Establishing secure connection…Loading editor…Preparing document…

Data Management Plan Agreement

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

DATA MANAGEMENT PLAN AGREEMENT

Parties

Recitals

WHEREAS, Client Name: is engaged in research, analysis, or other activities requiring management of electronic and physical data; and

WHEREAS, Service Provider Name: has expertise in preparing, implementing, and maintaining Data Management Plans and related services for the Project titled ; and

WHEREAS, the parties desire to set forth their respective rights and obligations with respect to the handling, storage, access, retention, and disposition of Data as part of the services described below, effective as of .

Scope of Work

Service Provider will prepare, implement, and manage the Data Management Plan and associated processes, including data classification, storage architecture, metadata standards, access controls, preservation strategy, and disposal procedures. Provider will also assist with compliance reviews and respond to reasonable Client inquiries relating to the DMP.

Payment Terms

Client shall pay Provider for services rendered in accordance with the terms below. All amounts are due in United States dollars unless otherwise agreed in writing.

Any undisputed amount not paid within days after the due date shall accrue interest at per month, or the maximum rate permitted by law, whichever is lower. Client shall also reimburse Provider for reasonable costs of collection.

Term and Termination

This Agreement commences on Start Date: and continues until End Date: unless earlier terminated by either party as set forth below.

Either party may terminate this Agreement for material breach by the other party if the breaching party fails to cure the breach within days after written notice. Either party may terminate for convenience with days prior written notice; Client remains liable for services performed and non-cancellable commitments incurred through the effective date of termination.

Confidentiality and Data Classification

For purposes of this Agreement, "Confidential Information" means non-public information disclosed by one party to the other that is designated as confidential or that reasonably should be understood to be confidential. Confidential Information includes Data described in this DMP but excludes information that is or becomes publicly known through no fault of the recipient, is independently developed, or is rightfully received from a third party without restriction.

Provider will treat all Confidential Information with at least the same degree of care as it uses to protect its own confidential information, but in no event less than reasonable care, and will not disclose Confidential Information except to personnel who have a need to know and are bound by confidentiality obligations no less protective than those in this Agreement.

Data Security and Access Controls

Provider shall implement administrative, technical, and physical safeguards proportionate to the sensitivity of the Data. At a minimum, Provider will: (a) restrict access on a need-to-know basis; (b) use strong authentication; (c) employ encryption for data at rest and in transit where required by the Data classification; and (d) maintain backup and disaster recovery procedures.

Data Retention, Delivery, and Disposal

Provider will retain Data only for the period specified by Client or as required by applicable law, after which Provider will securely dispose of or return Data in accordance with Client instructions. Retention period:

Intellectual Property and Use of Data

Unless otherwise agreed in writing, Client retains ownership of the Data and grants Provider only a limited license to use the Data to perform the services described herein. Provider may not assert ownership or other rights in Client Data and shall not use Client Data for any purpose outside the scope of this Agreement without Client's prior written consent.

Liability and Indemnification

Each party's liability under this Agreement shall be limited to direct damages to the extent caused by its negligence or willful misconduct. Neither party shall be liable for incidental, consequential, special, or punitive damages. Provider shall indemnify and hold Client harmless from third-party claims arising from Provider's breach of confidentiality or negligent handling of Data, except to the extent such claims result from Client's instructions or negligence.

Audit and Compliance

Client may, upon reasonable notice and during normal business hours, audit Provider's relevant records and systems to verify compliance with the terms of this Agreement. Provider will cooperate and provide reasonable access to documentation, subject to protection of other clients' confidential information.

Governing Law; Entire Agreement

This Agreement will be governed by the laws of the State of without regard to its conflict of laws principles. This Agreement, including any exhibits and written amendments signed by both parties, constitutes the entire agreement between the parties concerning the subject matter herein and supersedes all prior negotiations, proposals, and agreements.

Amendments

Any amendment to this Agreement must be in writing and signed by authorized representatives of both parties. No oral modification will be binding.

Client — Printed Name:

Provider — Printed Name:

Client — By:

Client — Date:

Client — Title:

Provider — By:

Provider — Date:

Provider — Title:

Enter text✕
Prepare your document for signing right on this page
  • 01 Edit the text and complete the fields
  • 02 Click Sign Now and on the next screen add recipients and signature fields in SignNow
  • 03 Start your free trial to sign and send your doc
Sign Now

What a Data Management Plan Agreement Is

A Data Management Plan Agreement defines how an organization or project will collect, organize, secure, share, retain, and dispose of data produced or used during a specific activity. It documents roles and responsibilities for data stewards, required metadata standards, access controls, retention schedules, and any consent or sharing restrictions. For grant-funded research and multi-party collaborations the agreement clarifies repository selection, preservation actions, and obligations under privacy laws such as HIPAA or institutional policies, improving auditability and operational continuity.

