SBIR Data Rights
SBIR data rights protection, government obligations, and practical implications for Phase III contracting.
Purpose
This primer explains the scope and application of SBIR data rights protections under the Small Business Innovation Research (SBIR) program. Understanding what is and is not protected by SBIR data rights enables government staff to fulfill their stewardship obligations while maintaining effective use of all deliverables under the contract.
Statutory and Regulatory Framework
| Authority | Description |
|---|---|
| 15 U.S.C. § 638(g) | Protection of Information — Requires agencies to protect SBIR-developed technical data and computer software from unauthorized disclosure |
| DFARS 252.227-7018 | Rights in Noncommercial Technical Data and Computer Software—SBIR Program. DoD implementation defining government rights during and after protection period |
| SBA SBIR Policy Directive §8(b) | Data Rights Protection — Establishes 20-year protection period measured from contract award |
What IS Protected
Technical Data
Recorded information of a technical nature, regardless of form or method of recording. Per DFARS 252.227-7018:
- Designs, algorithms, and methodologies developed under the SBIR effort
- System architectures and technical approaches
- Analysis frameworks and decision models
- Technical documentation describing the SBIR-developed technology
- Specifications that define internal system operation
- Engineering drawings and schematics
- Test data and technical reports
Computer Software
Computer programs, source code, and databases developed under the SBIR contract.
- Source code and object code for software developed under the SBIR effort
- Proprietary algorithms and computational methods
- Database structures and data models
- Application programming interfaces (APIs) that expose internal functionality
- Software documentation describing internal system operation
- Configuration files and deployment scripts
Protection duration: 20 years
From date of contract award. Applies regardless of whether the SBIR effort is complete. Same duration across all three phases. Per SBA Policy Directive Section 8(b).
What IS NOT Protected (Unlimited Rights)
Non-Technical Data
- Financial data, including cost and pricing information
- Management reports and administrative documentation
- Performance metrics and contract deliverable status
- Business processes and organizational information
- Schedule data and milestone tracking
- Invoice and payment documentation
Form, Fit, and Function Data
DFARS 252.227-7018(a)(15) specifically excludes form, fit, and function data from SBIR protections.
- Form: Physical characteristics of deliverables
- Fit: Interface specifications and connection requirements
- Function: Functional requirements and performance characteristics
System inputs, outputs, external behaviors, user interface specs, API specs defining external interaction — all receive unlimited rights.
Key point: While internal algorithms, source code, and technical approaches remain protected, the external interfaces and functional specifications that enable system integration do not.
Data Processed by SBIR Systems
SBIR data rights protect the technology and methods, not the data that the technology processes or analyzes. Government retains unlimited rights to:
- Input data provided by the government
- Output data and analytical results generated by the system
- Reports and deliverables containing analysis results
- Databases populated with government information
- Insights, recommendations, and decision support products
Information Already in Public Domain
DFARS 252.227-7018(a)(14) excludes publicly available information from SBIR protections.
- Published research, methodologies, and technical approaches
- Open-source software components
- Industry-standard frameworks and methodologies
- Information disclosed in patents or technical publications
Technology Component Protection
Protected by SBIR Data Rights
- Platform source code, object code, and executable programs
- Proprietary algorithms for data ingestion, correlation, and analysis
- Knowledge graph architectures and ontologies
- Machine learning models and training datasets
- System design documentation and technical specifications
- Internal APIs and integration logic
- Database schemas and data models
NOT Protected (Unlimited Rights)
- Work products generated using the platform (reports, analytics, briefings)
- Government-provided data processed by the platform
- API documentation and integration protocols (form, fit, function)
- Deliverables that do not reveal technical architecture
- General professional services methodologies
- User manuals and operational documentation
- Performance reports and metrics
Key distinction: The Government owns all data generated under the contract but has limited rights to the SBIR-developed tools that generate that data.
Government Rights and Responsibilities
Rights Granted to Government
| Government MAY | Government MAY NOT (during 20-year period) |
|---|---|
| Use internally without limitation | Release outside government without contractor permission |
| Reproduce for internal use, backup, archive | Use for competitive procurements |
| Disclose to other government agencies and support contractors (with protections) | Authorize third parties for commercial use |
| Emergency release for emergency repair/overhaul | Use for manufacturing purposes without authorization |
Government's Obligation to Protect
Marking Requirements
- Contractor must mark all SBIR-protected data with restricted rights legend (DFARS 252.227-7018(f))
- Government personnel must verify proper marking
- Unmarked deliverables risk being treated as unlimited rights
Limited Disclosure
- Protected materials disclosed only to parties with legitimate government purpose
- Non-disclosure agreements executed
- Appropriate protections in place
FOIA Exemption
SBIR-protected data is exempt from disclosure under FOIA (5 U.S.C. § 552(b)(4)). The exemption applies for 20 years.
Government Personnel Responsibilities
- Verify contractor marks deliverables properly
- Ensure marked materials receive appropriate handling
- Train staff on SBIR data rights obligations
- Prevent inadvertent disclosure
- Report any potential compromises
Practical Implications for Phase III
Sole-Source Justification Support
- Protected IP creates technical barrier to entry
- Alternative contractors cannot access SBIR technology
- Government cannot compel technology transfer
- Statutory framework supports sole-source
Government Flexibility (Despite Protections)
- Form, fit, and function data — Unlimited rights for integration
- Analytical outputs — Full ownership of work products
- Operational use — No restrictions on internal use
- Support contractors — Can disclose with protections
Long-Term Planning
| During 20-year period | After 20-year period |
|---|---|
| Sole-source follow-on awards supportable | Rights expand to Government Purpose Rights |
| Technology commercialization protected | Greater flexibility for competitions |
| Government use rights preserved | Sustainment and follow-on support enabled |
Summary
Protected (20 years)
- Technical data & computer software
- Source code, algorithms, architectures
- Proprietary methods and designs
Not Protected (Unlimited Rights)
- Non-technical data
- Form, fit, and function data
- Processed data & work products
- Public domain information
Phase III Implications
- Data rights support sole-source
- Government access preserved
- Contractor commercialization protected