Can this agreement be electronically signed?

Yes. Electronic signatures are generally enforceable under the federal ESIGN Act (15 U.S.C. §7001) and state UETA implementations. Confirm the selected signature method satisfies the agreement's attribution and consent requirements and note any statutory exceptions.

Do I need a Business Associate Agreement?

If the data includes protected health information, include a HIPAA Business Associate Agreement and specify required safeguards; HIPAA requires covered entities and business associates to document responsibilities.

When is notarization required?

Notarization is uncommon for commercial data-sharing agreements but may be required for particular filings or to create self-proving affidavits; check state law before adding notarization requirements.

How do parties revoke access to shared data?

Revoke access per the contract's termination and deletion clauses, which should include timelines for return or secure destruction and procedures for notifying the other party.

What if a party uses a subcontractor?

Require subcontractor notice, written flow-down obligations, and the right to audit or require remedial actions if controls are inadequate.

How long must records be kept?

Retention depends on data type and law: IRS records three years (IRC §6501(a)), HIPAA six years (45 CFR §164.530(j)); include clear retention and deletion instructions in the agreement.

Electronic Signature
Templates
Legal
Data Share Agreement

Data Share Agreement

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

DATA SHARE AGREEMENT

This Data Share Agreement (the Agreement) is entered into as of between Data Provider: , an entity organized as , with principal place of business at ; and Data Recipient: , an entity organized as , with principal place of business at .

RECITALS

WHEREAS, Data Provider possesses certain data sets and information described herein that are necessary for the Data Recipient to perform the authorized purposes set forth below; and

WHEREAS, Data Recipient desires access to specified categories of data and agrees to receive, use, process, store and protect such data in accordance with the terms and conditions of this Agreement; and

WHEREAS, the parties intend to set forth the respective responsibilities, permitted uses, security requirements and governance applicable to the data sharing contemplated by this Agreement.

NOW, THEREFORE

In consideration of the mutual promises contained herein and other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties agree as follows:

1. DEFINITIONS

1.1 "Agreement" means this Data Share Agreement including all schedules and appendices. "Confidential Information" means information that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure. "Data" means the categories of information described in Section 2. "Processing" has the meaning given under applicable data protection laws and includes collection, storage, use, disclosure, transfer and erasure.

2. DESCRIPTION OF DATA

Data to be Shared

2.1 Categories of Data: The Data includes the types, categories and fields set forth in the Data to be Shared field above and any supplemental data described in an executed schedule. 2.2 Exclusions: Data does not include data already lawfully in the public domain or data independently developed by Data Recipient without use of Data Provider’s Confidential Information.

3. PURPOSE; PERMITTED USES

Purpose of Sharing

3.1 Permitted Uses: Data Recipient shall use the Data solely for the Purpose and shall not use, retarget, sell, license or otherwise make available the Data for any other commercial or operational use except as expressly permitted in writing by Data Provider. All derivative works incorporating Data shall be treated as Data for the purposes of this Agreement.

4. TERM AND TERMINATION

Initial Term (months)

4.1 Term: This Agreement commences on the Effective Date and will continue for the Initial Term and any renewal terms expressly agreed in writing. 4.2 Termination for Cause: Either party may terminate this Agreement if the other party materially breaches any obligation and fails to cure within thirty (30) days after written notice. 4.3 Effect of Termination: Upon termination, Data Recipient shall cease use of Data and, at Data Provider’s election, securely return or destroy all copies of Data and certify destruction in writing within thirty (30) days.

5. SECURITY AND DATA HANDLING

Security Standards

5.1 Controls: Data Recipient shall implement and maintain administrative, physical and technical safeguards commensurate with industry standards to protect Data against unauthorized access, disclosure, alteration and destruction, including encryption in transit and at rest where appropriate. 5.2 Incident Response: Data Recipient shall notify Data Provider without undue delay but no later than seventy-two (72) hours after becoming aware of a security incident affecting Data and shall cooperate in investigation and mitigation efforts.

6. CONFIDENTIALITY

6.1 Obligation: Each party shall preserve the confidentiality of Confidential Information and shall not disclose it to any third party except to those employees, contractors, advisors or affiliates with a need to know and subject to confidentiality obligations at least as protective as this Agreement. 6.2 Standard of Care: Each party will exercise at least the same degree of care to protect Confidential Information as it uses to protect its own confidential information but in no event less than reasonable care.

