Data Sharing Agreement Template

A data sharing agreement governs the terms under which one organization shares data with another. It defines what data is shared, for what purpose, how it must be protected, and who is responsible for compliance with applicable data protection laws.

Whether you are sharing personal data between group companies, providing data to a research partner, or exchanging business data with a vendor or customer, a written data sharing agreement reduces legal risk, clarifies accountability, and demonstrates compliance. This template covers the essential provisions for a workable and legally sound data sharing arrangement.

  • Screenshot 0
  • Screenshot 1
  • Screenshot 2
  • Screenshot 3
  • Screenshot 4
  • Screenshot 5
  • Screenshot 6
  • Screenshot 7
  • Screenshot 8
  • Screenshot 9
  • Screenshot 10
  • Screenshot 11
  • Screenshot 12
  • Screenshot 13
  • Screenshot 14
  • Screenshot 15

Full Text Template

The full content of the template is available, when you want to edit the text and enter your details make sure to click on the button to use the template.

Data Sharing Agreement

Beijing Duoke Information Technology Co., Ltd.

Data Sharing Agreement

This Data Sharing Agreement (“this Agreement”) is entered into on between :

Party A:

Registered address:

Contact person:

Phone:

and

Party B:

Registered address:

Contact person:

Phone:


Whereas

Party A operates the website, APP and other platforms, and provides a variety of products and services, which will generate a large amount of data on .

Party B operates the website, APP and other platforms, and provides a variety of products and services, which will generate a large amount of data on .

The parties intend to establish a data sharing platform. Subject to the compliance of applicable laws and regulations and this Agreement, the parties will upload the data generated in their respective process of providing products and services to the data sharing platform for use by both parties to promote their respective business development, engage in market research and develop new products and businesses;

Now, therefore, both parties reach the following agreements through friendly negotiation on the principle of equality and mutual benefit:

Subject, Content and Ownership of Data Sharing.

Subject of Data Sharing.

The subject of the provision and use of shared data as agreed in this Agreement shall include both Party A and Party B and their respectively designated related parties (collectively referred to as “Participating Parties”), and the scope of specific participating parties shall be determined by both parties through negotiation separately. Participating parties other than Party A and Party B shall become parties to this Agreement by signing the “Confirmation Letter of Participation in Data Sharing” or other similar documents, accept the representations and warranties made by all participating parties under this Agreement, and perform obligations of a participating party under this Agreement.

The related parties described in this Agreement shall include but not limited to any other legal person, non-corporate entity or natural person directly or indirectly controlled by, subject to control of, controlling or under common control with one of the parties. “Control” shall mean holding equities/interests with more than % of the voting rights of an entity or having the power to appoint more than % of the directors or members of other similar management organizations of the entity, or having the actual right to decide on or control the operations of the entity through agreements or other means. The subordinate related parties of any entity refer to all entities controlled by it .

Content of Data Sharing.

Based on the principle of reciprocal exchange, under the premise of not violating the law and not infringing the lawful rights and interests of others, each participating party shall share the relevant data generated in its process of providing products and services to other participating parties.

All participating parties shall share data by jointly establishing a data sharing platform. The specific content of data sharing, and the manner and time of data provision by the participating parties shall be determined by the parties through negotiation separately.

Ownership of Shared Data.

Except as otherwise specified in this Agreement, any participating party (“Provider”) shall have all and any ownership, rights and interests (including intellectual property rights) to the data (including derived data1) it provides to other participating parties (“Recipient”) pursuant to this Agreement, and shall have the right to modify, combine the data, and shall be able to decide at its discretion whether to expand or reduce the scope of data collected or generated in the course of business. The recipients may only use the data provided by the providers under this Agreement in accordance with this Agreement.

The ownership and interests (including intellectual property rights) of products developed or services conducted by any participating party using data from the data sharing platform (including derived data) shall be solely owned by such party.

The attribution of the ownership and interests (including intellectual property rights) of products developed or services conducted jointly by different participating parties shall be separately determined by such participating parties through negotiation, with agreements separately signed.

