Data and Materials Sharing Agreement Guidance

University investigators are encouraged to share data and materials to advance research and discovery. The University must ensure that such sharing is consistent with applicable laws, sponsor requirements, and University policy. In most cases, an agreement is required when sending data and materials outside the University. The following provides a summary of the relevant guidelines. 

1. High Risk Data or Materials – Agreement Required

An agreement is required before any external sharing of high-risk data and biospecimens. Including, but not limited to:

• Protected Health Information (PHI),  Personally Identifiable Information (PII) ,or other regulated human subject data subject to HIPAA, FERPA, GDPR, or similar laws or regulations.
• Human genomic data or biospecimens, whether identifiable or coded.
• Government controlled data, such as export controlled information, or other regulated data.
• Data or materials received under contractual restrictions (e.g., industry-sponsored research or consortium agreements).
• Any data or materials where unauthorized disclosure could cause material harm to research participants, the investigator, or the University.

2. Moderate Risk Data – Agreement Required

Moderate Risk data includes unpublished or preliminary research data that do not contain regulated data elements but are not intended for public release. Examples include draft datasets, internal analyses, and non-public grant-related research records.   Investigators should expect that an agreement will be required when:

• Data are shared with an external academic, non-profit, or industry collaborator.
• The investigator or sponsor needs to limit how the data may be used, re-shared, or published.
• Intellectual property, confidentiality, or attribution must be addressed.

In limited circumstances, Moderate Risk data may be shared without a formal agreement if appropriate review and documentation are in place; however it is always best practice to have an agreement in place. 

3. Low Risk Data – Agreement May Not be Required

Low-risk data are intended for public disclosure or pose minimal risk if shared. Examples include:

• Published research findings.
• Publicly available information.

Formal sharing agreements are generally not required for Low-Risk data unless required by a sponsor, journal, data repository, or collaboration-specific terms.

4. Human Biospecimens – Special Requirements – Agreement Required

The sharing of human biospecimens generally requires an MTA, regardless of identifiability. Investigators working with NIH-funded biospecimens must also comply with the NIH Policy on Enhancing Security Measures for Human Biospecimens (NOT-OD-25-160), which places additional restrictions on storage, access, and international sharing, particularly with countries of concern. Biospecimens may not be transferred without an executed agreement and institutional approval.