Data sharing agreements with platforms

Introduction

Data sharing agreements are legally binding arrangements between organisations that establish the conditions under which information may be collected, accessed, transferred, processed or disclosed through digital platforms. These agreements are increasingly important in biotechnology, healthcare, artificial intelligence, pharmaceutical research, e-commerce and scientific collaboration.

Digital platforms frequently exchange information with research institutions, hospitals, pharmaceutical companies, cloud service providers and analytics organisations. Such information may include personal details, medical records, genetic information, clinical trial results, financial records and research datasets.

Without proper contractual safeguards, data sharing may result in privacy violations, unauthorised disclosure, intellectual property disputes and cybersecurity risks. Therefore, data sharing agreements establish clear responsibilities, permitted purposes, confidentiality obligations and accountability mechanisms.

Legal framework in India

1. Digital personal data protection act, 2023

The Digital Personal Data Protection Act, 2023, provides the principal framework for processing digital personal data in India.

Section 4 establishes requirements for lawful processing, Section 6 addresses consent, and Section 8 specifies obligations of data fiduciaries.

Under this framework, organisations sharing personal data through digital platforms must ensure that the processing has an appropriate lawful basis and complies with applicable requirements.

A data sharing agreement cannot independently create permission to process personal information where the processing otherwise lacks a lawful basis.

The Act's provisions must also be considered in light of their relevant commencement notifications and rules.

2. Information technology act, 2000

The Information Technology Act, 2000, provides legal recognition to electronic records and electronic signatures.

Section 4 recognises electronic records, while Section 5 recognises electronic signatures subject to statutory requirements.

Section 43 addresses unauthorised access and damage to computer systems, and Section 66 covers specified computer-related offences.

These provisions are relevant when organisations execute digital data sharing agreements and exchange information through electronic platforms.

3. Indian contract act, 1872

The Indian Contract Act, 1872, governs the contractual relationship between data-sharing organisations.

Section 10 establishes the requirements for valid contracts, Section 37 requires contractual performance, and Section 73 provides compensation for losses resulting from contractual breaches.

Therefore, agreements should clearly establish the rights and obligations of data providers, receiving organisations and platform operators.

4. Copyright act, 1957

The Copyright Act, 1957, protects original works, including qualifying databases and research compilations.

Section 14 defines the exclusive rights of copyright owners, while Sections 18 and 19 regulate copyright assignments.

Data sharing agreements should specify whether receiving organisations can reproduce, modify, publish or commercially exploit protected datasets.

Essential elements of data sharing agreements

1. Purpose and scope of data sharing

The agreement should identify the information being shared and explain the specific purpose for which it may be used.

For example, a biotechnology company sharing clinical trial datasets with an AI platform should specify whether the information can be used only for research analysis or also for developing commercial machine-learning models.

2. Data ownership and intellectual property

The agreement should distinguish between ownership of original datasets, copyright in database structures, software rights and intellectual property generated through research.

It should also clarify whether the receiving organisation receives ownership rights or merely limited permission to use the information.

3. Privacy and confidentiality

Organisations should establish confidentiality obligations and appropriate safeguards for personal information.

Agreements should specify access restrictions, encryption requirements, disclosure limitations and procedures for handling privacy complaints.

4. Data security and breach notification

Platform operators should maintain appropriate cybersecurity measures, including authentication, encryption, access controls and security monitoring.

The agreement should identify responsibilities for reporting security incidents and cooperating during investigations.

5. Retention and deletion

The agreement should establish how long information may be retained and explain the procedure for returning or deleting data after the contractual purpose ends.

6. Audit and accountability

Data providers should have appropriate rights to examine compliance with contractual security and processing obligations.

Agreements should also identify liability, indemnification arrangements and dispute resolution procedures.

Important case laws

1. Justice K.S. Puttaswamy v. Union of India (2017)

The Supreme Court recognised privacy as a fundamental right under Article 21 of the Constitution.

The judgment recognised informational privacy and established that interference with privacy must satisfy legality, legitimate purpose and proportionality.

Relevance: Data sharing agreements involving personal information must respect privacy rights. Contractual arrangements should establish clear purposes, appropriate safeguards and restrictions on unnecessary disclosure.

2. K.S. Puttaswamy v. Union of India (Aadhaar case, 2018)

The Supreme Court examined the constitutional validity of Aadhaar and considered issues concerning biometric information, data collection and private-sector access.

The Court upheld the Aadhaar framework subject to important limitations and safeguards.

Relevance: The judgment demonstrates that sharing identity-related and biometric information requires appropriate legal authority and safeguards. Digital platforms cannot assume unrestricted rights to access or use sensitive identity information.

3. Central Inland Water Transport Corporation Ltd. v. Brojo Nath Ganguly (1986)

The Supreme Court examined oppressive contractual conditions and the impact of unequal bargaining power.

The judgment recognised that certain unfair contractual terms may be contrary to public policy.

Relevance: Large digital platforms may impose standard-form data sharing agreements on smaller organisations. The decision provides broader principles for examining unreasonable contractual conditions and unequal bargaining power.

4. Google Spain SL v. AEPD and Mario Costeja González (2014)

The Court of Justice of the European Union examined the processing of personal information by search engines and recognised important data protection responsibilities.

Relevance: The judgment demonstrates that digital platforms handling personal information must consider individual privacy rights and the legal consequences of processing and making information accessible.

5. Facebook, Inc. v. Duguid (2021)

The United States Supreme Court examined the interpretation of the Telephone Consumer Protection Act in relation to automated telephone systems.

Relevance: Although the case did not directly concern data sharing agreements, it demonstrates the importance of clear statutory interpretation when regulating digital communication technologies. Platform agreements should similarly define permitted data uses and relevant compliance responsibilities precisely.

International standards and regulatory principles

International data sharing arrangements are also influenced by the European Union's General Data Protection Regulation (GDPR).

Articles 5 and 6 address data processing principles and lawful bases, while Articles 28 and 32 establish requirements concerning processors and security measures.

Articles 44–49 regulate international transfers of personal data.

These provisions are particularly relevant to multinational platforms exchanging research, healthcare and commercial information across different jurisdictions.

Compliance measures for organisations

Organisations should adopt the following practices when entering data sharing agreements:

Conduct due diligence before selecting a platform.

Define the purpose and scope of information sharing.

Identify the respective legal responsibilities of the parties.

Establish confidentiality and cybersecurity obligations.

Specify intellectual property and commercial usage rights.

Restrict unauthorised onward sharing.

Establish data retention and deletion procedures.

Provide audit and monitoring rights.

Establish breach notification and dispute resolution procedures.

Review agreements periodically to reflect legal and technological changes.

Conclusion

Data sharing agreements with digital platforms are essential for ensuring lawful information exchange, protecting intellectual property and maintaining accountability. In India, the Digital Personal Data Protection Act, 2023, Indian Contract Act, 1872, Copyright Act, 1957, and Information Technology Act, 2000, provide important legal foundations. Judicial decisions such as Puttaswamy, Central Inland Water Transport Corporation and Google Spain establish broader principles concerning privacy, contractual fairness and digital accountability. Organisations should therefore adopt transparent agreements covering permitted data uses, confidentiality, security, ownership, retention and liability to ensure responsible data sharing.