A data transfer agreement (DTA) is the legal instrument that makes a specific movement of clinical trial data — to a third-party analyst, a data repository or a partner institution — lawful, bounded and auditable. It is not the same instrument as a material transfer agreement (MTA), which covers physical specimens, or a clinical trial agreement (CTA), which governs the whole trial relationship between sponsor and site. Research administrators who conflate the three risk leaving a data movement with no defined retention period, no cross-border transfer mechanism and no liability clause.
A data transfer agreement is a standalone contract, separate from the CTA and the MTA, that fixes the permitted use, security safeguards, retention limits and legal transfer mechanism for a defined dataset moving from a data controller to a recipient. This article sets out what a clinical trial DTA covers that the other two instruments do not, and what clauses a compliant version must contain.
- What is a data transfer agreement in a clinical trial?
- DTA vs MTA: data versus physical materials
- DTA vs CTA: a narrow instrument inside a broader contract
- What clauses must a clinical trial DTA cover?
- Frequently asked questions
- What this means for sponsors, sites and data recipients
What is a data transfer agreement in a clinical trial?
A data transfer agreement is triggered whenever clinical trial data — identifiable, coded or fully anonymised — moves to a party not already bound by the trial’s main contracts: a central statistics unit, an academic secondary-use researcher, a data repository, or a partner sponsor in a licensing deal. The CTA the site signed with the original sponsor does not automatically extend data-handling obligations to that new recipient; the DTA is what does.
Unlike a CTA, a DTA is narrow by design. It does not govern how the trial is run, who is paid what, or how adverse events are reported. It governs one thing only: the terms under which a defined dataset can be received, used, stored and eventually destroyed or returned.
DTA vs MTA: data versus physical materials
The distinction between a DTA and an MTA is the distinction between data and matter. A material transfer agreement governs blood, tissue, biopsies, cell lines or investigational compounds moving between institutions — tangible items that can be depleted, contaminated or physically lost. A DTA governs the dataset, not the specimen it may have been derived from.
The two frequently travel together. A central laboratory sending biopsy slides to a specialist pathology reader needs an MTA for the slides and, if genomic or clinical annotation data accompanies them, a separate DTA for that dataset. Trying to cover data terms inside an MTA’s materials clauses is one of the most common gaps flagged in institutional research-contracting reviews.
| Instrument | What moves | Core legal basis | Typical parties | What it governs |
|---|---|---|---|---|
| Data Transfer Agreement (DTA) | Data — identifiable, coded or anonymised | UK GDPR/EU GDPR Chapter V transfer mechanisms; HIPAA Data Use Agreement (US) | Data controller/holder and a data recipient outside the original trial team | Permitted use, retention, security, cross-border transfer mechanism |
| Material Transfer Agreement (MTA) | Physical specimens or compounds | Institutional IP and biobanking policy | Material provider and recipient institution or laboratory | Ownership, permitted use, derivatives, liability |
| Clinical Trial Agreement (CTA) | The whole trial relationship | ICH-GCP E6(R2); EU Clinical Trials Regulation 536/2014 | Sponsor and investigator/site institution | Protocol conduct, funding, indemnity, publication rights |
DTA vs CTA: a narrow instrument inside a broader contract
A clinical trial agreement is the master contract between sponsor and site: it fixes protocol adherence, payment schedules, indemnification and publication rights for the entire study. Some CTAs include a data-ownership clause stating who holds the master dataset — but that clause states an outcome, not a transfer mechanism. It does not specify the cross-border legal basis, security controls, or destruction deadline that apply once data actually moves to a third party.
This gap is exactly where a DTA sits. When a sponsor later licenses anonymised trial data to a third-party analytics firm, or a site shares a dataset with an unaffiliated academic collaborator, the CTA’s ownership clause tells you who owns the data — it does not tell you the terms on which someone else may now receive it. A separate DTA closes that gap, keeping the CTA focused on trial conduct and the DTA focused on data movement — a single-purpose separation that research-contracting offices coordinated through ARMA, EARMA and INORMS increasingly recommend.
