Is an electronic signature enforceable?

Yes. Electronic signatures are legally valid under the federal ESIGN Act (15 U.S.C. §7001) and UETA where adopted; ensure intent, consent, attribution, and retention are documented.

When is notarization required?

Most data sharing agreements do not require notarization. If a jurisdiction or specific regulatory rule requires a notarized acknowledgement, follow state notary rules or RON procedures where available.

Do I need a HIPAA addendum?

If the data includes protected health information and a recipient acts as a business associate, include a Business Associate Agreement and reference HIPAA obligations and breach notification procedures.

How should I handle subprocessors?

List authorized subprocessors or require prior consent for new subprocessors; include audit rights and obligations to flow down equivalent security commitments.

What if a state law conflicts with the agreement?

State law may impose additional requirements; do not rely solely on the template—modify clauses to comply with specific state statutes such as the NY SHIELD Act or CCPA where applicable.

How long should records be retained?

Follow the retention clause in the agreement and applicable law: for example, HIPAA records require six years (45 CFR §164.530(j)); retain other records per IRS or industry rules.

Electronic Signature
Templates
Miscellaneous
Data Sharing Agreement Template

Data Sharing Agreement Template

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

DATA SHARING AGREEMENT

Parties and Effective Date

This Data Sharing Agreement ("Agreement") is entered into as of by and between:

Disclosing Party Name:

Disclosing Party Address

Receiving Party Name:

Receiving Party Address

Recitals

WHEREAS, Disclosing Party possesses certain Data (as defined below) that is relevant to the performance of mutual business objectives and is willing to make such Data available to Receiving Party on the terms set forth in this Agreement;

WHEREAS, Receiving Party desires to receive, use and process the Data for the Permitted Purpose described in this Agreement and agrees to maintain appropriate safeguards and restrict uses and disclosures consistent with the terms herein;

NOW, THEREFORE, in consideration of the mutual covenants and promises contained herein, the parties agree as follows.

Definitions

"Data" means the specific datasets, records, files, and associated metadata identified in this Agreement, including personal data and any derived datasets resulting from processing. Data categories to be shared (check all that apply):

Data Categories

Personal Data De-identified / Anonymized Data Aggregated Data Sensitive Data

Scope of Work

The parties agree that Disclosing Party will share Data with Receiving Party solely for the Permitted Purpose described below. Receiving Party shall not use the Data for any other purpose without the prior written consent of Disclosing Party.

Permitted Purpose / Scope of Work

Data Security and Handling

Receiving Party shall implement and maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the Data to protect against unauthorized access, disclosure, alteration or destruction. These safeguards shall include, at minimum, access controls, encryption for Data in transit and at rest where practical, secure disposal procedures, and restrictions on onward transfers.

Security Standard Reference (if any)

Permitted Use and Restrictions

Receiving Party may use the Data solely to perform the Scope of Work and for no other commercial purpose. Receiving Party shall not (a) sell, lease, sublicense or otherwise make the Data available to third parties except as expressly permitted in writing; (b) attempt to re-identify de-identified Data; or (c) create any derivative product that competes with Disclosing Party's core business without prior written consent.

Payment Terms

As consideration for the Data sharing and associated services, Receiving Party shall pay Disclosing Party the amounts and according to the schedule set forth below.

Payment Amount (total) Payment Schedule / Milestones Late Payment Fee

Term and Termination

This Agreement commences on the Start Date and continues until the End Date unless earlier terminated in accordance with this section.

Start Date: End Date:

Notice Period for Termination

Either party may terminate this Agreement for material breach by the other party if the breaching party fails to cure the breach within the notice period specified above. Disclosing Party may immediately suspend data access if Receiving Party's use creates an immediate risk of harm or unauthorized disclosure.

Confidentiality

Each party shall keep confidential and not disclose to any third party any Confidential Information of the other party except as permitted by this Agreement. Confidential Information includes the Data and any non-public business, technical or financial information marked or reasonably understood to be confidential. Receiving Party shall limit access to Confidential Information to employees, contractors and agents who have a need to know and who are bound by confidentiality obligations at least as protective as those in this Agreement.