7. DATA SUBJECT RIGHTS AND COMPLIANCE

7.1 Compliance: Each party shall comply with all applicable laws, rules and regulations regarding privacy, data protection and security in its performance under this Agreement. 7.2 Data Subject Requests: Data Recipient shall promptly notify Data Provider of any data subject request, regulatory inquiry or legal process relating to Data and shall cooperate to the extent necessary to permit Data Provider to respond and fulfill its obligations.

8. SUBPROCESSORS

8.1 Use of Subprocessors: Data Recipient may engage subprocessors to process Data provided that Data Recipient: (a) enters into a written contract with each subprocessor imposing substantially the same obligations as set forth in this Agreement; and (b) remains liable for the subprocessor’s performance. Data Recipient shall provide notice to Data Provider of any new subprocessor and permit Data Provider to object for legitimate reasons within fifteen (15) days.

9. AUDIT RIGHTS

9.1 Audit: Data Provider may, upon reasonable notice and during regular business hours, audit or engage an independent auditor to assess Data Recipient’s compliance with the terms of this Agreement, provided such audits are conducted in a manner that protects Data Recipient’s confidential business information. The parties shall cooperate and share reasonable audit findings and remediation plans.

10. REPRESENTATIONS AND WARRANTIES

Each party represents and warrants that it has the full right, authority and capacity to enter into and perform its obligations under this Agreement and that, to the best of its knowledge, the sharing of Data and the authorized uses contemplated by this Agreement do not infringe any third-party intellectual property or contractual rights.

11. INDEMNIFICATION AND LIMITATION OF LIABILITY

11.1 Indemnification: Each party shall indemnify, defend and hold harmless the other party from and against any third-party claims arising from the indemnifying party’s breach of this Agreement, gross negligence or willful misconduct. 11.2 Limitation: Except for breaches of confidentiality, indemnification obligations, and liability arising from gross negligence or willful misconduct, neither party shall be liable to the other for consequential, special, incidental or punitive damages. The aggregate liability of each party shall not exceed the fees actually paid under this Agreement in the twelve (12) months preceding the claim, unless otherwise required by law.

12. REMEDIES

The parties acknowledge that a breach of confidentiality or misuse of Data may cause irreparable harm for which monetary damages may be inadequate, and therefore the non-breaching party shall be entitled to seek injunctive or other equitable relief in addition to any other remedies available at law or in equity.

13. NOTICES

All notices required or permitted under this Agreement shall be in writing and delivered to the contact designated below by hand, nationally recognized overnight courier, or certified mail (return receipt requested).

Notices to Data Provider Notices to Data Recipient

14. AMENDMENTS; WAIVER

No amendment, modification or waiver of any provision of this Agreement will be effective unless in writing and signed by authorized representatives of both parties. A waiver of any breach shall not constitute a waiver of any subsequent breach.

15. GOVERNING LAW; VENUE

This Agreement shall be governed by and construed in accordance with the laws of the state specified below without regard to conflict of law principles. The parties consent to exclusive jurisdiction and venue of the state and federal courts located in the specified state for any disputes arising out of or relating to this Agreement.

Governing Law State

16. ENTIRE AGREEMENT; SEVERABILITY

This Agreement, including all schedules and exhibits, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, proposals and communications, whether oral or written. If any provision is held unenforceable, the remaining provisions shall remain in full force and effect and the parties shall negotiate in good faith a valid substitute provision.

17. MISCELLANEOUS

17.1 Assignment: Neither party may assign this Agreement without the prior written consent of the other, except to a successor in interest in connection with a merger or sale of substantially all assets. 17.2 Counterparts: This Agreement may be executed in counterparts, each of which will be deemed an original and all of which constitute one instrument. 17.3 Relationship of Parties: The parties are independent contractors and nothing in this Agreement creates a joint venture, partnership, employment or agency relationship.

SIGNATURES

The parties, by signing below through authorized representatives, acknowledge and agree to be bound by the terms of this Agreement.

