Rights to research data and datasets

1. Core idea and who it's for#

For many deeptech companies, the dataset is worth more than the patent. Examples include a library of measured material properties, years of instrument calibration runs, a labelled image set, a cohort of patient samples, and simulation outputs used to train a model. Data, though, is the asset founders most often assume they own when they don't.

Three facts drive everything in this playbook:

1. Raw data is mostly not "property" in the usual IP sense. Facts aren't protected by copyright. What is protected varies by country:

   • copyright in how a database is selected and arranged; a separate database right in the UK and EU;
   • trade-secret protection if the data is kept confidential;
   • contracts, such as a licence, a data use agreement or a consent form.
   • In practice, control of data comes from contracts and confidentiality , not registration.

2. The university, the funder, the data subjects and third-party providers may all have claims. The university's policy usually says it owns research data made by its staff. Funders may require the data to be shared publicly. Human participants consented to particular uses. Data from collaborators or vendors comes with licence terms.

3. Personal data adds a layer of law that applies whoever owns it: the DPDP Act in India, HIPAA and state laws in the US, UK GDPR in the UK. Consent and deidentification decide what you can use commercially.

The job at spinout is to build a data inventory, get a licence for the data you need, check that the consent and source terms allow commercial use, and set up your own data generation , so the company's future moat belongs to the company.

Who this is for: founders whose product depends on research data. That includes MLheavy companies, diagnostics and medtech built on clinical samples, materials and chemistry companies built on experimental datasets, and any spinout whose model was trained in the lab.

2. Evidence: who has a claim on research data#

Funders increasingly expect data to be shared. NIH's Data Management and Sharing Policy has applied to all NIH-funded research that generates scientific data since 25 January 2023. Applicants must submit a two-page plan and follow it. NIH expects researchers to share enough data to validate and replicate findings, including data not used in a publication and null results. Sharing can be limited for justified ethical, legal or technical reasons, for example where informed consent does not allow it (NYMC library guide). Before 2023, a sharing plan was needed only for grants of $500,000 or more a year in direct costs (KU Libraries).

For a founder this has two consequences:

• Data generated under an NIH grant may already be public, or have to become public, so it can't be your moat.
• The repository's data use agreement governs any commercial reuse of shared data. UKRI and many Indian funders, including DST and DBT, have similar open-data expectations.

Universities usually claim research data. Most university IP or research-data policies say the institution owns or controls data generated by employees on university projects. Students are often covered too when they work on funded projects. TTOs license datasets to companies, increasingly as an explicit schedule in the spinout licence (2.07). Georgetown, for example, has its technology commercialisation office review data use agreements linked to NIH data repositories (Georgetown).

India's data protection law is now coming into force. The government notified the DPDP Rules on 13–14 November 2025, with a phased rollout over 18 months, to 14 May 2027 (AZB & Partners). The three dates are 14 November 2025, 14 November 2026 and 14 May 2027 (AMS Shardul). Most operational duties, including notice, security safeguards, breach reporting, retention and the research exemption, apply from the end of the 18 months (Mondaq). Rule 16 exempts processing for research, archiving or statistical purposes if it meets the Second Schedule standards (SCC Online). Commentators note the exemption doesn't apply where results are used to make decisions about identifiable individuals (Hogan Lovells), and that "research" is not clearly defined (Takshashila).

The practical gap: research consent is not commercial consent. A dataset collected under a research exemption, or under consent "for this study", often can't legally be used to build and sell a commercial product. That holds even if the university licenses it to you. Check the consent forms, the ethics approval and the data protection basis before you build on human data.

3. Method: inventory, license, clean, then generate your own#

Step 1. Build a data inventory. List each dataset you plan to use, with:

• what it is, and its size;
• who generated it, when and under which grant;
• where it lives;
• whether it contains personal or health data;
• what consent or ethics approval covers it;
• any third-party sources inside it, such as vendor data, collaborators' data or public datasets with their own licences;
• whether it is already public, or must be shared under funder rules.

This one spreadsheet will answer most of the questions in investor due diligence later.

Step 2. Sort datasets into four groups.

Step 3. Negotiate a data licence from the university. Points to cover:

• a field-of-use exclusive or non-exclusive licence to the listed datasets, with the right to derive models and products from them;
• clarity that models trained on the data, and outputs, belong to the company , and that no royalty applies to them beyond what the licence sets;
• whether the university may keep using the data for research and publishing. That is usually fine, with a short delay;
• confirmation that the university has the right to grant the licence, including for consent and third-party data;
• what happens to the data if the licence ends. Avoid any clause that would force you to delete trained models.

