Data Ownership

Data ownership is the question of who holds legal title to, and control over, a research dataset. In a research context this is a genuinely contested and often legally imprecise term: for most federally funded and institutionally hosted research, no single “owner” doctrine cleanly answers the question the way it does for physical property. What actually governs who can access, share, publish, or reuse a dataset is a layered set of rights — institutional policy, the funder’s terms and conditions, the Data Management Plan (DMP), any Data Sharing Agreement or Data Use Agreement, and the researcher’s employment or student agreement — not a single ownership claim. Many research-administration specialists and funders now prefer stewardship or custodianship as the more accurate operational concept, precisely because “ownership” implies a clean, exclusive title that the actual legal and contractual landscape rarely provides.

Why “ownership” is a loose term for research data

Ownership, in the strict legal sense, is most secure for things that are eligible for property or copyright protection. Raw factual data — measurements, observations, survey responses — is generally not copyrightable on its own; copyright protects an original selection, arrangement, or expression, not the underlying facts. That leaves most claims over research data resting on other legal bases: contract (the funding agreement, the sponsor’s terms and conditions, a data-sharing or data-use agreement), institutional policy (a university asserting a policy-based claim over data generated using its facilities, funds, or personnel), employment law (data produced within the scope of a researcher’s job duties), and, for regulated data, statute (e.g., privacy law governing personal or health data, which constrains what any “owner” can do with it regardless of title). Because these bases can point in different directions on the same dataset, a research administrator is usually better served asking three separate questions instead of the single question “who owns this”: who has the right to retain and control access to the data, who has the right to direct its use, and who is accountable for its responsible management over time.

Who typically holds what rights

The institution

At most U.S. research universities, institutional policy asserts that the university (not the individual principal investigator) holds ownership or ownership-like rights over research data created using university facilities, funds, or personnel, subject to sponsor terms and conditions. This is a policy choice made by the institution, not a uniform requirement imposed by federal law. The University of California’s Research Data Policy is a clear, published example: it states that the Regents of the University of California retain ownership of research data created by University researchers and principal investigators during the course of University research, a position the policy traces back to a 1958 systemwide regulation providing that laboratory notebooks and other original research records are university property. Other research universities (Northwestern and the University of Minnesota among them) publish comparable policies asserting institutional ownership of data generated within the scope of employment or using substantial university resources, while typically carving out an exception for data students generate purely for their own academic coursework. Because this is policy-driven rather than statutory, the exact allocation of rights varies by institution — a research administrator should always confirm the specific language in their own institution’s research data or intellectual property policy rather than assume a single default applies everywhere.

The researcher

The individual researcher, including the principal investigator, is very rarely the outright legal “owner” of data produced under a federally funded or institutionally supported project. Instead, institutional policy typically designates the PI as the primary steward of the data for the life of the project — responsible for its collection, quality, security, and retention — without that role conferring personal ownership. This distinction matters in practice: a departing researcher generally cannot take institutionally owned research data with them without the institution’s consent (commonly handled through a data transfer or material transfer process), even though they may retain rights to continue analyzing it or to be named as an author on resulting publications.

The funder

Federal funders generally do not claim ownership of research data either. For U.S. federal awards, 2 CFR §200.315 (part of the OMB Uniform Guidance governing federal grants) addresses rights in data rather than ownership: it lets the recipient copyright work developed under the award while reserving the federal government a royalty-free, nonexclusive, irrevocable license to use it for federal purposes, and it separately requires the recipient to make available, on request, the research data underlying published findings that the government relied on in a regulatory action. NIH’s Data Management and Sharing Policy, similarly, governs planning for and sharing of data — it does not itself adjudicate who owns the data, leaving that question to institutional policy and the specific award’s terms and conditions. In practice, the funder’s real leverage over a dataset comes through the conditions attached to the award (data-sharing timelines, deposit mandates, retention periods, allowable-use restrictions), enforced through the sponsored-research agreement, not through a competing ownership claim.