The data a party generates by independently developing, calculating using the data provided it.

Authorization, Use and Restriction of Data.

Authorization.

In accordance with the terms and conditions of this Agreement, each participating party authorizes and agrees that all other participating parties may access and use the data it provides to the data sharing platform on a global basis in accordance with this Agreement, applicable laws and regulations, and rules of the data sharing platform. Such authorizations shall be non-transferable, non-exclusive and non-sublicensable.

Scope of Access and Use.

Subject to the fulfilment of the following conditions: 1) compliance with the rules of the data sharing platform; 2) compliance with all applicable laws and regulations; 3) compliance with other restrictions as provided in this Agreement, each participating party shall have the right to freely access and use the data of the data sharing platform, and generate and use data derived from the data of the data sharing platform.

Restrictions.

No participating party shall sell, authorize, transfer or disclose the relevant shared data provided by other participating parties in accordance with this Agreement to any third party other than the participating parties, or allow third parties to access the data sharing platform, or send to third parties or allow third parties to use any data (including derived data) of the data sharing platform, unless: a) a written authorization of the relevant party has been obtained; or b) if the disclosure is made as required according to applicable laws and regulations, the party shall give a written notice in an appropriate manner and take necessary measures to obtain necessary consent before the disclosure, and make the disclosure pursuant to the data minimization principle. To avoid ambiguity, this Article does not restrict a party from selling, authorizing, transferring, or disclosing data (including derived data) that it uploads to the data sharing platform.

Any participating party shall have the right to sell, authorize, transfer or disclose the relevant shared data provided by each of them in accordance with this Agreement to third parties other than the participating parties, but the foregoing third parties shall not include the counterparties’ competitors in the same industry (including branches, subsidiaries and other divisions) as listed by other participating parties in the competition lists, which shall be updated once in every from the date of this Agreement. Meanwhile, once in every year, each of Party A and Party B shall have the right to request the counterparty to terminate its partnership with a third party not included in the competition lists (which shall be limited to partnership in selling, authorizing, transferring, disclosing the relevant shared data provided by it to such third party), and a party shall terminate the partnership with such third party upon receiving the written notice of the counterparty.

No participating party may use any data of the data sharing platform to participate in, engage in, produce, or operate any business that competes with the business of other participating parties without the written approval of the relevant participating parties.

Except as otherwise provided in this Agreement, any participating party may not use or copy the company names, trademarks, trade names, domain names, website names, program marks and program names of other participating parties, or any other content that other parties have intellectual property rights without the prior consent of the relevant participating parties.

Any participating party that wishes to use the name of any other participating party in its promotional materials, business cards, websites and any other aspects shall obtain authorization in writing by such participating party. No participating party may engage in advertising and commercial activities in the name of any other participating parties without the authorization of relevant participating parties.

Management, Operation and Maintenance of the Data Sharing Platform.

Management.

After the execution of this Agreement, both parties shall establish a data sharing platform. The parties agree that after the execution of this Agreement, they shall each appoint a representative as the person-in-charge of the data sharing platform. Meanwhile, both parties may change their appointed persons from time to time, but they shall notify the other party in writing in a timely manner. For the avoidance of doubt, the relevant subject of management, operation and maintenance as provided in Article 3 of this Agreement shall only be Party A and Party B, excluding other participating parties hereto.

