SBIR/STTR Data Rights Updates and Analyis: Six Things You Must Understand

DoD Issues Updates to Data Rights Regulations for SBIR/STTR Programs

Overview: The Department of Defense (DoD) updated its data rights regulations and contract clauses for Small Business Innovation Research (SBIR) and Small Business Technology Transfer (STTR) programs, effective January 17, 2025.
Key Change: Incorporates the Small Business Administration’s (SBA) 2019 policy shift, setting a fixed 20-year protection period for SBIR/STTR data rights from the contract award date, replacing the prior indefinite “daisy-chaining” approach.
Background: DoD has applied this change via a class deviation since 2019, now formalized in the DoD Federal Acquisition Regulation Supplement (DFARS).
Impact: Clarifies key issues and provides an opportunity to revisit SBIR/STTR data rights questions.

Purpose: Promote federal funding for small businesses in early-stage research and development.
Phases:
- Phase I: Concept development, smaller contracts.
- Phase II: Prototype development, up to $2 million or more.
- Phase III: Production and commercial application, no dollar limit, funded by non-SBIR/STTR sources.
Eligibility: Phase I and II limited to small businesses (<500 employees, 50% U.S.-owned/controlled); Phase III open to prior Phase I/II awardees or successors-in-interest.
Sole-Source Authority: Phase III contracts can be awarded without competition if derived from, extend, or complete prior SBIR/STTR efforts, as applicable to any agency or prime contractor.

Benefit: Contractors restrict the Government from sharing proprietary SBIR/STTR data outside the Government during the protection period.
Scope: Applies to technical data and computer software developed or generated under SBIR/STTR contracts.
Protection Period:
- Pre-2019: Extended indefinitely via “daisy-chaining” for up to 4 years (civilian agencies) or 5 years (DoD) after final deliverable.
- Post-2019: Fixed 20 years from contract award, then shifts to government purpose rights.
Rights Progression:
- During protection: Equivalent to “limited rights” (technical data) and “restricted rights” (software), internal Government use only.
- Post-protection: Government-purpose rights allow non-commercial third-party use; unlimited rights permit any use, including commercial use.
Competitive Risk: Post-protection, data sharing can be allowed for re-procurement, which challenges the sole-source status; however, statutory sole-source authority for Phase III remains intact.

Steps:
- Timely assert restrictions in proposals and ensure their incorporation into contracts.
- Mark data with FAR or DFARS legends before delivery.
- Maintain records that prove development occurred at private expense or under SBIR/STTR contracts.
DoD Update: DFARS 252.227-7017 now requires contractors to identify SBIR/STTR data that will be generated and delivered with rights, removing the prior exemption.
Caution: DFARS 252.227-7018 inconsistently omits this requirement; contractors should still assert rights in proposals and contracts.
Marking: It is critical to use prescribed legends; unmarked data risks an assumption of unlimited rights by the DoD.
Corrections: If the contractor did not externally distribute data, then inadvertent omissions are fixable within 6 months (or with extension), provided the Government receives clearance of prior use liability.

Determination: Governed by the contract clause under which data are developed or generated.
SBA Stance: The 2019 rule change has no retroactive effect on existing contracts.
DoD Guidance (PGI 227.7104-2):
- Data first generated under the old daisy-chaining rule retains indefinite protection if redelivered later.
- Data under the 20-year rule redelivered under the same rule expires 20 years from the date of the first contract.
- Modified data: Original portions follow the prior contract’s period; new portions follow the current contract’s period.
Ambiguity: “Developed” (constructed/tested) vs. “generated” (created/fixed) terms create confusion; rights apply to data developed or generated under SBIR/STTR contracts.
Interpretation: The protection period ties to either a development or generation contract, potentially renewing 20-year periods for new data.

Confirmation: Yes, per SBA’s SBIR Policy Directive and DFARS 227.7104-1(d).
Subcontracts: The DoD clarifies that DFARS 252.227-7018 and other clauses should flow down to Phase III subcontractors through prime contracts.

Policy: No, DoD prohibits requiring contractors to forgo SBIR/STTR data rights as a condition of award.
Negotiation: Special license rights deviating from SBIR/STTR rights can only be negotiated post-award to ensure fair competition.