Why a Written Agreement Matters

A Data Management Plan Agreement reduces compliance risk by clarifying responsibilities, retaining a reproducible record of decisions, and aligning practices with funder and regulatory requirements under ESIGN/UETA and sector rules.

Why a Written Agreement Matters

Who Commonly Prepares and Signs This Agreement

Typical users include researchers, project managers, compliance officers, and IT staff who manage project data through its full lifecycle.

  • Research institutions and principal investigators managing grant-funded data, repository deposits, and funder sharing obligations.
  • Healthcare organizations and research hospitals handling protected health information subject to HIPAA and institutional review board constraints.
  • Government agencies, contractors, and program managers required to document retention and access controls for public records.

Coordinated signatory and operational roles ensure the agreement is actionable, enforceable, and maintained as part of normal project governance.

Who Signs and Why

Principal Investigator

The lead researcher or project director who approves the plan, certifies adherence to funder terms, and is accountable for fulfilling data sharing and retention obligations specified in the agreement.

Data Steward

Operational owner responsible for implementing access controls, metadata standards, backups, and archival actions; coordinates with IT and legal teams to ensure technical safeguards match contractual terms.

Core Sections to Include in the Agreement

A professional Data Management Plan Agreement organizes obligations into discrete sections so all parties can find and meet their responsibilities without ambiguity.

Scope

Define the project, data types, and activities covered by the agreement, including whether derivatives, aggregated datasets, or controlled-access data are in scope and any exclusions that apply.

Roles & Responsibilities

Identify roles such as data steward, custodian, PI, and legal contact, and specify tasks for each role including approval authorities, access provisioning, and incident response responsibilities.

Data Description

Describe data formats, volume estimates, file naming and metadata standards, and the minimum documentation required for reuse or repository ingestion by funders or publishers.

Access & Security

List technical and procedural safeguards, authentication methods, encryption standards, and any special handling instructions for restricted or sensitive data.

Retention & Disposal

Specify retention periods, archival locations, disposition triggers, and the process for secure deletion or transfer at the end of the retention term.

Sharing & Publication

Document permitted sharing, consent provisions, embargo periods, licensing terms, repository deposition instructions, and obligations to notify collaborators or funders.

Step-by-Step: Complete and Execute the Agreement

Follow these steps to prepare, review, and finalize a Data Management Plan Agreement so it meets operational and compliance needs.

  • 01
    Draft: Describe data lifecycle, metadata, and retention specifics.
  • 02
    Assign Roles: Identify data stewards, custodians, and responsible signers.
  • 03
    Specify Controls: Document encryption, access, and retention policies.
  • 04
    Finalize & Sign: Collect signatures, execute, and archive securely.

Configure the Digital Workflow

Map routing, authentication, and archival settings to institutional policy before sending the agreement for signature.

Field Configuration
Retention Policy Specify retention length and archival location for executed agreements.
Authentication Method Select Email link, SMS code, or multi-factor for signer verification.
Approval Order Choose sequential or parallel signer routing depending on authority needs.
Repository Destination Set institutional repository or approved cloud storage as archive.

How Electronic Submission and Signing Typically Works

Electronic execution moves the agreement through creation, signing, and archival while capturing an audit trail for each action.

  • Upload: Attach the final agreement file to the workflow.
  • Place Fields: Add signature, initials, and date locations as required.
  • Send: Dispatch signing links or email invites to parties.
  • Archive: Store executed copy with completion certificate and logs.

Platform Capabilities to Verify Before eSubmission

Ensure the signing platform supports the file formats, integrations, and compliance features needed to meet institutional and funder requirements.