Any decision on the data sharing platform is subject to unanimous agreement of the representatives appointed by both parties, who shall jointly exercise authorities including but not limited to the following:

review, discuss, handle, modify, and interpret policies, rules, regulations, procedures, and other terms and conditions related to the operation, management and use of the data sharing platform, including:

data classification: including classification based on security risks, confidentiality, relevant regulations, and personal information protection;

access, encryption, modification and deletion of shared data;

privacy protection (including assessment of the consistency in the personal information protection policies of both parties);

service levels, technical support, backup, maintenance, upgrades, and application programming interfaces; and

interoperability of computer systems of the parties over the data sharing platforms (collectively referred to as “Data Sharing Platform Rules”);

monitor and inspect all participating parties for compliance with the Data Sharing Platform Rules, the terms of this Agreement and applicable laws and regulations, and take appropriate actions against the non-compliant party to cause it to comply with the Data Sharing Platform Rules, the terms of this agreement and applicable laws and regulations;

establish:

a reasonable written notification procedure for notice of violations of the Data Sharing Platform Rules, this Agreement, and applicable laws and regulations;

reasonable remediation periods (that shall vary by different types of violation);

decide whether any related parties of Party A and Party B have the right to join the data sharing platform and become participating parties;

suspend the rights of participating parties who violate the Data Sharing Platform Rules, this Agreement or applicable laws and regulations to access the data sharing platform, and terminate the right of participating parties who fail to remedy within the reasonable remediation period to access the data sharing platform;

resolve disputes between the parties and establish reasonable and necessary rules and procedures for dispute resolution;

exempt any participating party from its obligations and responsibilities under this Agreement.

Within 0 days after the end of each fiscal year, the representatives appointed by the parties shall jointly submit to the parties:

consideration of changes and/or changes to any rule of the data sharing platform;

any actual or alleged violation of any rule of the data sharing platform, this Agreement or applicable laws and regulations, or other actual or suspected misappropriation or unauthorized use of any shared data;

other contents requested reasonably by the parties for reporting.

Operation and Maintenance.

Party A shall be responsible for the operation and maintenance of the data sharing platform, and shall have the right to obtain authorizations, purchase software and hardware from third parties necessary for the operation and maintenance of the data sharing platform. For the avoidance of doubt, the operation of the data sharing platform shall refer only to the operation of the data sharing platform itself, excluding the platforms respectively operated by the participating parties to provide their services and products.

Term of Data Sharing and Fee Arrangement.

Term.

The initial term of cooperation of this Agreement shall be 0 years, starting from the effective date of this Agreement. If Party A becomes a publicly listed company within the initial term of cooperation, Party A’s board of directors shall have the right to extend the term of this Agreement to a maximum of 0 years(starting from the effective date of this Agreement) within 0 days after Party A becomes a listed company. Both parties may prematurely terminate this Agreement or extend the term of partnership of this Agreement upon negotiation and consensus.

Fee Arrangement.

Data usage fee: Either party is not required to pay data usage fee to the other party.

Platform operation and maintenance cost: The cost of operating and maintaining the data sharing platform shall be borne by .

Taxes: Taxes and other expenses incurred as a result of the execution and performance of this Agreement shall be respectively borne by each participating party in accordance with the law.

Confidentiality.

Any participating party shall keep confidential undisclosed materials and information (“Confidential Information”) concerning the business, technical, financial and other aspects of other participating parties that it becomes aware of or accesses to because of the execution or performance of this Agreement. No participating party may disclose such confidential information to any third party without the written consent of the relevant participating parties. Any participating party shall protect the confidential information of other participating parties in the same manner as the protection of their own proprietary and confidential information and materials, but in any event not less than a reasonable degree of care. Participating parties who accept confidential information shall be responsible for any violation of the confidentiality provisions of the Agreement by their employees or agents.

At the request of the relevant participating party, any other participating party shall return any documents, materials or software containing the confidential information of the relevant participating party to it as required, or destroy or otherwise dispose of them, and shall not continue to use such confidential information.

After the termination of this Agreement, the parties’ confidentiality obligations under this Agreement shall survive and the parties shall still comply with the confidentiality provisions of this Agreement and perform their confidentiality obligations until the other parties agree to relieve them of the obligations, or the violation of the confidentiality provisions of this Agreement will not cause de facto damage in any form to other parties.

No participating party shall, without the written approval of the relevant participating party, disclose to third parties (except where laws, regulations, government departments, stock exchanges or other regulatory authorities require, and except for the legal, accounting, business and other consultants and authorized employees of both parties) any content of the terms of this Agreement, as well as circumstances of the execution and performance of this Agreement, and any information of any participating party known through the execution and performance of this Agreement.

