# Data sharing agreement template: a clause-by-clause outline > A free data sharing agreement template: ten clauses explained in plain language, a CSV outline you can fill in, and the GDPR and CCPA terms to check. Canonical: https://origindatapartners.com/blog/data-sharing-agreement-template By: Origin Data Partners Status: Published Published: 2026-11-10 Updated: 2026-11-10 Sources checked: 2026-11-09 ## Quick answer A data sharing agreement sets the rules when two organizations exchange data: who the parties are, why the data is shared, which data moves, how it is protected, whether it may be passed on, how requests from individuals are handled, and when it is deleted. Use the clause outline below, then have counsel draft the contract. ## Key points - Settle the purpose and the data description first; most other clauses follow from them. - If one party only acts on the other's instructions, a data processing agreement fits better. - Payment, exclusivity and rights in trained models belong in a data licensing agreement. ## Download the data sharing agreement template. Use the [free CSV builder](#data-sharing-agreement-builder) on this page, or open the [data sharing agreement template](https://origindatapartners.com/downloads/data-sharing-agreement-template.csv) with ten example clauses. No email or account is required. This is a working template, not legal advice. Use it to organize facts and questions, then have qualified counsel review anything you sign, adopt or delete. Describe the data before you negotiate. The [company data inventory](https://origindatapartners.com/blog/company-data-inventory-template) names the record categories; the [data dictionary template](https://origindatapartners.com/blog/company-data-dictionary-template) explains the fields that will move. ## The clauses, in plain language Each clause settles one question. The positions below are an illustrative starting point for two organizations that each decide their own use of the data. | Clause | What it settles | Our position | | --- | --- | --- | | Parties and roles | Who shares, who receives and who decides how the data is used | Each party decides its own use; neither acts for the other | | Purpose | Why the data is shared and the benefit expected | Joint service quality reporting only | | Data description | Which fields and record categories move, at what frequency | Monthly summary of resolved tickets without names or emails | | Permissions and legal basis | Why each party may share and use the data | Each party records its own basis | | Security and access | Who may access the data and how it is protected | Named team only; encrypted transfer | | Onward sharing | Whether the recipient may pass data to anyone else | No onward sharing without written consent | | Individual rights requests | Who handles access, correction and deletion requests | Each party handles requests it receives and notifies the other | | Retention and deletion | How long the recipient keeps the data and how it is deleted | Delete or return at the end of the agreement | | Incidents | How quickly a party reports a breach or misuse | Prompt written notice with the facts known | | Term and termination | How long sharing lasts and how it ends | Annual term with a review date | ## Sharing, processing or licensing: pick the right agreement A data sharing agreement fits when each organization uses the data for its own purposes. When the parties decide together, the GDPR treats them as joint controllers: [Article 26](https://www.legislation.gov.uk/eur/2016/679/article/26/adopted) says that where two or more controllers "jointly determine the purposes and means of processing, they shall be joint controllers", and that they determine their respective responsibilities for compliance "by means of an arrangement between them". When one party only processes data on the other's behalf, [Article 28](https://www.legislation.gov.uk/eur/2016/679/article/28/adopted) requires a contract, often called a data processing agreement, which among other things has the processor delete or return the personal data at the end of the services. When one company grants another rights to use its records in exchange for payment, the commercial terms belong in a data licensing agreement. See [data licensing vs data processing vs data sharing agreements](https://origindatapartners.com/guides/data-licensing-agreement#licensing-vs-processing-vs-sharing). ## California terms to check If personal information of California consumers is shared, [section 1798.100](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.100) of the California Civil Code requires a business that sells or shares it with a third party to have an agreement that, among other terms, specifies the information is disclosed "only for limited and specified purposes", obligates the recipient to provide the same level of privacy protection the law requires, and requires the recipient to notify the business if it can no longer meet its obligations. The purpose, onward sharing and incident clauses in the template are where those terms usually sit. ## Before any data moves Agree the outline internally, check customer contracts and privacy notices for restrictions, and confirm who signs. Share a description and a sample only after the agreement is in place. If the other party is an AI developer that wants to pay for your records, the question changes from sharing to licensing. Origin Data Partners is an independent data partner that helps companies get their data bought; you can [check whether your company could qualify](https://origindatapartners.com/check-fit) without sending records. ## Questions and answers ### What is a data sharing agreement? A data sharing agreement is a contract that sets the rules when organizations exchange data: the purpose, the data involved, security, onward sharing, handling of individual requests, retention and deletion. ### What should a data sharing agreement template include? Parties and roles, purpose, a data description, permissions, security and access, onward sharing, individual rights requests, retention and deletion, incident notice, and term and termination. The CSV outline on this page covers each one. ### Is a data sharing agreement the same as a data processing agreement? No. A data processing agreement governs a vendor that handles personal data only on your instructions. A data sharing agreement covers organizations that each use the data for their own purposes, or decide together. ### Do joint controllers need a data sharing agreement? They need an arrangement. GDPR Article 26 requires joint controllers to determine their respective responsibilities in a transparent manner, by means of an arrangement between them, and a data sharing agreement is a common place to record it. ### Can we use a data sharing agreement to sell data? It is the wrong tool. Payment, exclusivity and rights in trained models belong in a data licensing agreement. Start by describing the records in the [inventory template](https://origindatapartners.com/blog/company-data-inventory-template). ### Is this data sharing agreement template legal advice? No. It is a working template for agreeing positions internally. Counsel should draft and review the final contract. ## Sources - [GDPR Article 26 (joint controllers) as adopted, on legislation.gov.uk](https://www.legislation.gov.uk/eur/2016/679/article/26/adopted) - [GDPR Article 28 (processor) as adopted, on legislation.gov.uk](https://www.legislation.gov.uk/eur/2016/679/article/28/adopted) - [California Civil Code section 1798.100 (contracts with third parties)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.100) ## Related reading - [Data licensing agreement: what to include](https://origindatapartners.com/guides/data-licensing-agreement) - [/blog/data-use-agreement-template](https://origindatapartners.com/blog/data-use-agreement-template) - [/blog/company-data-inventory-template](https://origindatapartners.com/blog/company-data-inventory-template) - [/blog/company-data-dictionary-template](https://origindatapartners.com/blog/company-data-dictionary-template)