Breach Notification and Remedies

Receiving Party shall notify Disclosing Party without undue delay upon becoming aware of any unauthorized access to or disclosure of the Data. Notification shall describe the nature of the incident, the Data affected, remedial actions taken and proposed future measures. Remedies for breach include injunctive relief, termination, and recovery of damages, including costs of notification, investigation and mitigation.

Audit Rights and Compliance

Disclosing Party may, upon reasonable notice and during normal business hours, audit Receiving Party's compliance with this Agreement. Receiving Party shall comply with applicable data protection laws and maintain records demonstrating compliance. Receiving Party shall promptly implement any corrective measures reasonably required by Disclosing Party following an audit.

Data Retention and Destruction

Receiving Party shall retain Data only for the period necessary to accomplish the Permitted Purpose or as required by law. Upon expiration or termination of this Agreement, Receiving Party shall return or securely destroy the Data within the timeframe specified below and certify such destruction upon request.

Data Retention Period

Indemnification and Liability

Each party shall indemnify and hold harmless the other party from third-party claims arising from its negligent or willful breach of this Agreement. Except for liability arising from a party's intentional misconduct or gross negligence, neither party's aggregate liability shall exceed the total fees paid under this Agreement in the twelve months preceding the claim.

Governing Law and Dispute Resolution

This Agreement shall be governed by and construed in accordance with the laws of the State of without regard to its conflict of laws principles. The parties shall attempt in good faith to resolve disputes through negotiation prior to initiating litigation.

Notices

All notices required or permitted under this Agreement shall be in writing and delivered to the addresses set forth below or such other address as a party may designate in writing.

Disclosing Party Notice Contact Receiving Party Notice Contact

Entire Agreement; Amendments

This Agreement constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior agreements and understandings. Any amendment or modification must be in writing and signed by authorized representatives of both parties.

Miscellaneous

If any provision of this Agreement is held to be invalid or unenforceable, the remainder of the Agreement shall remain in full force and effect. The parties are independent contractors and nothing in this Agreement creates a partnership, joint venture, or agency relationship.

Disclosing Party:

By:

Date:

Receiving Party:

By:

Date:

What a Data Sharing Agreement Template Is

A Data Sharing Agreement Template is a standardized legal document that records the terms, scope, and permitted uses when one party provides data to another. It defines the parties, categories of shared data, purpose and legal basis for sharing, security and handling obligations, retention and deletion schedules, permitted recipients and subprocessors, and dispute-resolution mechanisms. The template saves time by providing preformatted clauses for liability, confidentiality, compliance (HIPAA/FERPA/CCPA where applicable), audit rights, and breach notification procedures so organizations can adapt the agreement to a specific transaction without drafting from scratch.

Why a Standard Template Matters for Data Transfers

Using a template reduces negotiation time, ensures consistent treatment of privacy and security requirements, and documents legal responsibilities that support regulatory compliance under ESIGN/UETA and sector rules such as HIPAA and FERPA.

Who Typically Uses a Data Sharing Agreement Template

These templates are used by organizations that routinely exchange data with vendors, partners, or affiliates, and by legal, privacy, or IT teams that need predictable contractual protections.

Small and mid-size businesses sharing analytics or customer lists with third-party processors, where standard clauses speed contracting.
Healthcare organizations and covered entities sharing de-identified or limited data with researchers or vendors under HIPAA business associate arrangements.
Technology firms and SaaS providers onboarding customers and partners that require clear data handling, security, and breach-notification obligations.

A clear template reduces operational friction and helps ensure every data exchange includes the same minimum protections and auditability.

Who Has Authority to Sign

Authorized Signatory

Typically a corporate officer, general counsel, or delegated contract manager with written signing authority. The signer should be empowered to bind the organization and accept data-processing obligations, warranties, and indemnities on the company's behalf.

Data Recipient Representative

Operationally responsible person such as the head of security, privacy officer, or vendor account manager who can confirm technical safeguards, identify subprocessors, and commit to retention and deletion obligations in the agreement.