Except as otherwise provided in this Agreement, if either party hereto requires assistance from a third party for the performance of its obligations under this Agreement, and it is inevitable for such third party to know or access the confidential information under this Agreement when providing assistance, any party hereto may provide the confidential information to such third party subject to the written consent of the other party and the agreement of the third party in writing to assume all of the confidentiality obligations set forth in this Agreement.

Representations and Warranties.

Each participating party states, represents and warrants to all other participating parties as follows:

The party has all necessary powers and authority to execute and deliver this Agreement and perform its obligations under this Agreement.

The party has obtained all necessary official authorizations from its company to execute and deliver this Agreement and perform its obligations under this Agreement.

The party’s execution of this Agreement or performance of its obligations under this Agreement is not in violation of or in conflict with any other agreements it has entered into.

Each participating party warrants that it has the legal rights to the data provided by it under this Agreement and will not infringe on the legal rights of any third party. Each participating party warrants that it will not engage in any conduct that would harm the interests of other participating parties during the partnership, including but not limited to infringement of the copyrights, right to reputation and/or other legal rights of other participating parties.

Each participating party warrants that in this partnership, the collection and provision of relevant data, the upload of such data to the data sharing platform, and the authorization of other participating parties to use such data in accordance with this Agreement do not violate relevant laws and regulations, and infringe on the lawful rights and interests of third parties, and it has obtained the necessary consent, permit or approval for the above actions, including but not limited to:

The data provider has obtained explicit authorization from the users for the collection, processing and provision of user-related data, or has obtained explicit authorization from the information subject for the collection, use and provision of such original personal information to domestic or overseas partners, as well as for the purpose and scope of using such original personal information, in which such authorized scope includes the sharing of user-related data.

Each participating party warrants that if a participating party is an entity outside China, the participating party providing data to such foreign entity shall conduct security assessment on cross-border data transfer in accordance with relevant laws and regulations prior to the cross-border data transfer and other participating parties shall provide necessary assistance.

Each participating party warrants that it will observe the principles below in accessing or using the data interface of the data sharing platform:

It shall comply with relevant laws and regulations concerning Internet administration of the and other relevant countries or regions.

It shall comply with all network protocols, regulations and procedures related to network services and information security.

It shall not use the data interface to engage in any conduct that may adversely affect the normal Internet operation.

It shall not use the data interface for any illegal purposes.

If there is any unlawful use of data privilege by internal employee, data leak or security breach, such unlawful use shall be terminated immediately and the representatives appointed by both parties shall be informed.

Liability for Default Compensation.

If any participating party (“the Defaulting Party”) constitutes a default due to direct or indirect violation of any terms of this Agreement or failure to promptly and fully assume its obligations under this Agreement, after the occurrence of the default, the observant party shall be entitled to request in writing the defaulting party to rectify the default and take sufficient, effective and timely measures to eliminate the consequences of the default, and compensate the observant party for the losses incurred as a result, including but not limited to economic loss and reputation damage; if the defaulting party fails to rectify its default within business days of receipt of the above notice of default by the observant party, the observant party shall be entitled to terminate this Agreement by notifying the counterparties in writing and require the defaulting party to compensate for the losses.

In the event of default by a party, the counterparties shall take appropriate measures within a reasonable scope to prevent further losses; if no appropriate measures are taken to prevent further losses, no compensation shall be claimed for such further losses. The reasonable expenses incurred by a party for preventing further losses shall be borne by the defaulting party. If the observant party does not take measures to reduce losses, the defaulting party shall be entitled to request deduction from the damages for the amount of losses that would have otherwise been reduced.

The losses that the defaulting party shall compensate the observant party due to its default includes but not limited to the direct economic loss and any foreseeable indirect loss and other reasonable expenses incurred on the observant party due to the default by the defaulting party, such expenses include but not limited to legal fees, litigation and arbitration fees, financial expenses and travel expenses.