What clauses must a clinical trial DTA cover?
A compliant clinical trial DTA is built around a defined clause set. Where cross-border transfer is involved, the legal transfer mechanism clause is not optional under UK GDPR/EU GDPR Chapter V (Articles 44–49), which requires an adequacy decision, Standard Contractual Clauses, or an equivalent safeguard before personal data leaves the UK or EEA.
- Purpose limitation — the exact research use(s) the recipient may apply to the data, with no implied right to broader secondary use.
- Legal transfer mechanism — for cross-border transfers, the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914, June 2021) or the UK ICO’s International Data Transfer Agreement (IDTA), in force since 21 March 2022 and mandatory for new UK transfer contracts from 21 September 2022.
- Confidentiality and re-identification prohibition — an express bar on attempting to re-identify anonymised or pseudonymised participants.
- Security safeguards — encryption in transit and at rest, access controls, and breach-notification timelines.
- Retention and destruction/return — a fixed deadline by which the recipient must destroy or return the dataset, with certification of destruction.
- Audit and inspection rights — the data holder’s right to verify the recipient’s compliance.
- Publication and attribution terms — how the recipient may cite or publish findings derived from the data, and what data-sharing statement language applies.
Two further reference points shape this clause set. Under the HIPAA Privacy Rule (45 CFR §164.514(e)), a US covered entity sharing a “limited data set” must do so under a Data Use Agreement with materially the same content requirements as a clinical trial DTA. Since July 2018, the ICMJE has required a data-sharing statement as a condition of publication for trials reporting individual patient-level data — so the DTA’s publication and attribution clause is a downstream publication requirement, not a courtesy.
Frequently asked questions
What is a data transfer agreement in clinical trials?
A data transfer agreement (DTA) is a legally binding contract that sets the terms for moving clinical trial data from a data controller to a third-party recipient. It defines permitted use, retention limits, security safeguards and cross-border transfer mechanisms, and applies whenever data — not physical specimens — moves outside the originating study team.
What is the difference between a DPA and a DSA?
A Data Processing Agreement (DPA) binds a processor acting strictly on a controller’s instructions, as required by UK GDPR Article 28. A Data Sharing Agreement (DSA) — the closer relative of a clinical trial DTA — governs transfers between two independent controllers who each decide their own purposes for the data.
What is a material transfer agreement in clinical trials?
A material transfer agreement (MTA) governs the transfer of tangible items — blood, tissue, biopsies or investigational compounds — between institutions, covering permitted use, ownership of derivatives and liability. Unlike a DTA, an MTA never addresses data itself; a single trial commonly needs both when biological samples travel with associated datasets.
What is the purpose of a data transfer agreement?
The purpose of a data transfer agreement is to make a specific transfer of clinical trial data lawful and auditable. It fixes the legal transfer mechanism, restricts secondary use, sets retention and deletion deadlines, and assigns liability if the recipient breaches confidentiality or re-identifies anonymised participants.
What this means for sponsors, sites and data recipients
Treating the DTA as a genuine standalone instrument — not a subset of the CTA, and not interchangeable with an MTA — closes a compliance gap that institutional research-contracting offices flag repeatedly. As secondary use of trial data grows through repositories, federated analytics and cross-sponsor licensing, data movements that fall outside the original CTA’s scope will keep rising.
Research administrators, data protection officers and sponsors gain most by maintaining a standing DTA template — pre-cleared for common transfer scenarios and distinct from their MTA and CTA templates — so a new data recipient can be onboarded against a known, auditable clause set rather than a bespoke renegotiation each time.
For definitions of related contracting and data-governance terms, research administrators can consult the CASRAI dictionary of research-administration terms; broader context on how these agreements sit within institutional research operations is covered in CASRAI’s research administration content.