Core Clauses to Include in a Professional Template

A robust Data Sharing Agreement Template organizes obligations so each party’s duties are clear, enforceable, and auditable across the lifecycle of the data.

Parties and Roles

Identify the data controller/owner, the recipient, and any subprocessors. Specify whether each party acts as controller, processor, or joint controller and allocate responsibilities accordingly.

Scope and Purpose

Describe the categories of personal and non-personal data, the precise purposes for processing, and any prohibited secondary uses to prevent unintended reuse.

Security Requirements

Specify required technical and organizational measures, encryption expectations (in transit and at rest), access controls, and required certifications or audits.

Breach Notification

Require prompt notification timelines, responsibilities for forensic investigation, regulator notice assistance, and required remedial measures.

Retention and Deletion

Set retention periods, deletion or return procedures at termination, and obligations for backups and archived copies.

Liability and Indemnity

Allocate risk through liability caps, carve-outs for willful misconduct, insurance expectations, and indemnification for third-party claims.

Essential Information to Capture

Parties: Name, mailing address, contact and legal entity type

Data Categories: Personal data types, special categories, and identifiers

Purpose: Permitted processing purpose and limitations

Security Controls: Encryption, access control, and logging requirements

Retention: Retention duration and disposition instructions

Subprocessors: Authorized subprocessors and approval process

Step-by-Step: Completing the Template

Follow a consistent sequence to reduce review cycles and ensure each clause is tailored to the transaction.

01

Prepare Parties: Confirm legal names and authorized signers before editing.
02

Define Scope: List precise data categories and processing purposes.
03

Set Controls: Insert required security, audit, and breach procedures.
04

Review & Sign: Legal review, operational sign-off, then execute with eSign.

How to Customize and Complete the Template Online

Configure the online workflow to collect signatures, attach exhibits, and preserve an audit trail for compliance.

Field	Configuration
Parties Block	Auto-fill from CRM records to reduce errors
Signature Fields	Require signer name, title, date, and email verification
Conditional Clauses	Show confidentiality or HIPAA addendum only when relevant
Audit Trail	Enable IP, timestamp, and certificate capture

Where to Send or Store the Executed Agreement

Decide destinations in advance and configure automatic routing on signature completion to keep records consistent.

Primary Repository: Store executed PDF in secure document management system
Legal Copy: Send a signed copy to legal counsel for contract filing
Operational Access: Grant access to data stewards with role-based permissions
Auditor Access: Preserve a tamper-evident copy and audit log for inspections

Digital Signing and File Format Requirements

Choose a platform that supports secure PDFs, audit trails, and the authentication strength required by your industry and regulators.

File Formats: PDF and Word DOCX supported; export signed PDF/A for archival
Authentication Options: Email, SMS, KBA, or advanced signer authentication per policy
Integrations: Connectors available for Salesforce, NetSuite, Microsoft 365

Retain signed records in a secure repository with AES-256 at-rest encryption and maintain the audit trail for evidentiary requirements.

Timelines, Notice Periods, and Processing Expectations

Some timelines are contract-defined; others derive from privacy laws or sector-specific rules—set clear deadlines in the template.

Effective Date:

When obligations begin; use MM/DD/YYYY format

Notice to Terminate:

Commonly 30–90 days unless otherwise negotiated

Data Access Requests:

CCPA response window: 45 days to respond

Breach Notification:

HIPAA standard: notify affected parties without unreasonable delay

Record Retention Start:

Retention clocks usually begin on effective date

Key Milestones from Negotiation to Termination

Plan milestones to coordinate legal review, security validation, transfer, and wind-down activities.

01

Negotiation

Agree scope, security, and liability terms before execution.

02

Legal Review

Internal counsel and privacy officer approve final text.

03

Execution

All parties sign and save executed copies plus audit logs.

04

Data Transfer & Termination

Begin transfers, then follow deletion or return instructions at end of term.

Notarization and Witness Steps (When Required)

Most data sharing agreements do not require notarization, but some transactions or jurisdictions may demand additional authentication; follow these steps when notarization or witnesses are necessary.