No Double Compensation. Any participating party, for the same loss, shall not be entitled to receive compensation or other form of reparation or restitution more than once.

To avoid ambiguity, except as otherwise agreed in this Agreement, all participating parties hereto shall independently assume the various rights and obligations under this Agreement. Party A and Party B, respectively, shall not be jointly and severally liable for the default by any of its related parties.

Force Majeure.

“Force Majeure” shall mean an event that cannot be reasonably controlled or foreseen, or unavoidable even if foreseen by the parties hereto, which renders either party impossible to perform all or part of its obligations pursuant to this Agreement. Such event includes but is not limited to government action, earthquake, typhoon, flooding, fire or other natural disaster, war or any other similar event. In view of the special nature of Internet, force Majeure also includes the following circumstances affecting the normal operation of the Internet: 1) hacker attacks; 2) material impact caused by technical adjustments by the telecommunications operator, excluding losses due to poor management by such party; 3) temporary shutdown due to government control, except for controls resulting from such party’s fault; 4) virus invasion; 5) general failure of the public networks.

If either party fails to perform this Agreement in whole or in part, or delays the performance of this Agreement due to force majeure, within calendar days from the date of the event of force majeure, it shall notify the other party in writing of the circumstances of the event of force majeure; and within calendar days from the date of the event of force majeure, it shall provide to the other party a proof issued by a notary office of the place where the event of force majeure takes place and causes the failure or delay of its performance of this Agreement in whole or in part.

The party subject to force majeure shall take all necessary measures to reduce the losses and resume the performance of this Agreement immediately after the event ends.

Effectiveness, Modifications and Termination of the Agreement.

This Agreement shall be effective upon the execution by the legal representatives or authorized representatives of both parties and the stamping of the official seals or special seals for contracts. Other participating parties shall become parties to this Agreement by signing the “Confirmation Letter of Participation in Data Sharing” or other similar documents, accept the representations and warranties made by all participating parties under this Agreement and perform obligations of a participating party under this Agreement. The participating parties shall negotiate whether to renew at least 0 days prior to the expiration of this Agreement or at least 0 days prior to the expiration of each renewal (as the case may be). Unless otherwise agreed, all terms and conditions of this Agreement shall remain unchanged during the renewed period.

This Agreement may be supplemented, modified or changed upon negotiation and consensus of the participating parties. Supplements, modifications or changes shall be made in writing and become effective upon signing by all participating parties.

Notwithstanding the provisions of other terms of this Agreement, any participating party shall be entitled to prematurely terminate this Agreement by notifying the counterparty in writing and shall not be liable for default as a result of such premature termination, if:

The counterparty is insolvent, or becomes the subject of a liquidation or dissolution procedure, or has been transferred for the benefit of creditors, or has a receiver designated for its business (excluding voluntary liquidation for reorganization or merger purposes).

A force majeure event lasts for calendar days and renders either party hereto unable to continue to perform its primary obligations under this Agreement.

Upon termination of this Agreement, any participating party shall have the right to request other participating parties to return data or information (including all copies) belonging to it, and to request removal of data or information related to this Agreement, except where data or information is required to be saved for archiving purposes in accordance with the law.

If this Agreement is terminated, Article 5 (Confidentiality), Article 6 (Representations and Warranties), Article 7 (Liability for Default Compensation), Article 10 (Dispute Resolution and Governing Laws), Article 11 (Notice), Article 12 (Miscellaneous Provisions) shall survive with full legal effect.

Dispute Resolution and Governing Laws.

The participating parties shall resolve disputes arising from the execution of this Agreement or all disputes related to this Agreement through friendly negotiations. If the parties fail to reach an agreement within calendar days, either party may submit the dispute to the for arbitration in in accordance with the then effective arbitration rules of the .

The conclusion, execution, construction of this Agreement and resolution of disputes shall be governed by the laws of the .

Notice.

