Data Sharing Agreement (DSA)

A contract between two or more parties that governs the bidirectional or multilateral exchange of data, allocating responsibilities for data quality, security, lawful basis, sub-processor use, and any controller-to-controller or joint-controller obligations.

ByCASRAI Editorial Board

· Last updated 21 May 2026

Worked examples

Is an instance

A consortium of five universities running a federated longitudinal cohort executes a multi-party DSA defining each site's role as a separate controller and the central coordinating centre's role as joint controller for the pooled analysis dataset.

Is an instance

Two NHS trusts sharing pseudonymised electronic-health-record extracts for a hypertension study sign a DSA specifying field-level data minimisation and a five-year retention limit.

Whereas a DUA is typically unidirectional (provider to recipient), a DSA frames a sharing relationship and is the instrument of choice for multi-institutional consortia, collaborative cohorts, and federated analyses. Under UK and EU data-protection law a DSA typically captures the parties' respective roles as separate controllers, joint controllers, or controller-and-processor, and incorporates the safeguards required by Articles 26 and 28 of the GDPR. The agreement also defines minimum-necessary data elements, retention periods, audit rights, breach notification timelines, and procedures for handling data-subject requests.

References

UK Information Commissioner's Office Data Sharing Code of Practice
GDPR Regulation (EU) 2016/679 Articles 26 (joint controllers) and 28 (processors)
UK Health Research Authority guidance on collaborative research agreements

Use in your systems

JATS XML <role> element

xml

<role vocab="credit"
      vocab-identifier="https://casrai.org/dictionary/"
      vocab-term="Data Sharing Agreement (DSA)"
      vocab-term-identifier="https://casrai.org/dictionary/term/data-sharing-agreement" />

Schema.org DefinedTerm (JSON-LD)

json

{
  "@context": "https://schema.org",
  "@type": "DefinedTerm",
  "name": "Data Sharing Agreement (DSA)",
  "identifier": "https://casrai.org/dictionary/term/data-sharing-agreement",
  "description": "A contract between two or more parties that governs the bidirectional or multilateral exchange of data, allocating responsibilities for data quality, security, lawful basis, sub-processor use, and any controller-to-controller or joint-controller obligations.",
  "inDefinedTermSet": "https://casrai.org/dictionary/domain/compliance-and-regulatory/",
  "url": "https://casrai.org/dictionary/term/data-sharing-agreement",
  "sameAs": [
    "DSA",
    "data-sharing contract",
    "collaborative data agreement"
  ],
  "license": "https://creativecommons.org/licenses/by/4.0/"
}