Can a DSA be signed electronically?

Yes. Electronic signatures are legally enforceable under the federal ESIGN Act (15 U.S.C. ch. 96) and state UETA statutes in 49 states; validate signature intent, consent, attribution, and retention to meet the ESIGN four‑part test.

When is a HIPAA addendum required?

A HIPAA Business Associate Agreement or addendum is required whenever a covered entity shares protected health information for use or disclosure; include specific safeguards and reference 45 CFR §164.502(e) and §164.530.

Do DSAs need notarization or witnesses?

Generally no for data sharing contracts; notarization or witnesses are rarely required unless state law or a related instrument requires them. Confirm if a specific state or court filing triggers notarization requirements.

How do I withdraw consent for electronic records?

Provide a clear withdrawal process in the consumer disclosure per ESIGN (15 U.S.C. §7001(c)), show how to request paper records, and document the effective date of withdrawal in workflows.

What if a signer lacks authority?

If signatory authority is unclear, include an authority representation and require corporate resolution or officer certification; lack of authority can render the agreement voidable.

How long should I keep signed DSAs?

Retain signed DSAs for the contract term plus applicable legal minimums: at least 3 years for tax records (IRC §6501(a)) and 6 years for HIPAA-related records (45 CFR §164.530(j)); consider longer retention for litigation hold or industry rules.

Electronic Signature
Templates
Legal
Legal DSA Agreement

Legal DSA Agreement

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

LEGAL DSA AGREEMENT

This Data Sharing Agreement ("Agreement") is entered into as of by and between Party A: , organized as Corporation Partnership Individual Government with principal place of business at ; and Party B: , organized as Corporation Partnership Individual Government with principal place of business at .

RECITALS

WHEREAS, Party A and Party B each possess certain data and information described herein that each party is willing to share for the limited purposes set forth in this Agreement; and

WHEREAS, the parties desire to establish the terms and conditions under which shared data will be disclosed, received, processed, secured, and used, including protections for confidentiality, privacy, security breach notice and regulatory compliance; and

WHEREAS, the parties intend that this Agreement allocate responsibilities and limit uses of the shared data to the permitted purposes described below.

NOW, THEREFORE, in consideration of the mutual promises contained herein, the parties agree as follows:

1. DEFINITIONS

For purposes of this Agreement, the following terms shall have the meanings set forth below:

"Shared Data" means all categories of information and data described in Section 2 that a Disclosing Party provides to a Receiving Party under this Agreement, including Personal Data and any derivative data produced by processing Shared Data.

"Personal Data" means information relating to an identified or identifiable natural person as defined under applicable law and as further described in the data description field below.

2. DATA DESCRIPTION AND PURPOSE

Data to be shared:

Data categories: Personal Data Sensitive Personal Data De-identified Data Aggregate Data

Purpose of sharing:

3. SCOPE AND PERMITTED USE

The Receiving Party shall use Shared Data solely for the Purpose, and shall not use, disclose, sell, license, distribute or otherwise make Shared Data available for any other purpose without the prior written consent of the Disclosing Party. The Receiving Party shall limit access to Shared Data to personnel with a need to know and who are subject to obligations of confidentiality and use no less protective than those set forth in this Agreement.

4. DATA SECURITY AND HANDLING

The Receiving Party shall implement and maintain administrative, technical and physical safeguards appropriate to the sensitivity of the Shared Data, including encryption in transit and at rest where applicable. Security measures to be implemented:

The Receiving Party shall maintain reasonable policies for secure storage, access control, logging, vulnerability management, and employee training, and shall ensure subcontractors adhere to equivalent safeguards by contract.

5. CONFIDENTIALITY

Each party shall treat Shared Data as Confidential Information. Confidential Information shall not be disclosed except as permitted by this Agreement or required by law. Confidential Information excludes information that is demonstrably: (a) already known to the recipient without obligation of confidentiality; (b) publicly available other than by breach of this Agreement; (c) rightfully obtained from a third party without restriction; or (d) independently developed without use of the Shared Data.

6. DATA SUBJECT RIGHTS AND COMPLIANCE

The parties shall cooperate to respond to requests from data subjects or regulators related to Shared Data. The Receiving Party shall promptly notify the Disclosing Party of any request that may affect the Disclosing Party's obligations and shall not respond to such request without giving the Disclosing Party a reasonable opportunity to review and, where appropriate, to respond or object.

Each party warrants that it will process Shared Data in compliance with applicable data protection and privacy laws, including lawful basis for processing Personal Data and any required notices or consents.

7. BREACH NOTIFICATION

The Receiving Party shall notify the Disclosing Party of any confirmed or reasonably suspected security incident affecting Shared Data without undue delay and, in any event, no later than hours of discovery. Notification shall include details of the incident, data categories affected, the remedial actions taken, and the contact information for the incident response lead.

8. AUDIT AND INSPECTION

The Disclosing Party shall have the right, upon reasonable notice and during normal business hours, to audit the Receiving Party's compliance with this Agreement, including inspection of relevant security policies, procedures and records. Audits shall be conducted in a manner that does not unreasonably interfere with the Receiving Party's business operations. The Receiving Party shall promptly remedy any material noncompliance identified by such audit.

