Why data rights are the SBIR firm's leverage
The SBIR Data Rights clause is the mechanism that makes Phase III sole-source credible. Without it, anything you develop under SBIR funding would be government property on delivery, and the program office could recompete the follow-on work using your technical data as the baseline. With it, your technical data is protected for a 20-year period during which the government has limited rights to use it, and recompeting the work without your cooperation is effectively impossible.
SBIR data rights give the firm 20 years of protection on technical data first developed under the award. March-in rights allow the government to force licensing in defined circumstances — but have rarely been exercised in 40+ years of SBIR history.
This leverage is why many experienced SBIR firms describe data rights as "the whole deal." Everything else — the $150K Phase I, the $1.8M Phase II — is R&D funding. The data rights are the commercial asset.
GOVERNMENT RIGHTS
- License to use, reproduce, and modify technical data for government purposes
- Right to share with other government contractors performing government work
- March-in rights if commercialization fails or public health / safety requires
- Background IP used in SBIR work is subject to a government-purpose license
CONTRACTOR RETAINS
- Patent rights on inventions (with a government license back)
- Trade secrets covering proprietary technical data and methods
- SBIR data rights protection for 20 years (DoD and civilian agencies)
- Right to license commercially without government approval
The 20-year protection period
Under reforms in the 2019 SBIR reauthorization and updated in subsequent cycles, SBIR data rights are protected for 20 years from the date of award. During that window the government has "SBIR Data Rights" which are a defined form of limited rights — the government can use the data for government purposes but cannot release it to competitors without the firm's consent. After the 20-year period, the data transitions to unlimited rights (government ownership).
Prior to the 2019 reform the protection period was 5 years, then 12 years in various intermediate configurations. The 20-year window is a meaningful extension that aligns better with how long it actually takes for an AI capability to mature from prototype to deployed commercial product.
What SBIR Data Rights actually cover
The rights cover technical data and computer software developed with SBIR funding. That includes algorithms, source code, trained model weights, configuration files, documentation describing methods, and any technical reports that describe how the technology works. It does not cover data that was developed outside the SBIR (pre-existing IP), data that was developed at private expense during or after the SBIR (document this carefully), or data that is freely available in the public domain.
Government Purpose Rights vs Unlimited Rights
| Rights type | Who can use the data | When it applies |
|---|---|---|
| SBIR Data Rights | Government internal use only. No release to third parties without consent. | Technical data developed under SBIR funding, during the 20-year protection period. |
| Government Purpose Rights (GPR) | Government can share with contractors for government purposes only, not commercial. | Typically applies after SBIR protection period ends OR to data developed with mixed funding. |
| Unlimited Rights | Government owns and can distribute freely. | After SBIR protection expires, or if data is developed wholly at government expense outside SBIR. |
| Limited Rights (commercial) | Very restricted government use. | Technical data developed entirely at private expense. Must be documented. |
March-in rights
The Bayh-Dole Act includes "march-in rights" that allow the government, in narrow circumstances, to require the firm to license the technology to others. The criteria are strict: the firm must have failed to take effective steps to commercialize, there must be a public health or safety need, or the technology must be needed for federal regulation compliance. Historically, march-in rights have almost never been exercised. For an SBIR firm executing its commercialization plan in good faith, march-in is not a practical risk.
However, march-in has been discussed more actively in recent policy cycles, particularly around high-cost pharmaceuticals. For AI firms the practical risk remains very low. Document commercialization effort (customers, revenue, marketing activities) in case the issue ever arises.
Marking deliverables
The protection is only enforceable if you mark the deliverables correctly. Every document, dataset, and software artifact produced under SBIR funding must bear the SBIR Data Rights legend. Missing or incorrect markings can forfeit the protection for that specific deliverable.
The standard legend (paraphrased — check your award document for exact text): "SBIR DATA RIGHTS — These SBIR data are furnished with SBIR rights under Contract No. [X]. For a period of 20 years after award, the Government agrees to use these data for Government purposes only, and they shall not be disclosed outside the Government without the express written permission of the contractor."
Mark every page of technical reports, the cover sheet of datasets, the header comments in source code, and the metadata of any delivered artifact.
What happens at the 20-year mark
At the end of the protection period, SBIR data rights expire and the data transitions to unlimited rights. The government can then release the data to contractors for competition or use it broadly. For most SBIR technology, 20 years is long enough that the original technology is obsolete by the time rights expire. For foundational algorithmic capabilities that are still relevant at year 20, firms should plan to have commercial licensing or derivative work protecting the continuing value.
Data rights in multi-phase awards
Each phase generates its own data rights. A Phase II continues the protection on Phase I data and adds protection for new Phase II data, with the 20-year clock on Phase II running from the Phase II award date. Phase III commercial contracts typically preserve SBIR data rights on prior work and add commercial-style IP terms on new work.
Pitfalls to avoid
Mixing SBIR and non-SBIR data in deliverables
If protected and unprotected data are comingled, the protection can be lost.
Failing to mark every artifact
Missing markings on source code or dataset files forfeit protection.
Accepting unlimited rights clauses in Phase III
Some Phase III COs push for unlimited rights out of habit. Decline politely — the SBIR rights travel with the technology.
Open-sourcing SBIR-funded code without consideration
Once public, the protection advantage is largely moot. Open source can be strategic but do it intentionally.
Frequently asked questions
20 years from the date of award under current statute (post-2019 reforms). After 20 years, data transitions to unlimited rights.
A rights category that lets the government share with other contractors for government purposes, but not for commercial use.
No, not during the protection period. The government has limited rights — internal use only, no release to competitors.
A Bayh-Dole provision allowing the government, in narrow circumstances (public health need, failure to commercialize), to require licensing. Historically almost never exercised.
Yes. The protection is only enforceable on marked deliverables. Mark every technical report, dataset, and source file.
SBIR data rights are preserved on SBIR-developed work. New Phase III work has commercial IP terms negotiated in the contract.