  • File Formats: PDF, DOCX, and XLSX are commonly supported.
  • Integrations: Salesforce, Google Workspace, NetSuite, and common repositories.
  • Authentication: Email, SMS, knowledge-based, SSO, and multi-factor options.

eSignature Vendor Pricing and Feature Snapshot

Compare vendor starting prices and core capabilities commonly relevant to executing Data Management Plan Agreements and institutional compliance workflows.

signNow DocuSign Adobe Sign PandaDoc HelloSign
Starting Price $8/user/mo $15/user/mo $14/user/mo $19/user/mo $15/user/mo
Free Trial 7-day free trial Varies Varies Varies Varies
Bulk Send Yes Yes Yes Yes No
Audit Trail Yes Yes Yes Yes Yes
HIPAA Compliant Yes Yes Yes No No

Security and Compliance Controls to Document

Encryption: TLS 1.2/1.3 in transit; AES-256 at rest
Access Controls: Role-based permissions and unique accounts
Audit Trail: Timestamps, IP logs, and version history
Data Minimization: Limit collection to necessary elements
De-identification: Remove direct identifiers when possible
BAA / HIPAA: Business associate agreement for PHI

Consequences of an Incorrect or Missing Agreement

Funding Loss: Grant termination or withholding
HIPAA Fines: Civil penalties and corrective action
Contract Breach: Termination and damages
Data Breach Liability: Notification costs and lawsuits
Operational Disruption: Loss of access or productivity
Reputational Damage: Stakeholder trust erosion

Common Mistakes to Avoid When Preparing the Agreement

  • Failing to define data ownership and stewardship leads to delayed responses when access or deletion requests occur during audits or litigation.
  • Using vague retention language without specific periods or triggers increases exposure to inconsistent retention and possible regulatory noncompliance.
  • Omitting metadata standards and file naming conventions hampers reuse, reproducibility, and repository ingestion by funders or publishers.
  • Neglecting authentication strength or audit trail details undermines the evidentiary value of electronic signatures or access logs.

Timing Considerations and Typical Deadlines

Timing depends on funder and institutional workflows; incorporate review and signature windows into project schedules to avoid delays.

Grant Application:

Submit a draft plan with the application when funders require a Data Management Plan.

Pre-Award Approval:

Obtain institutional approvals and legal review before finalizing pre-award commitments.

Post-Award Update:

Revise the plan if project scope changes or new data types are introduced.

Periodic Review:

Schedule annual reviews or reviews tied to major project milestones.

Archival Trigger:

Begin long-term retention or deletion when contractual obligations and retention periods end.

Key Milestones from Draft to Archive

Track milestones to ensure timely reviews, signatures, and archival actions during the project lifecycle.

01

Draft Completion

Author prepares the initial plan and supporting metadata documentation.

02

Internal Review

Compliance, IT, and legal review for policy and risk alignment.

03

Execution

Authorized parties sign and date the agreement electronically or in-person.

04

Archive and Monitor

Store executed copy, enable retention controls, and monitor compliance.

Practical Examples of Agreement Use

These examples illustrate how organizations tailor Data Management Plan Agreements to match operational and compliance needs in practice.

University Research Team

A university lab developed a Data Management Plan Agreement to standardize datasets across multiple studies and ensure repository submission compliance.

  • Enabled consistent metadata and DOI assignment.
  • The agreement clarified ownership, automated archival workflows, and reduced time spent preparing data deposits for funder audits, while providing a single reference for IRB and publisher requirements that sped approvals and reproducibility.

Healthcare Provider

A health system used a Data Management Plan Agreement to define PHI handling, de-identification, and research-sharing processes.

  • Ensured HIPAA-aligned procedures and BAAs.
  • As a result, collaborations began with clear consent and transfer protocols, minimizing legal review cycles, enabling faster institutional approvals, and reducing administrative delays while preserving patient privacy.

Practical Tips for Accurate and Efficient Completion

Adopt consistent drafting habits to reduce review cycles and ensure enforceability across teams and funders.

Use clear, enforceable language
Write precise obligations instead of aspirational statements. Specify exact retention periods, conditions for sharing, and measurable security controls to reduce ambiguity during audits or disputes.
Align with funder and institutional policy
Cross-check the plan against funder templates and institutional guidance so commitments in the agreement do not conflict with sponsored award terms or IRB approvals.
Standardize metadata and file formats
Adopt a single accepted metadata schema and preferred formats to simplify repository deposits, enable machine processing, and reduce errors during ingestion.
Document change control
Track revisions with version numbers and dates, require approval for material changes, and preserve prior signed versions to support audits and historical reviews.

Frequently Asked Questions and Troubleshooting

Answers to common questions about legal validity, PHI handling, signature attribution, and updating Data Management Plan Agreements.


Need help? Contact support

be ready to get more
Join over 28 million airSlate SignNow users
Sign Now
Company
Forms
Pricing
Resources
Knowledge base
Other Products
© 2026 airSlate Inc. All rights reserved.