9. RETURN OR DESTRUCTION

Upon expiration or termination of this Agreement, or upon written request of the Disclosing Party, the Receiving Party shall promptly return or securely destroy Shared Data in its possession, including all copies, unless retention is required by law. If destruction is infeasible, the Receiving Party shall securely isolate the retained data and continue to protect it in accordance with this Agreement.

10. INDEMNIFICATION; LIMITATION OF LIABILITY

Each party (Indemnifying Party) shall indemnify, defend and hold harmless the other party (Indemnified Party) from third-party claims arising out of the Indemnifying Party's breach of this Agreement, negligence, or willful misconduct in connection with Shared Data. Except for liability arising from gross negligence, willful misconduct, or indemnification obligations, neither party's aggregate liability under this Agreement shall exceed the fees actually paid or payable by the parties under this Agreement in the twelve (12) months preceding the claim.

11. TERM AND TERMINATION

This Agreement shall commence on the Effective Date and shall continue for a period of years unless earlier terminated as provided herein. Either party may terminate this Agreement for material breach by the other party if the breach remains uncured for a period of thirty (30) days after written notice.

12. NOTICES

All notices required or permitted under this Agreement shall be in writing and delivered to the addresses set forth below by certified mail, overnight courier, or email (with confirmation of receipt).

Notice Contact for Party A Notice Contact for Party B

13. AMENDMENTS; WAIVER

No modification, amendment or waiver of any provision of this Agreement shall be effective unless in writing and signed by duly authorized representatives of both parties. The waiver of any breach shall not be deemed a waiver of any other breach.

14. ASSIGNMENT; COUNTERPARTS

Neither party may assign this Agreement without the prior written consent of the other party, except to a successor by merger or acquisition. This Agreement may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one instrument.

15. GOVERNING LAW; SEVERABILITY; ENTIRE AGREEMENT

Governing law: The validity, interpretation and performance of this Agreement shall be governed by the laws of without regard to conflict of laws principles.

Severability: If any provision of this Agreement is held invalid or unenforceable, the remaining provisions shall remain in full force and effect and the parties shall endeavor in good faith to replace the invalid provision with a valid provision that preserves the parties' intent.

Entire Agreement: This Agreement constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, proposals and communications, whether oral or written.

16. MISCELLANEOUS PROVISIONS

Relationship of Parties: The parties are independent contractors and nothing in this Agreement shall be construed to create a partnership, joint venture, agency, or employment relationship. Neither party shall have authority to bind the other.

Subprocessors: Where the Receiving Party engages subprocessors to process Shared Data, the Receiving Party shall impose written obligations on such subprocessors that are no less protective than those in this Agreement and shall remain liable for the subprocessors' compliance.

Party A:

By:

Date:

Party B:

By:

Date:

What the Legal DSA Agreement Is and When It Applies

A Legal DSA Agreement (Data Sharing Agreement) is a written contract that defines permitted data exchanges between parties, the purpose for sharing, security and privacy requirements, retention rules, and liability allocation. It governs what data may be transferred, how it may be used, who may access it, and technical safeguards. In regulated contexts the DSA supplements broader contracts or privacy notices and may incorporate industry-specific controls such as HIPAA addenda, PCI requirements, or contractual audit rights to protect personal and sensitive information.

Why a Legal DSA Agreement Matters

A clear DSA reduces compliance risk, preserves contractual rights, clarifies responsibilities for security and incident response, and sets expectations for data retention and deletion. It helps demonstrate a reasonable administrative, technical, and physical safeguard approach under laws such as HIPAA and applicable state privacy rules.

Who Typically Prepares or Signs a DSA

Organizations that exchange personal, proprietary, or regulated data commonly use DSAs to document permitted uses, controls, and retention.

In-house counsel and contracts teams who negotiate liability and governing law provisions.
Privacy, security, and compliance officers who validate technical and administrative safeguards.
Business owners and vendors who operationalize data transfers and enforce permitted uses.

Use this checklist to identify internal owners and external counterparties who should review and sign the agreement before data flows begin.

Essential Data and Security Items to Include

Data Scope: Specific data categories shared

Permitted Use: Authorized processing purposes

Security Controls: Encryption and access limits

Breach Protocol: Notification timing and owner

Retention: Storage duration and deletion

Audit Rights: Inspection and reporting terms

Step-by-Step: How to Complete a Legal DSA Agreement

Follow these steps to prepare, review, and execute a DSA so the agreement accurately reflects operational controls and legal obligations.

01

Draft core terms: Define parties, data, purpose, and retention.
02

Map technical controls: Document encryption, access, and logging measures.
03

Legal review: Counsel confirms liability, indemnities, and compliance clauses.
04

Execute and log: Signatures captured and copies stored by each party.

How to Configure an Online DSA Workflow

Set up repeatable e-sign and review steps to reduce friction and preserve audit trails for compliance.

Upload document template	Store master DSA in PDF or Word format for reuse.
Assign roles	Designate signer order and reviewers.
Set required fields	Add mandatory signature, date, and initial fields.
Add authentication	Enable email verification, SMS code, or KBA where needed.
Enable audit trail	Capture timestamps, IP, and action history automatically.

