1. Introduction

A data-sharing agreement (DSA) is a contract or legally binding arrangement governing the disclosure, transfer, access, use, storage, security, and subsequent sharing of data between two or more parties. These parties may include biotechnology companies, hospitals, universities, pharmaceutical manufacturers, genomic databases, government agencies, research institutions, and artificial intelligence developers.

Data-sharing agreement enforceability refers to the legal ability of a party to compel compliance with the agreement or obtain an appropriate remedy when another party breaches its obligations.

In biotechnology and biomedical research, enforceability is particularly important because data may include clinical-trial results, genomic sequences, patient records, biological research datasets, and proprietary experimental information.

The central legal question is whether the agreement creates sufficiently clear and lawful obligations, has been validly formed, complies with applicable data-protection and intellectual-property laws, and provides remedies that a court or arbitral tribunal can enforce.

2. Essential elements of an enforceable data-sharing agreement

An agreement's enforceability depends on the applicable jurisdiction. The following elements are commonly important.

A. Valid formation and contractual certainty

The agreement should identify the parties, define the data being shared, establish the permitted purposes, and specify the obligations undertaken by each party.

In India, the general contractual framework is found in the Indian Contract Act, 1872. Relevant provisions include:

Section 10: Requirements for agreements to constitute valid contracts.

Section 11: Competency of parties to contract.

Section 13: Meaning of consent.

Section 14: Free consent.

Section 23: Lawful consideration and objects.

Section 29: Agreements void for uncertainty.

A vague provision stating that a recipient may use data for “any legitimate business purpose” may create disputes about the scope of permission. A more precise clause identifies authorized research, commercial, regulatory, or analytical purposes.

B. Lawful authority to share the data

A party cannot necessarily authorize the transfer of information merely because it possesses a copy of the dataset.

The disclosing party must establish an appropriate legal basis and authority to share the data, considering:

Consent or another applicable lawful basis for processing personal data.

Restrictions arising from confidentiality obligations.

Ownership or licensing of databases and underlying intellectual property.

Ethical approvals and research-participant commitments.

Restrictions on onward transfers and international data transfers.

Contractual consent between two organizations does not automatically substitute for any separate consent or legal basis required for processing an individual's personal information.

C. Definite rights and obligations

An enforceable DSA should address the following matters expressly:

These clauses improve certainty, but their presence alone does not guarantee enforceability. Mandatory law, public policy, and the circumstances of contract formation remain relevant.

D. Consideration and lawful purpose

Under Indian contract law, consideration is generally required, subject to statutory exceptions. A data-sharing agreement may provide for payment, reciprocal access to datasets, research collaboration, computing resources, or other legally recognized consideration.

A gratuitous agreement may raise questions under Section 25 of the Indian Contract Act, 1872. The parties should not assume that a document becomes enforceable merely because it is signed.

The object of the agreement must also be lawful under Section 23. For example, an agreement to disclose confidential patient data in violation of applicable legal restrictions cannot be made lawful simply by including an indemnity clause.

3. Leading case laws on enforceability

The following decisions are relevant to data-sharing agreements through their treatment of contract formation, privacy, unlawful processing, confidentiality, and remedies. They should not all be described as cases directly deciding the enforceability of a DSA.

Case 1: Trimex International FZE Ltd. v. Vedanta Aluminium Ltd.

Supreme Court of India · (2010) 3 SCC 1

Facts: The parties exchanged commercial offers and emails concerning a transaction involving the supply of bauxite. A dispute arose over whether a binding contract and arbitration agreement had been concluded before execution of a final formal agreement.

Legal issue: Can communications exchanged by email create a binding contract even if a consolidated formal document has not been signed?

Decision: The Supreme Court recognized that a concluded contract can arise from correspondence when the essential terms have been agreed and acceptance is unconditional.

Indian Kanoon+1

Relevance to data-sharing agreements: A DSA negotiated through email, electronic signature, or an accepted online process may be enforceable without a subsequently signed master agreement, depending on the communications, applicable formalities, and the parties' intention to be bound.

For example, if a university offers a pharmaceutical company access to a specified genomic dataset on defined confidentiality and research-use conditions, and the company unequivocally accepts those terms, the absence of a later consolidated document does not necessarily defeat contract formation.

Legal principle: The substance of the parties' agreement and their communications may matter more than the absence of a single signed document.

Case 2: Justice K.S. Puttaswamy (Retd.) v. Union of India

Supreme Court of India · (2017) 10 SCC 1

Facts: The litigation concerned the constitutional status of privacy, including the implications of state collection and use of personal information.