Any notice or other correspondence (“Notice”) sent by a party to the other party in connection with this Agreement shall be in writing and served to the person being notified at the following mailing addresses or phone numbers or e-mail addresses, which shall only constitute a valid notice by indicating the names of the following contact persons; for clarification, notices served by e-mail shall be deemed notices in writing:

Party A:

Contact person:

Mailing address:

E-mail:

Phone:

Party B:

Contact person:

Mailing address:

E-mail:

Phone:

Notices, requests or other correspondences sent pursuant to the preceding paragraph shall be deemed served in the following circumstances: If the notice is deliver personally, it shall be deemed served when the notice is signed for receipt by the person being notified; notices that may be sent by post shall be sent by registered express mail or express mail service. The registered express mail shall be deemed served to the person being notified on the calendar day after posting, and a notice delivered by express mail service shall be deemed served upon signing for receipt by the person being notified; a notice sent by e-mail shall be deemed served when the mail system shows that the person being notified actually receives the notice.

If the above mailing address or notification method of either party changes, the changing party shall notify the other party within calendar days after the date of such change. If the changing party fails to notify in time as agreed, it shall bear the losses caused thereby.

Miscellaneous Provisions.

Matters not covered in this Agreement shall be supplemented in writing by the participating parties after friendly negotiation, and the supplementary agreements shall have the same legal effect as this Agreement. In the event of any discrepancy between this Agreement and the supplementary agreements, the provisions of the supplementary agreement shall prevail.

If any provision of this Agreement is deemed invalid or unenforceable in whole or in part due to any reason, or is in violation of any applicable laws, it shall be regarded as deleted, but the remaining provisions of this Agreement shall remain in force and binding. For provisions that are deemed invalid, unenforceable or illegal, the parties shall negotiate in a friendly manner based on the principle of achieving the original business intentions.

Failure by either party hereto to exercise its rights in time under this Agreement shall not be deemed a waiver of the rights, nor shall it affect the exercise of such rights by the party in the future.

The Annexes to this Agreement (if any) shall be an integral part of this Agreement and have the same legal effect as this Agreement.

Any headings in this Agreement are for reference only and do not affect the meaning of this Agreement and its interpretation.


The Parties have caused this Agreement to be executed and delivered by their duly authorized representatives as of date first set out above.

Pending

Pending

Use this template

Disclaimer: The original creator, the author of this template, and fynk GmbH are not responsible for any damages or liabilities that may result from using this template. This template should not be considered a substitute for legal advice, and consulting with a legal professional is recommended before use. fynk GmbH, the original creator, and the author do not provide legal advice and will not be held accountable for any legal consequences arising from its use.

Making contract management easier for companies such as

Conrad logo Oekostrom AG Logo Datarade Logo Rampf Logo Unite Logo

Background Information

What a data sharing agreement covers and how to use this template

Learn what a data sharing agreement is, when you need one, the key provisions to include, and how to adapt this template to your data sharing arrangements.

What Is a Data Sharing Agreement?

A data sharing agreement is a contract between two or more organizations (the data provider and the data recipient) that sets out the terms on which data is shared, the permitted uses of that data, and the obligations each party must meet to protect it.

Data sharing agreements are used in many contexts:

  • Intra-group data sharing – sharing personal or business data between affiliated companies in a corporate group.
  • Research and analytics – sharing data with a research institution, analytics partner, or academic body.
  • Vendor and partner arrangements – providing data to a supplier, technology provider, or business partner to enable a service.
  • Regulatory and public sector – sharing data between public authorities or with regulated entities.

Where personal data is involved, a data sharing agreement overlaps with data protection law obligations. In the EU/EEA, the UK, and many other jurisdictions, sharing personal data with a third party requires a lawful basis and appropriate contractual safeguards.