Data Provider:

By:

Date:

Data Recipient:

By:

Date:

What a Data Share Agreement Is and When It Applies

A Data Share Agreement is a written contract that sets the terms for transferring, accessing, using, and protecting data between two or more parties. It identifies the parties, describes the categories of data to be exchanged, defines permitted uses and purpose limitations, establishes security and confidentiality obligations, sets retention and deletion rules, and allocates liabilities and remedies. These agreements are used when sensitive, regulated, or business-critical data moves across organizational boundaries and are designed to support compliance with federal law and sector-specific rules such as HIPAA, FERPA, and relevant state electronic signature statutes.

Why a Data Share Agreement Matters for Risk and Compliance

A clear Data Share Agreement reduces legal and operational risk by documenting consent, permitted uses, data minimization, and security controls. It helps parties meet regulatory obligations, limits exposure after a breach, and defines dispute resolution and liability. Properly scoped agreements also make audits and vendor oversight more efficient while clarifying responsibilities across organizations.

Who Typically Uses a Data Share Agreement

Organizations of varied sizes and industries enter Data Share Agreements whenever data crosses organizational boundaries, whether between vendors, affiliates, or research partners.

Real estate firms and brokers exchanging tenant, transaction, or title-related records during deal workflows.
Healthcare providers and business associates sharing PHI under a limited-use arrangement with a required BAA.
Financial services and accounting firms transferring customer financial data for processing and audit.

Parties should tailor each agreement to industry rules, the sensitivity of the data, and the specific operational workflow that governs exchange and use.

Core Elements to Include in a Professional Data Share Agreement

A robust agreement combines clear scope, security obligations, and operational details so both parties understand rights, restrictions, and remediation steps.

Parties & Scope

Identify each party and explicitly list data categories covered, including structured data, documents, and metadata, to avoid ambiguity during transfers.

Permitted Uses

Define allowable processing activities, purpose limitations, downstream sharing restrictions, and any required approvals before reuse.

Security Controls

Specify encryption, access controls, vulnerability management, and minimum baseline standards that each party must meet.

Data Transfer & Storage

Address cross-border transfers, hosting locations, acceptable storage formats, and responsibilities for data portability or return.

Retention & Deletion

State retention periods, deletion procedures, and timelines for data purge or secure return when the agreement ends.

Liability & Remedies

Allocate indemnities, limitations of liability, breach notification timelines, and dispute resolution or injunctive relief options.

Security and Compliance Terms to Require

Encryption: At-rest and in-transit encryption

Access Controls: Role-based permissions

Breach Notification: Prompt, defined timelines

Audit Logs: Immutable access records

Subcontractors: Flow-down obligations required

BAA Requirement: Required for HIPAA-covered data

Step-by-Step: Preparing and Signing a Data Share Agreement

Follow a clear sequence to reduce negotiation cycles and ensure operational readiness before data exchange begins.

01

Assemble Parties: Confirm legal entity names and authorized signatories.
02

Define Data: Precisely list data types, formats, and transfer mechanisms.
03

Set Controls: Agree on encryption, access, audit, and subcontractor rules.
04

Execute & Distribute: Sign all copies and circulate executed versions to stakeholders.

How to Configure the Sharing Workflow Online

Map technical settings to contract terms when implementing online exchange and automated workflows.

Field	Configuration
Access Level	Role-based roles mapped to signer and reader permissions
Authentication	MFA, SMS OTP, or identity verification based on data sensitivity
Audit Trail	Capture timestamps, IP addresses, and signer attribution
Data Transfer	Use SFTP, secure API endpoints, or encrypted file packages

Typical Operational Flow for Data Sharing

A consistent operational sequence ensures contractual and technical alignment before and during transfers.

Draft: Prepare agreement with scope and controls specified.
Approve: Legal and security teams sign off on obligations.
Implement: Configure systems, access, and logging.
Exchange: Transfer data per agreed schedule and method.

Technical and Platform Requirements for eSubmission

Ensure the technology used for execution and exchange supports the contract terms: secure transfer, auditability, and signer authentication.

File Formats: PDF, DOCX, and machine-readable CSV are standard
Integrations: Connectors for Salesforce, NetSuite, Box, Google Workspace
Authentication: Support for email, SMS OTP, or advanced ID proofing

Match platform settings to agreed controls and retain a certified audit trail for legal and compliance review.