Legal issue: Is privacy a constitutionally protected fundamental right in India?

Decision: A nine-judge bench unanimously recognized privacy as a fundamental right protected by Article 21 and the other freedoms guaranteed by Part III of the Constitution.

Indian Kanoon

Relevance to data-sharing agreements: The judgment establishes an important constitutional context for agreements involving personal, health, biometric, and genomic information.

A contract between two private companies does not, by itself, settle every constitutional question. Nevertheless, where data sharing involves state action, public authorities, or statutory privacy obligations, the constitutional framework can materially affect the lawfulness of the arrangement.

For example, an agreement permitting the transfer of patients' identifiable genomic data to an analytics company cannot automatically override the individuals' legally protected privacy interests.

Legal principle: Contractual permission and lawful authority to process personal information are separate questions.

Case 3: Lloyd v. Google LLC

UK Supreme Court · [2021] UKSC 50

Facts: The claimant sought to bring a representative action alleging that Google had collected and used browsing information from iPhone users without their knowledge or consent.

Legal issue: Could the proposed representative class recover compensation for alleged data-protection violations without establishing the relevant unlawful processing and compensable harm for each individual?

Decision: The UK Supreme Court rejected the proposed representative claim in its pleaded form. Under the applicable Data Protection Act 1998, the claimant could not obtain the claimed compensation merely by establishing that individuals belonged to the affected class; the relevant individual requirements had to be satisfied.

Bailii+1

Relevance to data-sharing agreements: This decision illustrates that data-protection duties and contractual remedies are not interchangeable. An organization may face statutory claims even where no direct contract exists between it and the affected individuals. Conversely, proving a contractual breach does not automatically establish every element of a separate damages claim.

In a biotechnology collaboration, a research participant might have a statutory or privacy-related claim against an organization even though the participant did not sign the inter-organizational DSA.

Legal principle: Identify the claimant, the source of the legal duty, the particular breach, and the requirements for the remedy sought.

Jurisdictional qualification: Lloyd interpreted historical UK legislation, not Indian law or the current EU GDPR. Its reasoning should be applied within its proper legal context.

Case 4: R (Bridges) v. Chief Constable of South Wales Police

Court of Appeal of England and Wales · [2020] EWCA Civ 1058

Facts: The claimant challenged the police use of live automated facial-recognition technology.

Legal issue: Did the use of the technology comply with applicable legal requirements concerning privacy, data protection, and equality?

Decision: The Court of Appeal found deficiencies in the legal framework governing the police's use of automated facial recognition, including non-compliance with data-protection impact-assessment requirements and the public-sector equality duty.

Bailii

Relevance to data-sharing agreements: An agreement involving biometric or facial-recognition datasets cannot replace the legal assessments, safeguards, and authorizations required of the organizations involved.

A contract that clearly specifies the data, users, and permitted purposes may still be insufficient if the actual processing violates mandatory law.

Legal principle: Contractual clarity does not cure unlawful data processing.

Comparative significance

These decisions supply relevant legal principles, but the precise result in a DSA dispute will depend on the governing law, the contract's wording, and the evidence of the alleged breach.

4. Indian statutory framework governing data-sharing agreements

A. Indian Contract Act, 1872

The Act provides the principal framework for determining whether a DSA is a valid and enforceable contract.

The statutory text is available through India Code's Indian Contract Act, 1872.

India Code+1

B. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection (DPDP) Act, 2023, is an important part of India's evolving framework for digital personal information.

However, its commencement is phased. As of 5 November 2026, many of its core processing obligations, including Sections 3–17, are scheduled to commence 18 months after the November 2025 notification, in May 2027. Certain additional provisions have different commencement dates. It is therefore inaccurate to treat the entire Act as already operative.

E-Gazette+1

For a DSA executed or performed in India, counsel should verify which provisions are in force on the relevant date and consider applicable existing requirements, including the Information Technology Act, 2000, the SPDI Rules, 2011 where applicable, and sector-specific rules.

C. Intellectual-property and confidentiality laws

Data access does not automatically transfer ownership of the data, database, software, or underlying research.

A DSA should distinguish between:

The right to access or receive data.

The right to reproduce or modify a dataset.

Ownership of database structures, software, and associated intellectual property.

Rights in inventions or discoveries arising from research.

Confidential information and trade secrets.

Rights to publish results or share derived datasets.