Data Sharing Agreement vs. Data Processing Agreement

These two documents are often confused:

Data Sharing AgreementData Processing Agreement
Who controls the data?Both parties act as independent data controllersOne party is a data processor acting on the other’s instructions
Who decides purpose?Each party may use data for its own purposes (within agreed limits)Processor acts only on the controller’s documented instructions
GDPR relevanceRequired when two controllers share personal dataRequired when a controller engages a processor

A data sharing agreement is the right document when both parties are independent controllers. A data processing agreement (DPA) is required when one party processes data purely on behalf of the other.

Key Clauses in a Data Sharing Agreement

1. Description of the data

Precisely describe what data is being shared:

  • Categories of data (personal, financial, operational, health, research data, etc.)
  • Data subjects or entities to which the data relates
  • Format and method of transfer
  • Frequency of sharing (one-off, ongoing, periodic)

Vague descriptions create disputes about what the recipient is permitted to use.

2. Permitted purposes

Define what the recipient may use the shared data for. This is the most commercially critical clause:

  • Specific, limited purposes for which the data may be processed
  • Prohibition on using the data for any other purpose without consent
  • Prohibition on onward sharing without prior written consent

Limiting purpose protects the data provider and ensures the recipient does not exploit the data beyond the agreed arrangement.

3. Data protection obligations

Set out each party’s obligations under applicable law:

  • Compliance with GDPR, UK GDPR, CCPA, or other applicable data protection legislation
  • Which party is the data controller (or whether both are joint controllers)
  • Obligations to maintain a lawful basis for processing
  • Data subject rights: how each party handles access requests, erasure, and objections
  • Data breach notification obligations and timelines
  • Data minimization and accuracy obligations

See also: general compliance with laws.

4. Security measures

Define the technical and organizational measures each party must maintain:

  • Minimum security standards (e.g., encryption at rest and in transit, access controls, pseudonymization)
  • Obligations to notify the other party of security incidents affecting shared data
  • Regular security assessments or audits. Maintaining an audit trail of document access and changes supports breach investigation and demonstrates accountability

5. Retention and deletion

Set clear data lifecycle obligations:

  • How long the recipient may retain the shared data
  • Obligation to delete or return data when the permitted purpose is fulfilled or the agreement ends
  • Certification of deletion on request

6. International transfers

If data is transferred across borders, address applicable transfer mechanisms:

  • Standard Contractual Clauses (SCCs) for EU/UK data transfers
  • Adequacy decisions
  • Any restrictions on transferring data outside defined geographic boundaries

7. Confidentiality

The shared data may contain commercially sensitive information. A confidentiality clause should:

  • Confirm confidentiality obligations over and above data protection requirements
  • Cover non-personal business data that may not be covered by data protection law

8. Intellectual property

Address intellectual property ownership of any insights, aggregates, or derivative works created from the shared data:

  • The data provider typically retains ownership of the underlying data
  • The recipient may own derived insights, subject to agreed restrictions
  • Neither party acquires IP rights in the other’s data or systems

9. Liability and indemnification

Allocate liability for data protection failures:

  • Each party is liable for breaches it causes
  • Mutual indemnification for regulatory fines or third-party claims arising from the other party’s non-compliance
  • Limitation of liability caps (consider whether these should be carved out for data protection breaches)

10. Term and termination

Define how long the agreement lasts:

  • Duration tied to the permitted purpose, or a fixed term with renewal
  • Termination for breach, change of law, or withdrawal of lawful basis
  • Post-termination data deletion obligations

Who Needs a Data Sharing Agreement?

  • Corporate groups sharing HR, customer, or operational data between affiliated entities
  • Research institutions and commercial partners exchanging data for analytics or studies
  • Technology companies providing data feeds or API access to business partners
  • Public sector bodies sharing personal data in accordance with regulatory requirements
  • Healthcare organizations sharing patient or clinical data with partners or researchers

How to Customize This Template

  1. Describe the data precisely in a schedule.
  2. Define the permitted purpose narrowly and clearly.
  3. Identify the applicable data protection law and obligations.
  4. Set security standards appropriate to the sensitivity of the data.
  5. Address international transfer mechanisms if relevant.
  6. Set deletion timelines and certification requirements.
  7. Have your data protection officer or legal counsel review before execution.