01

Determine Requirement

Confirm contract or statutory need for notary or witness

02

Select Notarization Type

In-person notarization or RON if state law permits

03

Signer Identification

Use government ID, credential analysis, or multi-factor

04

Record Session

For RON, retain audio-video recording per state rules

05

Witnesses

Provide witness signature lines when jurisdiction requires

06

Notary Journal

Notary records event details and document description

07

Attach Acknowledgement

Include notary acknowledgment as executed exhibit

08

Store Evidence

Keep notarization records with executed agreement

Common Mistakes to Avoid

Vague scope language that permits unintended reuse of data
Omitting security specifications or leaving controls undefined
Failing to list subprocessors or to require prior notice
Not aligning retention language with applicable regulatory periods

Risks and Consequences of an Incorrect Agreement

Regulatory Fines: Fines and enforcement actions under HIPAA/CCPA

Contract Liability: Breach of contract damages and indemnity exposure

Data Breach Costs: Remediation, notification, and forensic expense

Business Disruption: Operational delays and loss of customer trust

Criminal Exposure: Willful violations may trigger criminal penalties

Litigation Risk: Class actions or third-party claims for misuse

Practical Tips for Accurate and Efficient Completion

These practices reduce rework, speed approvals, and strengthen enforceability for standard data sharing arrangements.

Limit Data to What’s Necessary

Specify minimal data categories and narrow purposes. Minimization reduces exposure and simplifies compliance obligations across jurisdictions and audits.

Use Clear, Measurable Controls

Avoid vague security promises. Specify encryption standards, access controls, logging frequency, and periodic audit rights to allow operational verification.

Align Retention with Law

Map retention clauses to federal and state retention rules and record any exceptions. Clear timelines help operational teams implement deletion workflows correctly.

Require Subprocessor Transparency

Include a subprocessors schedule or prior-approval mechanism and require notification of any new subprocessors to preserve control over third-party access.

Real-World Examples of Template Use

Organizations adopt templates to standardize recurring exchanges and reduce negotiation cycles while preserving regulatory controls.

Optica Ventures (COO)

Optica standardized data-sharing terms across investor reporting to reduce legal review time.

The template limited permitted uses and automated audit rights.
As a result, they reduced contract turnaround and ensured consistent security commitments across portfolio companies without repeated redlines.

Martin Properties (Founder)

A regional real estate firm used a template for tenant data transfers to property managers.

The agreement required specific retention and deletion steps.
That approach clarified responsibilities, improved tenant privacy handling, and reduced disputes about access and retention practices.

eSignature Pricing and Feature Comparison

Compare starting prices and core capabilities when selecting an eSignature provider to execute Data Sharing Agreement Templates; signNow is listed first for parity.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial, no credit card	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Bulk Send	Yes (Business Premium)	Yes	Yes	Yes	Varies by plan
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes (BAA available)	Yes	Yes	No	No

FAQs and Troubleshooting for the Template

Answers to common questions about enforceability, signatures, and practical implementation for Data Sharing Agreement Templates.

Need help? Contact support

Is an electronic signature enforceable?
Yes. Electronic signatures are legally valid under the federal ESIGN Act (15 U.S.C. §7001) and UETA where adopted; ensure intent, consent, attribution, and retention are documented.
When is notarization required?
Most data sharing agreements do not require notarization. If a jurisdiction or specific regulatory rule requires a notarized acknowledgement, follow state notary rules or RON procedures where available.
Do I need a HIPAA addendum?
If the data includes protected health information and a recipient acts as a business associate, include a Business Associate Agreement and reference HIPAA obligations and breach notification procedures.
How should I handle subprocessors?
List authorized subprocessors or require prior consent for new subprocessors; include audit rights and obligations to flow down equivalent security commitments.
What if a state law conflicts with the agreement?
State law may impose additional requirements; do not rely solely on the template—modify clauses to comply with specific state statutes such as the NY SHIELD Act or CCPA where applicable.
How long should records be retained?
Follow the retention clause in the agreement and applicable law: for example, HIPAA records require six years (45 CFR §164.530(j)); retain other records per IRS or industry rules.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now