timeframe within which the recipient must notify the discloser of a suspected or confirmed breach, the content of that notification, and the required containment and remediation steps.

Common mistake: Setting a breach notification window longer than 72 hours. Under GDPR and many other frameworks, the data controller is required to notify its supervisory authority within 72 hours — a longer contractual window puts the discloser in breach of its own regulatory obligations.

In plain language: Requires the recipient to cooperate with the discloser in responding to data subject access requests, deletion requests, and other rights exercised under applicable privacy law within specified timeframes.

Common mistake: Omitting this clause entirely on the assumption that data subject rights are the discloser's problem. Recipients holding personal data have independent obligations in many jurisdictions and can be subject to regulatory action regardless of the discloser's role.

In plain language: Specifies how long the recipient may hold the data, what happens to it at contract expiry or termination, and requires written certification of deletion.

Common mistake: No deletion certification requirement. Without it, the discloser has no evidence that data was destroyed and cannot demonstrate compliance to regulators or demonstrate breach of contract if data is later misused.

In plain language: Allocates financial responsibility for losses arising from breach of the agreement, caps aggregate liability, and indemnifies the discloser against third-party claims caused by the recipient's misuse of data.

Common mistake: Applying the same liability cap to data breach claims as to general commercial breaches. Regulatory fines under GDPR can reach €20M or 4% of global turnover — a cap equal to one year's contract fees provides no meaningful protection against catastrophic breach events.

In plain language: States which jurisdiction's law governs the contract, the notice period and grounds for termination, and confirms that the written agreement supersedes all prior discussions and representations.

Common mistake: Choosing a governing law that differs from the jurisdiction where the data subjects reside. Privacy regulators apply the law of the data subjects' location regardless of the governing-law clause — creating a conflict between contractual rights and regulatory obligations.

A data sharing agreement is a legally binding contract between two or more parties that sets out the terms under which specified data — often including personal, proprietary, or confidential information — may be accessed, used, stored, and disclosed. It defines the permitted purposes for the data, the security obligations each party must meet, restrictions on further sharing, breach notification requirements, and what happens to the data when the arrangement ends. Organizations use it to protect themselves legally, demonstrate regulatory compliance, and establish clear accountability between data partners.

You need one any time your organization shares structured data with an external party — including vendors, research partners, government agencies, affiliates, or joint-venture partners. It is especially important when the data includes personal information, proprietary business data, or commercially sensitive records. If you are subject to GDPR, HIPAA, CCPA, or similar frameworks, a written data sharing agreement is typically a regulatory requirement rather than merely a best practice.

A data sharing agreement governs an arrangement where one party provides data to another who will use it for their own purposes — both parties may act as independent data controllers. A data processing agreement (DPA) is used when a processor handles personal data strictly on behalf of and under the instructions of a controller — the processor has no independent right to use the data. Under GDPR, a DPA is mandatory for all controller-processor relationships; a data sharing agreement is used for controller-to-controller sharing.

Yes, if any of the shared data relates to individuals located in the European Economic Area, GDPR compliance is required regardless of where the parties are based. The agreement must identify the lawful basis for sharing, specify the purposes, include data subject rights procedures, address international transfer mechanisms if data leaves the EEA, and align retention periods to the principles of data minimization and storage limitation. Non-compliance can result in fines of up to €20M or 4% of global annual turnover.

At minimum, the agreement should specify encryption standards for data at rest and in transit, access control requirements limiting data to authorized personnel, audit logging obligations, incident response procedures, and any required certifications such as ISO 27001 or SOC 2 Type II. For highly sensitive data — health records, financial data, biometrics — consider requiring penetration testing on a defined schedule and mandatory breach insurance coverage. Vague requirements like "industry-standard security" are difficult to audit and harder to enforce.

Retention periods should be set to the minimum duration necessary for the permitted purpose — no longer. Typical ranges are 12–36 months for marketing or analytics data, aligned to regulatory minimums for financial records (typically 5–7 years), or aligned to research data management plans for academic datasets. The agreement should require deletion or return within 30 days of expiry and mandate written certification of deletion so the discloser can demonstrate compliance to regulators.

Yes. Most data sharing agreements include provisions for termination for convenience with a defined notice period — typically 30 to 90 days — and immediate termination for material breach, insolvency, or regulatory action. Upon termination, the agreement should trigger an obligation to return or delete data within a specified period. Allowing data to remain with the recipient after termination without a clear mechanism to retrieve or destroy it is one of the most common and consequential drafting gaps.

For straightforward arrangements between domestic parties involving non-sensitive data, a well-structured template reviewed by a privacy professional is often sufficient. Engage a lawyer when the arrangement involves personal data subject to GDPR, HIPAA, or CCPA; when data is being transferred internationally; when the data is commercially valuable or competitively sensitive; or when the counterparty is a large organization with significant negotiating leverage. A 2–3 hour privacy counsel review typically costs $500–$1,500 and is worthwhile for any arrangement involving personal data at scale.

The non-breaching party may terminate the agreement, demand return or deletion of all shared data, and pursue damages or indemnification for losses arising from the breach. If personal data was involved, the discloser may also face regulatory scrutiny for having shared data with a party that failed to protect it adequately — making the recipient's indemnification obligation a critical commercial protection. In serious cases involving unauthorized disclosure of personal data, regulatory fines and class-action exposure can far exceed the direct commercial value of the arrangement.