SBIR/STTR Data Rights

SBIR/STTR data rights are the special federal data-rights clauses that attach automatically to Small Business Innovation Research (SBIR) and Small Business Technology Transfer (STTR) awards, protecting the technical data and computer software a small-business awardee generates under the award from being disclosed to competitors or used by the government to compete the follow-on work. They are a real, commercially significant protection distinct from patent rights — a company can hold strong data rights on work it never patents at all.

What triggers SBIR/STTR data rights

The protection attaches automatically, by operation of the contract’s incorporated clauses, to any technical data or computer software generated “in the performance of” an SBIR or STTR-funded effort — no separate application or registration is required. The controlling clause depends on the awarding agency’s acquisition regulation:

• Civilian agencies (NSF, NIH/HHS, DOE, NASA, USDA, etc.) generally use FAR 52.227-20, Rights in Data—SBIR Program.
• DoD uses DFARS 252.227-7018, Rights in Other Than Commercial Technical Data and Computer Software—Small Business Innovation Research Program and Small Business Technology Transfer Program, the DFARS clause specific to SBIR/STTR (distinct from the general DFARS 252.227-7013 technical-data clause used on non-SBIR defense contracts).

Data generated entirely at private expense, outside the funded scope of work — for example using a company’s own independent R&D (IR&D) budget in parallel with the award — falls outside SBIR data rights altogether and is governed purely by the company’s own trade-secret and contractual protections.

The protection period: 20 years, with a civilian/DoD wrinkle worth knowing

SBA’s SBIR/STTR Policy Directive (most recently reissued May 2, 2019) set a uniform, non-extendable 20-year data-rights protection period, running from the date of the Phase I, II, or III award. DFARS 252.227-7018 was amended to codify this directly, effective for contracts dated on or after January 17, 2025: 20 years from the date of award (not the date of final deliverable, which was the older, DoD-deviation-era trigger), after which the government’s license converts from unlimited use to perpetual government-purpose rights rather than reverting to full public availability.

The civilian FAR clause text at 52.227-20 has a wrinkle: it has not itself been rewritten to state 20 years — read literally, it still specifies a 4-year protection period. Civilian agencies are expected to apply the Policy Directive’s 20-year period regardless, typically via agency-specific solicitation language that incorporates the Policy Directive’s model clause on top of the FAR text. An awardee working with a civilian agency should confirm the specific clause language in its award document rather than assume the bare FAR citation controls.

What the government can and cannot do with the data

During the protection period, the government may use SBIR/STTR data only for government purposes internally (evaluation, its own further R&D, etc.) and may not release or disclose it outside the government — including to another contractor bidding on a follow-on solicitation — without the awardee’s permission. This is precisely what makes the protection commercially significant: it prevents an agency from using the SBIR performer’s own technical data package to help a competitor underbid the follow-on production or sustainment contract. Data properly marked with the required SBIR/STTR data-rights legend puts the government on notice of the restriction; unmarked data delivered without any restrictive legend can be treated as furnished with unlimited rights, so correct marking at delivery matters as much as the underlying entitlement.

How this differs from patent rights

SBIR/STTR data rights and patent rights are independent regimes that often run in parallel but protect different things:

• Patent rights protect the underlying invention itself, require an affirmative filing, novelty and non-obviousness, and result in public disclosure of the invention in exchange for an exclusionary right (see 35 U.S.C. § 102 patent novelty and invention disclosure timing and provisional patent applications). Ownership of inventions made under a federally funded award is separately governed by the Bayh-Dole Act framework for the university-subcontractor context.
• SBIR/STTR data rights protect the technical data and software artifacts — drawings, test data, source code, manuals — regardless of whether any patent is ever filed on the underlying technology, by restricting what the government can do with those specific deliverables.

A company can hold full 20-year data rights on a technical data package describing an invention it deliberately chose not to patent (for example, to avoid public disclosure), and conversely, filing a patent does not by itself extend or replace the data-rights clock on the underlying data package — the two protections are asserted and tracked separately, and a technology transfer or contracts office should manage them as separate deliverables in any award record.

Why this matters commercially

For an SBIR/STTR awardee heading toward licensing or Phase III commercialization, SBIR data rights are often what makes the government’s Phase III sole-source contracting authority (15 U.S.C. § 638(r)(4); FAR 6.302-5) commercially meaningful in practice: because the government cannot hand the awardee’s own technical data package to a competitor, it has a strong practical incentive to continue sole-source contracting with the original SBIR performer for follow-on production rather than re-competing on the open market using data it cannot legally share.

Related concepts

See SBIR (Small Business Innovation Research) and SBIR Phase II for general program mechanics, SBIR/STTR reauthorization for the statutory authority the program itself operates under, and federal contracts vs. grants for university research for how FAR-governed data rights compare to grant-based IP terms more broadly.