Step 4. Fix the human-data basis. Work with the university's ethics committee or IRB and its data protection officer. Options:

• new consent for commercial use;
• de-identification or anonymisation to the legal standard in each country;
• federated or in-situ analysis, where you never take the data out;
• partnering with a hospital under a fresh agreement.

Budget months, not weeks.

Step 5. Start generating your own data from day one. Your own experiments, customers' data under clear contract terms, and synthetic data become the company's proprietary moat. Put data-ownership and use clauses in every customer and pilot contract, along with confidentiality terms. Keep the data in company systems, separate from the university's (2.14).

Worked example (illustrative)#

An AI-pathology spinout built its model on 40,000 slide images from the university hospital, plus a public dataset. Its inventory shows:

• Hospital images. They were collected under consent "for research into cancer diagnosis", with ethics approval that doesn't mention commercial use. The university is willing to license them, but its data protection officer won't approve commercial use under the current consent.
• Public dataset. Its licence is CC-BY-NC, so it is non-commercial.

The founders take four steps:

1. They agree a research collaboration under which the hospital keeps the old images, and the company's model is validated on them in place. The model weights belong to the company under the collaboration terms.
2. They sign commercial data agreements with two new hospital partners, using a consent form written for commercial development, to collect 25,000 new images over 12 months.
3. They retrain the production model only on commercially cleared data, and drop the CC-BY-NC set from training. They keep it only for internal benchmarking, where the licence allows.
4. They record all of this in the data room (14.10).

The seed investor's diligence takes days, not weeks, because the inventory and the consent trail are already documented.

4. India / US / UK differences#

India in practice. Until the DPDP Act's operational provisions apply in May 2027, the older IT Act rules on sensitive personal data still apply. Design for the DPDP standard now, because investors will diligence against it.

US in practice. Federal-lab and NIH datasets in public repositories come with access agreements that often restrict re-identification and sometimes commercial use. Read them.

UK in practice. The database right can protect a dataset your company builds. Keep evidence of the investment in it.

5. Scripts, mistakes, related playbooks and sources#

Scripts#

To the TTO:

"Alongside the patents, the company needs a licence to these four datasets, which are listed with their sources. We'd like it to say clearly that models and products derived from the data belong to the company. Can you confirm which ones contain personal data, and what consent and ethics approvals cover them?"

To the ethics committee or data protection officer:

"We want to develop a commercial product using data collected under protocol X. Does the existing consent and approval allow that? If not, what would a compliant route look like: re-consent, de-identification, or in-situ analysis with no transfer?"

To a pilot customer:

"During the pilot we'll process your data only to deliver the results to you. With your agreement, we'd also like to use de-identified, aggregated results to improve our models. Here is the clause, and here's what we will never do."

Common mistakes#

1. Assuming that whoever generated the data owns it. The university or the funder usually controls it.
2. Training on non-commercial data. CC-BY-NC sets or research-only data use agreements end up in a commercial model.
3. Treating research consent as commercial consent. Human data is used beyond what participants agreed to.
4. Licences that ignore models. The licence doesn't say who owns trained models and outputs, or a termination clause requires you to delete them.
5. No inventory. Diligence stalls because nobody can say where the training data came from.
6. Mixing systems. Company data sits on university servers with no agreement, which muddies who owns it and who controls it.

Related playbooks#

• 2.01 Who owns your invention
• 2.07 Licence terms
• 2.14 University labs and SRAs
• 2.16 Open source or proprietary
• 2.18 Trade secrets vs patents
• 14.10 The seed data room

Sources#

• NIH Data Management and Sharing Policy guide, NYMC Library
• NIH DMS Policy: summary, KU Libraries
• NIH data management and sharing, Georgetown University
• DPDP Act phased rollout and key compliance milestones, AZB & Partners
• DPDP Act and Rules: staggered timelines, Shardul Amarchand Mangaldas
• A closer look at the DPDP Rules 2025, Mondaq
• DPDP Rules 2025: key highlights, SCC Online
• India's DPDP Act brought into force, Hogan Lovells
• MeitY notifies DPDP Rules 2025, Takshashila Institution

The worked example is illustrative. This playbook is not legal advice: data and privacy law is jurisdiction-specific and changing, so take advice for your dataset. Last checked November 2026.