DSA (Data Sharing Agreement): What It Covers

Data Sharing Agreement (DSA)

A contract between two or more parties that governs the bidirectional or multilateral exchange of data, allocating responsibilities for data quality, security, lawful basis, sub-processor use, and any controller-to-controller or joint-controller obligations.

ByCASRAI Editorial Board

· Last updated 15 Aug 2026

Ask about Data Sharing Agreement (DSA)

Answers are drawn from this dictionary entry and the rest of the CASRAI corpus, with a link to every source.

Answers are AI-generated from CASRAI’s own published pages and can be wrong, so check the linked sources before relying on one; your question is logged without personal data — never sold, never used to train a third-party model — to show us what CASRAI is missing, so please do not type personal or confidential details. How we use this

Worked examples

Is an instance

A consortium of five universities running a federated longitudinal cohort executes a multi-party DSA defining each site's role as a separate controller and the central coordinating centre's role as joint controller for the pooled analysis dataset.

Is an instance

Two NHS trusts sharing pseudonymised electronic-health-record extracts for a hypertension study sign a DSA specifying field-level data minimisation and a five-year retention limit.

A Data Sharing Agreement (DSA) is a contract between two or more parties that governs the bidirectional or multilateral exchange of data, allocating responsibilities for data quality, security, lawful basis, and any controller-to-controller or joint-controller obligations. Unlike a Data Use Agreement, which is typically unidirectional, a DSA is the instrument of choice for multi-institutional consortia, collaborative cohorts, and federated analyses.

Under UK and EU data-protection law a DSA typically captures the parties' respective roles as separate controllers, joint controllers, or controller-and-processor, and incorporates the safeguards required by Articles 26 and 28 of the GDPR. The agreement also defines minimum-necessary data elements, retention periods, audit rights, breach notification timelines, and procedures for handling data-subject requests.

References

UK Information Commissioner's Office Data Sharing Code of Practice
GDPR Regulation (EU) 2016/679 Articles 26 (joint controllers) and 28 (processors)
UK Health Research Authority guidance on collaborative research agreements

Frequently Asked Questions

What is the difference between a Data Sharing Agreement and a Data Use Agreement?

A Data Sharing Agreement governs bidirectional or multilateral data exchange among two or more parties, whereas a Data Use Agreement is typically unidirectional, covering one party’s use of data supplied by another. DSAs are the instrument of choice for multi-institutional consortia, collaborative cohorts, and federated analyses, where every party is both sharing and receiving data rather than one party simply supplying it to another.

What is the difference between a DSA and a DPA?

A Data Sharing Agreement addresses parties acting as separate controllers or joint controllers who exchange data with each other. A Data Processing Agreement (DPA) instead governs a controller instructing a processor to handle data on its behalf, the arrangement required under GDPR Article 28. A single collaboration can need both: a DSA between the controllers, plus a separate DPA if either party engages a processor. See Data Sharing Agreement vs. Data Processing Agreement for a full comparison.

When do you need a Data Sharing Agreement?

A DSA is needed whenever two or more separate parties exchange data as controllers, joint controllers, or controller-and-processor, such as in a multi-institutional research consortium or a collaborative cohort study. It is the appropriate instrument for that kind of multi-party, ongoing exchange rather than a one-off, unidirectional transfer, which is more typically handled by a Data Use Agreement.

What does a Data Sharing Agreement typically include?

A DSA typically defines each party’s role as a separate controller, joint controller, or controller-and-processor, and sets out minimum-necessary data elements, retention periods, audit rights, breach-notification timelines, and procedures for handling data-subject requests. Under UK and EU data-protection law, these terms are shaped by the safeguards required under GDPR Articles 26 and 28.

Use in your systems

JATS XML <role> element

xml

<role vocab="credit"
      vocab-identifier="https://casrai.org/dictionary/"
      vocab-term="Data Sharing Agreement (DSA)"
      vocab-term-identifier="https://casrai.org/dictionary/term/data-sharing-agreement" />

Schema.org DefinedTerm (JSON-LD)

json

{
  "@context": "https://schema.org",
  "@type": "DefinedTerm",
  "@id": "https://casrai.org/dictionary/term/data-sharing-agreement",
  "name": "Data Sharing Agreement (DSA)",
  "identifier": "https://casrai.org/dictionary/term/data-sharing-agreement",
  "description": "A contract between two or more parties that governs the bidirectional or multilateral exchange of data, allocating responsibilities for data quality, security, lawful basis, sub-processor use, and any controller-to-controller or joint-controller obligations.",
  "inDefinedTermSet": "https://casrai.org/dictionary/domain/compliance-regulatory#set",
  "url": "https://casrai.org/dictionary/term/data-sharing-agreement",
  "sameAs": [
    "DSA",
    "data-sharing contract",
    "collaborative data agreement"
  ],
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "publisher": {
    "@id": "https://casrai.org/#organization"
  },
  "dateModified": "2026-08-15T04:36:52",
  "inLanguage": "en"
}