Common Timing Expectations and Deadlines

Document specific timeframes in the agreement so performance and compliance actions are measurable and enforceable.

Effective Date:

Enter MM/DD/YYYY. This triggers obligations and retention clocks.

Data Delivery Window:

Specify the timeframe for initial and recurring transfers.

Review and Renewal:

Set periodic security and compliance review intervals.

Breach Notification:

HIPAA requires notification without unreasonable delay; 60 days for large breaches (45 CFR §164.408).

Termination Effects:

Define deadlines for data return or secure deletion after termination.

Common Mistakes to Avoid When Preparing a Data Share Agreement

Vague data descriptions that leave scope open to interpretation and increase compliance risk.
Failing to require subcontractor flow-downs, which can expose the owner to third-party breaches.
Omitting concrete retention and deletion procedures, complicating breach response and audits.
Using unclear signature authority language that results in unenforceable or delayed execution.

Principal Risks and Potential Consequences

Data Breach Liability: Civil exposure and remediation costs

Regulatory Fines: Fines under HIPAA or sector rules

Contract Termination: Loss of access or service

Reputational Harm: Customer trust erosion

Operational Disruption: Interrupted workflows and delays

Injunctions: Court-ordered restraints on use

Real-World Examples and Customer Perspectives

Organizations across sectors use Data Share Agreements to accelerate workflows while documenting compliance and security obligations in writing.

Optica Ventures LLC — Brian Fitzgibbons

Optica streamlined partner data exchanges for transactions and client onboarding.

The interface was simple and accessible for customers.
The team reported fewer follow-ups, faster completions, and consistent records for audit and customer service.

Fertility Centers of Illinois — John Butler

A healthcare practice standardized consent and data transfers with partners to protect sensitive patient records.

The API and workflows supported integrations.
The organization emphasized compliance confidence and improved timeliness when sharing medical records with labs and insurers.

Practical Tips for Accurate and Efficient Agreements

Apply consistent drafting and operational controls to reduce negotiation time and improve compliance outcomes.

Be Specific

Clearly enumerate data elements, formats, and fields to reduce ambiguity and simplify technical implementation and audits.

Match Tech to Contract

Ensure the chosen transfer method and platform settings enforce the contractual security controls and retain detailed audit trails.

Document Subcontractors

List permitted subprocessors and require equivalent obligations and audit rights to prevent downstream surprises.

Review Regularly

Schedule periodic security and legal reviews and update the agreement when business or regulatory conditions change.

eSignature Vendor Pricing and Feature Snapshot for Data Share Agreements

Compare basic pricing and feature availability across common eSignature vendors. Use plan details to assess compliance needs and volume expectations.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Bulk Send	Available on select plans	Available	Available	Available	Varies
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes (BAA required)	Yes	Yes	No	No
Envelope Cap	No envelope cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

Frequently Asked Questions About Data Share Agreements

Answers to typical legal, technical, and operational questions encountered when creating or executing Data Share Agreements.

Need help? Contact support

Can this agreement be electronically signed?
Yes. Electronic signatures are generally enforceable under the federal ESIGN Act (15 U.S.C. §7001) and state UETA implementations. Confirm the selected signature method satisfies the agreement's attribution and consent requirements and note any statutory exceptions.
Do I need a Business Associate Agreement?
If the data includes protected health information, include a HIPAA Business Associate Agreement and specify required safeguards; HIPAA requires covered entities and business associates to document responsibilities.
When is notarization required?
Notarization is uncommon for commercial data-sharing agreements but may be required for particular filings or to create self-proving affidavits; check state law before adding notarization requirements.
How do parties revoke access to shared data?
Revoke access per the contract's termination and deletion clauses, which should include timelines for return or secure destruction and procedures for notifying the other party.
What if a party uses a subcontractor?
Require subcontractor notice, written flow-down obligations, and the right to audit or require remedial actions if controls are inadequate.
How long must records be kept?
Retention depends on data type and law: IRS records three years (IRC §6501(a)), HIPAA six years (45 CFR §164.530(j)); include clear retention and deletion instructions in the agreement.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now