A data sharing agreement sets the rules when two organizations exchange data: who the parties are, why the data is shared, which data moves, how it is protected, whether it may be passed on, how requests from individuals are handled, and when it is deleted. Use the clause outline below, then have counsel draft the contract.
- Settle the purpose and the data description first; most other clauses follow from them.
- If one party only acts on the other's instructions, a data processing agreement fits better.
- Payment, exclusivity and rights in trained models belong in a data licensing agreement.
FREE WORKING TOOL · NO ACCOUNT REQUIRED
Draft a data sharing agreement outline and download your CSV
Add a row for each clause. Write your position in plain language and the question you still need to answer. Counsel turns the agreed outline into contract wording.
This builder creates the file in your browser. Your entries are not submitted by this tool and disappear when you leave or reload. Use descriptions and invented examples, without private records or access details.
1 row in your working file. Save a download before leaving this page.
To share the tool, link to this page. Your downloaded file is a working document; it does not establish approval, rights, eligibility or an outcome.
Download the data sharing agreement template.
Use the free CSV builder on this page, or open the data sharing agreement template with ten example clauses. No email or account is required.
This is a working template, not legal advice. Use it to organize facts and questions, then have qualified counsel review anything you sign, adopt or delete.
Describe the data before you negotiate. The company data inventory names the record categories; the data dictionary template explains the fields that will move.
The clauses, in plain language
Each clause settles one question. The positions below are an illustrative starting point for two organizations that each decide their own use of the data.
| Clause | What it settles | Our position |
|---|---|---|
| Parties and roles | Who shares, who receives and who decides how the data is used | Each party decides its own use; neither acts for the other |
| Purpose | Why the data is shared and the benefit expected | Joint service quality reporting only |
| Data description | Which fields and record categories move, at what frequency | Monthly summary of resolved tickets without names or emails |
| Permissions and legal basis | Why each party may share and use the data | Each party records its own basis |
| Security and access | Who may access the data and how it is protected | Named team only; encrypted transfer |
| Onward sharing | Whether the recipient may pass data to anyone else | No onward sharing without written consent |
| Individual rights requests | Who handles access, correction and deletion requests | Each party handles requests it receives and notifies the other |
| Retention and deletion | How long the recipient keeps the data and how it is deleted | Delete or return at the end of the agreement |
| Incidents | How quickly a party reports a breach or misuse | Prompt written notice with the facts known |
| Term and termination | How long sharing lasts and how it ends | Annual term with a review date |
Sharing, processing or licensing: pick the right agreement
A data sharing agreement fits when each organization uses the data for its own purposes. When the parties decide together, the GDPR treats them as joint controllers: Article 26 says that where two or more controllers "jointly determine the purposes and means of processing, they shall be joint controllers", and that they determine their respective responsibilities for compliance "by means of an arrangement between them".
When one party only processes data on the other's behalf, Article 28 requires a contract, often called a data processing agreement, which among other things has the processor delete or return the personal data at the end of the services.
When one company grants another rights to use its records in exchange for payment, the commercial terms belong in a data licensing agreement. See data licensing vs data processing vs data sharing agreements.
California terms to check
If personal information of California consumers is shared, section 1798.100 of the California Civil Code requires a business that sells or shares it with a third party to have an agreement that, among other terms, specifies the information is disclosed "only for limited and specified purposes", obligates the recipient to provide the same level of privacy protection the law requires, and requires the recipient to notify the business if it can no longer meet its obligations.
The purpose, onward sharing and incident clauses in the template are where those terms usually sit.
Common questions
What is a data sharing agreement?
A data sharing agreement is a contract that sets the rules when organizations exchange data: the purpose, the data involved, security, onward sharing, handling of individual requests, retention and deletion.
What should a data sharing agreement template include?
Parties and roles, purpose, a data description, permissions, security and access, onward sharing, individual rights requests, retention and deletion, incident notice, and term and termination. The CSV outline on this page covers each one.
Is a data sharing agreement the same as a data processing agreement?
No. A data processing agreement governs a vendor that handles personal data only on your instructions. A data sharing agreement covers organizations that each use the data for their own purposes, or decide together.
Do joint controllers need a data sharing agreement?
They need an arrangement. GDPR Article 26 requires joint controllers to determine their respective responsibilities in a transparent manner, by means of an arrangement between them, and a data sharing agreement is a common place to record it.
Can we use a data sharing agreement to sell data?
It is the wrong tool. Payment, exclusivity and rights in trained models belong in a data licensing agreement. Start by describing the records in the inventory template.
Is this data sharing agreement template legal advice?
No. It is a working template for agreeing positions internally. Counsel should draft and review the final contract.