Data ownership in outsourced research

Introduction

Data ownership in outsourced research refers to the legal rights and responsibilities associated with research data generated, collected, processed or analysed by an external organisation under a contractual arrangement. Universities, pharmaceutical companies, biotechnology laboratories and research institutions frequently outsource research activities to contract research organisations (CROs), private laboratories, data analytics companies and independent investigators.

Such arrangements create important legal questions concerning who owns the research data, who can access it, who may publish research findings and who is responsible for protecting confidential information.

For example, when a pharmaceutical company appoints a CRO to conduct clinical trials, the CRO may collect patient information, laboratory results and clinical observations. However, the contractual rights over these records may belong partly or entirely to the sponsoring organisation, subject to applicable privacy, intellectual property and regulatory requirements.

Legal framework in India

1. Indian contract act, 1872

The Indian Contract Act, 1872, provides the legal foundation for outsourcing agreements.

Section 10 establishes the requirements for valid contracts, while Section 37 requires parties to perform their contractual obligations. Section 73 provides compensation for loss or damage caused by contractual breach.

Research outsourcing agreements should clearly define:

Ownership and permitted use of research datasets.

Confidentiality obligations.

Rights to publish research findings.

Data transfer and storage responsibilities.

Restrictions on third-party disclosure.

Responsibilities after contract termination.

A clearly drafted agreement reduces disputes between sponsors, researchers and external service providers.

2. Copyright act, 1957

The Copyright Act, 1957, protects original literary, artistic and other qualifying works.

Section 17 establishes rules concerning first ownership of copyright, while Section 18 addresses assignment of copyright. Section 19 prescribes requirements for valid copyright assignments.

Research databases, reports, software code and original documentation may receive copyright protection where statutory requirements are satisfied.

However, raw facts, observations and individual data points are not automatically protected by copyright. Ownership of a dataset must therefore be distinguished from copyright in its original compilation or documentation.

3. Digital personal data protection act, 2023

The DPDP Act, 2023, regulates the processing of digital personal data.

Section 4 establishes requirements for lawful processing, Section 6 addresses consent and Section 8 establishes obligations of data fiduciaries.

Outsourcing research does not automatically transfer the legal responsibilities of the organisation determining the purpose and means of processing personal data.

Contracts should specify how external research providers may access, process, secure and disclose personal information. The Act's application must also be considered in light of its relevant commencement provisions.

Important principles governing data ownership

1. Contractual allocation of ownership

The research agreement should clearly identify whether the sponsor, research institution or external service provider owns particular datasets.

For example, a pharmaceutical company may retain contractual rights over clinical trial datasets, while the CRO receives limited rights to process those datasets for the agreed research purpose.

2. Intellectual property rights

Research outputs may contain inventions, software, databases, scientific reports and technical methods.

Ownership depends on applicable intellectual property legislation, employment arrangements, contractual assignments and the nature of the research output.

Patent ownership should also be distinguished from ownership of experimental records and underlying scientific data.

3. Confidentiality and trade secrets

Outsourced research may involve commercially sensitive information, including unpublished experimental results, manufacturing processes and pharmaceutical formulations.

Confidentiality clauses and appropriate access restrictions help prevent unauthorised disclosure or commercial exploitation.

4. Publication and academic freedom

Research institutions and individual investigators may seek to publish scientific findings.

Outsourcing agreements should establish publication review procedures, confidentiality restrictions and reasonable arrangements for patent filing before publication.

Important case laws

1. Eastern Book Company v. D.B. Modak (2008)

The Supreme Court of India examined copyright protection and the originality requirement in legal publications.

The Court recognised that copyright protection requires sufficient skill and judgment rather than mere mechanical effort.

Relevance: The judgment helps determine whether an organised research database or dataset compilation qualifies for copyright protection. It also clarifies that collecting facts alone does not automatically establish copyright ownership.

2. Indian Performing Right Society Ltd. v. Eastern Indian Motion Pictures Association (1977)

The Supreme Court examined copyright ownership and contractual relationships involving creative works.

The judgment discussed the importance of statutory ownership rules and contractual arrangements in determining rights over protected works.

Relevance: Outsourced research agreements should clearly establish copyright ownership in research reports, software, publications and other original outputs.

3. Feist Publications, Inc. v. Rural Telephone Service Co. (1991)

The United States Supreme Court held that factual information is not protected by copyright merely because considerable effort was spent collecting it.

Protection may arise where the selection or arrangement of information demonstrates sufficient originality.

Relevance: This decision is important for outsourced research datasets because sponsors and CROs must distinguish ownership of contractual data rights from copyright protection over an original database structure.

4. University of London Press Ltd. v. University Tutorial Press Ltd. (1916)

The English court examined originality in educational materials and recognised that copyright does not require novelty in the patent-law sense.

Relevance: The decision provides a foundational principle for determining whether original research documentation and reports qualify for copyright protection.

Contractual safeguards and compliance measures

Research organisations should establish comprehensive outsourcing agreements containing:

Clear ownership provisions for raw data and research outputs.

Confidentiality and non-disclosure obligations.

Defined rights to access, process and reuse datasets.

Data protection and cybersecurity responsibilities.

Publication and intellectual property provisions.

Data retention, return and deletion requirements.

Audit rights and breach notification procedures.

Dispute resolution and liability clauses.

Organisations should also maintain records identifying the origin of datasets, persons responsible for processing and any subsequent transfers to third parties.

Challenges in outsourced research

Disputes frequently arise when contracts do not distinguish between raw data, processed datasets, research reports and inventions. Additional difficulties occur when researchers use pre-existing databases or third-party software.

International outsourcing may create jurisdictional conflicts involving intellectual property, privacy and cross-border data transfers. Therefore, agreements should identify applicable law, dispute resolution procedures and permitted international transfers.

Conclusion

Data ownership in outsourced research requires careful coordination between contractual rights, intellectual property protection, confidentiality and personal data protection. The Indian Contract Act, 1872, Copyright Act, 1957, and Digital Personal Data Protection Act, 2023, provide important legal foundations. Judicial decisions such as Eastern Book Company v. D.B. Modak and Feist Publications v. Rural Telephone Service clarify the distinction between factual information and copyright-protected compilations. Research organisations should establish clear ownership clauses, confidentiality obligations, publication rights and data security responsibilities to prevent disputes and ensure accountable research collaboration.