For example, a pharmaceutical company receiving clinical-trial data may obtain a limited research licence without obtaining ownership of the underlying database or permission to commercialize identifiable patient information.

5. Remedies for breach of a data-sharing agreement

An enforceable DSA should provide remedies that correspond to the nature of the breach and the applicable law.

1. Damages

A party may seek compensation for provable losses caused by unauthorized disclosure, wrongful use, failure to supply data, or breach of security obligations. In India, Sections 73 and 74 of the Contract Act are particularly relevant.

2. Injunctions

A court may, where legally justified, restrain unauthorized disclosure, misuse of confidential information, or continued conduct that violates enforceable rights. Injunctive relief is not automatic merely because a contract contains a confidentiality clause.

3. Return, deletion, or restricted access

Contractual provisions may require the recipient to return or delete data, suspend access, revoke credentials, and certify compliance, subject to lawful retention requirements and applicable technical limitations.

4. Arbitration or litigation

A valid dispute-resolution clause may provide for arbitration or identify the courts with jurisdiction. The clause must satisfy applicable statutory requirements and cannot necessarily exclude every form of court intervention.

Additional case law on contractual remedies

Kailash Nath Associates v. Delhi Development Authority — (2015) 4 SCC 136

The Supreme Court examined Sections 73 and 74 of the Indian Contract Act and explained the relationship between stipulated sums, penalties, and compensation for loss.

Application: A DSA cannot guarantee recovery of any arbitrary amount merely by labelling it a penalty or liquidated damages. The enforceability of a stipulated sum depends on the governing statutory principles, the terms of the agreement, and the circumstances of the breach.

IndiaCode

6. Common grounds on which enforceability may be challenged

A further issue is the distinction between a breach of the DSA and a breach of an independent legal duty. A recipient might comply with the agreement's express wording but still violate privacy legislation, or it might breach the agreement without causing the particular damage required for a statutory compensation claim.

7. Practical example: Biotechnology research data

Suppose a university in India agrees to share pseudonymized clinical-trial data with a pharmaceutical company for biomarker research.

The agreement permits use only for a specified research project and prohibits re-identification and onward disclosure without authorization.

The pharmaceutical company subsequently combines the dataset with other records, identifies participants, and shares the information with an advertising company.

The legal analysis would involve several distinct questions:

Contract formation: Was the DSA validly concluded, and were the relevant restrictions incorporated into it?

Scope of permission: Did the combination of datasets and re-identification exceed the authorized purposes?

Confidentiality: Did the recipient breach express or implied confidentiality obligations?

Data protection: Was the processing lawful under the legislation applicable at the time?

Evidence: Can the parties establish access logs, data transfers, contractual notices, and the actual uses of the information?

Remedies: Is an injunction, deletion order, damages, contractual termination, or another remedy available?

If the university can establish an enforceable restriction and a breach, it may have a contractual claim. Affected participants may also have separate rights under applicable law. The precise outcome depends on the evidence, the contractual terms, and the relevant legal regime.

8. Best practices for maximizing enforceability

Organizations preparing a DSA should:

Define the dataset, authorized purposes, recipients, and permitted operations precisely.

Identify the legal basis and authority for sharing the data.

Document acceptance, signing authority, and contract amendments.

Specify confidentiality, cybersecurity, breach notification, and audit obligations.

Distinguish data access rights from intellectual-property ownership.

Establish rules for derived datasets, AI training, publication, and onward transfers.

Include appropriate retention, deletion, and exit procedures.

Draft proportionate liability, indemnity, and damages provisions.

Select a valid governing-law and dispute-resolution mechanism.

Review the agreement against mandatory privacy, research-ethics, and sector-specific requirements.

9. Conclusion

Data-sharing agreement enforceability depends on more than signatures. The agreement must create sufficiently certain obligations, be validly formed, pursue a lawful purpose, and remain consistent with mandatory law.

The Indian Contract Act provides the core contractual framework, while Trimex supports electronic contract formation, Puttaswamy establishes the constitutional importance of privacy, and Lloyd and Bridges illustrate the separate legal constraints applicable to data processing.

There is no single universal rule that makes every DSA enforceable. Each agreement must be assessed according to its wording, the nature of the data, the parties' authority, the governing jurisdiction, and the remedies sought.

For a more targeted legal analysis, the most useful next step is to examine data-sharing agreement enforceability under Indian law specifically, including relevant statutory provisions, case-law citations, and a model clause checklist for biotechnology and clinical-trial datasets.