If you also need to protect confidential information exchanged before or alongside the data sharing arrangement, a mutual NDA is commonly used in combination:

Data Sharing Agreement Template

This data sharing agreement template is ready to use in fynk. Customize data descriptions, permitted purposes, security requirements, and retention timelines, then send for signature.

With fynk, you can:

  • Track data sharing agreements alongside DPAs and privacy documentation
Access control settings in fynk
White zoom-in icon
Grey info bubble icon

Set granular access permissions on data sharing agreements so only authorized team members can view or edit sensitive terms.

  • Set retention period reminders and deletion review dates
  • Maintain an audit trail of review, approval, and signature
  • Link related agreements and correspondence in one record

FAQs

What is a data sharing agreement?
A data sharing agreement is a contract between two or more organizations that sets out the terms on which data is shared, including what data is shared, for what purpose, what security measures apply, who is responsible under data protection law, and how long the data may be retained.
When do I need a data sharing agreement instead of a data processing agreement?
A data sharing agreement is needed when both organizations are independent data controllers: each deciding the purpose and means of processing for their own part. A data processing agreement (DPA) is needed when one organization processes data solely on behalf of the other, acting as a processor under GDPR.
Does a data sharing agreement need to comply with GDPR?
Yes, if the data shared includes personal data of individuals in the EU or UK. The agreement must reflect each party's obligations under GDPR (or UK GDPR), including lawful basis, data subject rights, breach notification, and, if data is transferred internationally, the applicable transfer mechanism such as Standard Contractual Clauses.
What should a data sharing agreement say about data deletion?
The agreement should specify how long the recipient may retain the shared data, the obligation to delete or return it when the permitted purpose is fulfilled or the agreement ends, and a requirement to certify deletion on request. Data minimization principles under GDPR also require that data is not kept longer than necessary.
Who owns derived insights or analytics created from shared data?
This depends on what the parties agree. The data provider typically retains ownership of the underlying data. Ownership of derived insights, aggregates, or analytical outputs should be addressed explicitly in the IP clause; otherwise, disputes about ownership and permitted use of outputs can arise.

Searching for a contract management solution?

Find out how fynk can help you close deals faster and simplify your eSigning process – request a demo to see it in action.

Ready to sign?
Use this template today.

Clause Library: learn more about the clauses in this template

Learn more about the clauses appearing in this template and find other clauses that are used in real contracts.

Confidentiality clause

A confidentiality clause is a provision in a contract that obligates one or both parties to keep certain information confidential and not to disclose it to third parties without prior consent. This clause is designed to protect sensitive information such as trade secrets, business strategies, and proprietary data shared during the course of the contractual relationship.

20 example clauses

Intellectual property

The intellectual property clause in a contract defines the ownership rights and usage conditions for any creations, inventions, or proprietary information that are developed, exchanged, or used during the course of the agreement. It typically outlines whether the intellectual property rights are retained by the creator, transferred to another party, or shared among parties, detailing any limitations and obligations associated with these rights.

23 example clauses

Indemnity

An indemnity clause is a contractual provision where one party agrees to compensate the other for certain costs and liabilities that may arise due to specified events or actions. This clause is designed to allocate risk by holding one party responsible for losses incurred by the other, providing financial protection in situations such as breaches of contract, negligence, or legal claims.

20 example clauses

Governing law and jurisdiction

The "Governing Law and Jurisdiction" clause specifies which region's legal framework will be applied in interpreting and enforcing the terms of a contract and designates the location where any legal disputes will be resolved. This clause is crucial for determining procedural and substantive legal matters, ensuring both parties are aware of the legal standards and courts that will have authority in case of conflicts.

14 example clauses

Related Templates

Are you looking for more templates? fynk has them all!

Vehicle Purchase Agreement Template

A contract outlining the sale, purchase, delivery, and payment terms for vehicles, including specifications, schedules, notices, and obligations.