Data subjects and source communities

Where data originates from human research participants or from Indigenous communities, additional governance frameworks constrain use regardless of who holds institutional title. Human-subjects data is bounded by what participants actually consented to, independent of who “owns” the file. For Indigenous data specifically, the CARE Principles (Collective Benefit, Authority to Control, Responsibility, Ethics) and Canada’s OCAP® Principles (Ownership, Control, Access, Possession), stewarded by the First Nations Information Governance Centre, assert that the community itself — not the researcher or the host institution — holds governance authority over data about it, a genuinely distinct and separately negotiated layer that a standard institutional data-ownership policy does not automatically resolve.

Data ownership vs. data stewardship and custodianship

Ownership is a claim to legal title and the residual right to decide what happens to something. Data stewardship is an operational, accountability-based role: the person or function responsible for the day-to-day management of a dataset — organizing deposits, maintaining metadata, applying retention and security controls, and keeping a DMP current — regardless of who holds title to it. Custodianship is closely related to stewardship and is often used interchangeably with it in research-data contexts: a custodian has physical or technical possession and day-to-day responsibility for a dataset without necessarily holding an ownership claim over it. This is why research-data-management guidance increasingly steers institutions toward stewardship or custodianship language rather than ownership language in policy and DMP text: it describes accountability accurately without asserting a property claim that may not hold up, or may conflict with the funder’s own terms, once tested. See Data Stewardship and the Data Curator Role in Research for how this plays out operationally, including how it differs from the closely related Data Curator and Data Curation functions.

Practical implications: who can actually share, publish, or reuse the data

Because there is rarely a single ownership doctrine to appeal to, the practical answer to “can I share/publish/reuse this dataset” is almost always found in a combination of four documents, not one:

• The institution’s research data or intellectual property policy — establishes the institutional baseline (who holds title or ownership-like rights by default).
• The sponsor’s terms and conditions / the sponsored research agreement — may impose sharing mandates, publication delays, or use restrictions that override the institutional default for that specific award; see Sponsored research agreement.
• The DMP — the working document that operationalizes access, sharing timelines, and reuse permissions for the specific dataset; see How to Describe Reuse Rights and Permissions for a Shared Dataset.
• Any executed Data Sharing Agreement or Data Use Agreement with an external collaborator or third-party recipient — the instrument that actually grants (or restricts) a named party’s right to receive and use the data, independent of who holds underlying ownership. See Data Sharing Agreements Between Collaborators and Institutions and Data Sharing Agreement vs. Data Processing Agreement for how these instruments differ from each other.

A researcher wanting to deposit a dataset in a public repository, license it for reuse, or hand it to an external collaborator should check all four before assuming their own judgment as “the person who did the work” settles the question — particularly on federally funded projects, where the sponsor’s own data-sharing requirements and any human-subjects or export-control constraints can independently limit what even the institution-as-owner is free to authorize. This is also why the term is worth distinguishing from adjacent, better-defined intellectual-property concepts: patentable inventions arising from federally funded research are governed by the distinct statutory framework of the Bayh-Dole Act (title to patentable inventions, not to the underlying data itself), and any copyrightable expression within a dataset or its documentation is governed by ordinary copyright law and, where applicable, a licence — both narrower, more legally settled questions than “who owns this data.”

References

• 2 CFR §200.315, Intangible Property (OMB Uniform Guidance), ecfr.gov.
• NIH Data Management and Sharing Policy (NOT-OD-21-013), grants.nih.gov.
• University of California Research Data Policy (issued August 9, 2022; effective July 15, 2022), policy.ucop.edu.
• Office of Research Integrity (HHS), “Data Ownership,” ori.hhs.gov.
• Global Indigenous Data Alliance, CARE Principles for Indigenous Data Governance, GIDA-global.org; First Nations Information Governance Centre, OCAP® Principles, fnigc.ca.