Where to Send or File the Executed DSA

After execution, route and file signed copies in location(s) that meet legal and operational needs and allow rapid retrieval for audits or incident response.

Primary Custodian: Legal or contracts repository with version control
Security Team: Retain for incident correlation and access logs
Business Owner: Keep operational copy at project level
Counterparty: Each party stores a signed copy with audit certificate

How to Distribute and Share a DSA Securely

Choose distribution channels that protect confidentiality and preserve an audit trail when exchanging or signing DSAs.

Secure eSign: Platform with audit trail
Encrypted email: TLS or end-to-end encryption
Enterprise storage: SSO and role-based access

Key Timelines, Deadlines, and Processing Expectations

Track timing for negotiation milestones, execution, data transfers, and any statutory notice obligations affected by the DSA.

Negotiation window:

Typical 1–4 weeks depending on complexity

Execution deadline:

Align with project start or data transfer date

Breach notification timing:

Often 72 hours to 30 days as contract specifies

Retention triggers:

Starts on effective date or data receipt

Renewal review:

Annual or on contract renewal, per governance

Common Preparation Errors to Avoid

Undefined data scope — failing to list data fields and categories leads to downstream misuse or disputes over permitted processing.
Vague security language — generic promises without measurable controls create enforcement gaps and fail regulatory expectations.
Missing authority to sign — unsigned or improperly executed agreements can be challenged if signatories lack corporate authority.
Unclear retention rules — absent deletion or return obligations increase legal risk and potential regulatory penalties.

Primary Risks and Contractual Consequences

Regulatory fines: Violations can trigger agency penalties

Data breach costs: Remediation and notification expenses

Contract termination: Counterparty may suspend services

Indemnity exposure: Significant financial liability

Reputational harm: Customer and partner trust erosion

Operational disruption: Suspension of data transfers

Real-world Examples with Legal and Operational Context

These concise examples show how organizations use DSAs to manage risk and comply with industry rules while enabling business operations.

Optica Ventures (COO)

Optica needed a repeatable DSA for partner data exchanges

They standardized permitted uses and logging
The agreement cut review time across deals and provided clear audit trails for compliance and vendor onboarding.

Fertility Centers (Founder)

A healthcare provider required patient data sharing with labs

They added a HIPAA addendum and breach protocol
The DSA ensured required safeguards, documented BAA terms, and preserved patient privacy while enabling timely lab reporting.

Core Components of a Professional Legal DSA Agreement

A well-drafted DSA includes precise clauses that align legal obligations with technical controls and operational practices to minimize ambiguity and regulatory exposure.

Parties

Clear identification of each legal entity, including corporate form and contact for notices, to avoid disputes about who has obligations under the agreement.

Data Description

Detailed list of the data types, categories, and examples included or excluded to ensure consistent interpretation and prevent unauthorized sharing.

Permitted Uses

Explicitly state allowed processing activities and prohibit secondary uses such as marketing, resale, or reidentification without express consent.

Security Controls

Specify minimum technical and organizational measures such as encryption, access controls, logging, and vulnerability management expectations.

Incident Response

Define breach notification timelines, investigative responsibilities, and remediation steps to meet contractual and regulatory expectations.

Termination and Return

Obligations to return or securely delete shared data on termination, including verification and timelines to reduce residual data risk.

eSignature Vendor Comparison for DSA Execution

Basic pricing and feature differences among common eSignature platforms; signNow is listed first per vendor-comparison convention.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial, no credit card required	No	No	Yes, limited	Yes, limited
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Frequently Asked Questions About Legal DSA Agreements

Answers to common operational and legal questions about preparing, signing, and enforcing DSAs in the United States.

Need help? Contact support

Can a DSA be signed electronically?
Yes. Electronic signatures are legally enforceable under the federal ESIGN Act (15 U.S.C. ch. 96) and state UETA statutes in 49 states; validate signature intent, consent, attribution, and retention to meet the ESIGN four‑part test.
When is a HIPAA addendum required?
A HIPAA Business Associate Agreement or addendum is required whenever a covered entity shares protected health information for use or disclosure; include specific safeguards and reference 45 CFR §164.502(e) and §164.530.
Do DSAs need notarization or witnesses?
Generally no for data sharing contracts; notarization or witnesses are rarely required unless state law or a related instrument requires them. Confirm if a specific state or court filing triggers notarization requirements.
How do I withdraw consent for electronic records?
Provide a clear withdrawal process in the consumer disclosure per ESIGN (15 U.S.C. §7001(c)), show how to request paper records, and document the effective date of withdrawal in workflows.
What if a signer lacks authority?
If signatory authority is unclear, include an authority representation and require corporate resolution or officer certification; lack of authority can render the agreement voidable.
How long should I keep signed DSAs?
Retain signed DSAs for the contract term plus applicable legal minimums: at least 3 years for tax records (IRC §6501(a)) and 6 years for HIPAA-related records (45 CFR §164.530(j)); consider longer retention for litigation hold or industry rules.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now