Data Rights in Government Contracts: How to Protect Your IP When Working With Federal Agencies

You spent years developing proprietary software, testing methodologies, or engineering designs. Then you win a government contract that uses some of that work. Now the government wants the technical data — and you're not sure what rights they actually have.

This is not a hypothetical. Federal agencies routinely assert rights to technical data and computer software delivered under contracts, and the rules governing those rights are embedded in clauses that most contractors sign without fully reading. The consequences can be severe. If the government holds unlimited rights to your core IP, a competitor can potentially access it through a Freedom of Information Act request. You could find your proprietary processes in a competitor's hands.

The good news: the system has protections built in, and the regulations give you meaningful leverage — but only if you use them correctly. The rules under the Federal Acquisition Regulation (FAR) and the Defense Federal Acquisition Regulation Supplement (DFARS) establish a clear framework. Rights tiers, funding origin rules, marking requirements, and pre-award assertion procedures all exist specifically to let contractors protect legitimately private IP while still fulfilling government contracts.

Data rights disputes are also rising. As agencies push for greater data portability and technology modernization, they increasingly want to move work from one contractor to another — and they need the technical data to do it. Understanding these rules before you sign a contract is the only reliable way to protect your position.

Both FAR and DFARS use a tiered system for government rights in contractor-developed data. The tier that applies depends mainly on how development was funded, which we'll cover in the next section. Here's what each tier actually means in practice.

Unlimited rights is the most dangerous tier for contractors. Under DFARS 252.227-7013, the government can use unlimited-rights data in any way it chooses — including releasing it to a competing firm to support a competitive reprocurement. This is the tier that most contractors want to avoid on their proprietary IP.

Government Purpose Rightssits in the middle. The government can use the data for any government purpose, but cannot release it for commercial purposes during the protection period (typically 5 years under DoD contracts). After that period, GPR data converts to unlimited rights. GPR applies to data developed with mixed funding — part government, part private. It's a compromise: the government gets what it needs for operations and competitive reprocurement, but your commercial business isn't immediately exposed.

Limited rights and restricted rights apply to data and software developed entirely at private expense. These are your strongest protections. The government can use the data internally but cannot release it outside the government without your permission, except in very narrow circumstances spelled out in the clause (emergency repair, foreign government use under treaties, and a few others). Critically, a competitor cannot access it through FOIA or a data request for reprocurement purposes.

The single most important concept in government data rights is the funding origin rule. Where the money came from during development determines what rights tier applies. This rule is the foundation of the entire framework — and contractors who don't understand it often give away more than they have to.

The tricky cases are mixed-funding situations. If you develop a technology partly on your own dime and then continue development under a government contract, you need to carefully document the split. The portions developed before the contract — or with your own funds during the contract — can qualify for limited or restricted rights. The portions developed with government money on that contract fall under government purpose rights at best.

Documentation matters enormously here. Your IR&D (independent research and development) records, B&P (bid and proposal) cost records, and internal project accounting need to clearly demonstrate what was developed when and with whose money. In a dispute, the government can challenge your funding assertions, and vague records rarely hold up.

The FAR and DFARS have parallel but distinct data rights frameworks. Which one applies depends on which agency you're contracting with. DoD contracts use DFARS. Civilian agencies — GSA, HHS, DHS, NASA (with some modifications), and others — use FAR.

The core FAR clause for civilian contracts is FAR 52.227-14, Rights in Data — General. It uses the same unlimited/limited/restricted framework, but there are meaningful differences in scope and the specific scenarios where the government acquires different tiers. Under FAR 52.227-14, the government generally receives unlimited rights in data produced entirely under the contract (government-funded), but the contractor can withhold limited rights data — non-software technical data developed at private expense — by marking it appropriately and delivering only a notice in lieu of the actual data.

For DoD contracts, the controlling clauses were historically DFARS 252.227-7013 (technical data for noncommercial items) and DFARS 252.227-7014 (software for noncommercial items). A DFARS class deviation effective February 1, 2026 consolidated these clauses into DFARS 252.227-7989 and renumbered related provisions. If you're working on a DoD contract awarded after that date, verify which version of the clause is actually in your contract — the numbering changed.

One important practical difference: DFARS contracts generally have a more contractor-favorable default on mixed-funding data. Under DFARS, mixed-funding development yields Government Purpose Rights for 5 years before converting to unlimited. Under the standard FAR clause for civilian agencies, the default on data produced “under” the contract often leans toward unlimited rights. If you work across both civilian and DoD customers, you can't assume the same marking strategy works identically for both.

SBIR and STTR awardees get a separate and significantly stronger data rights protection than standard contractors. This protection exists specifically because SBIR is designed to fund development of commercially promising technology — and the program would fail if the government could take unlimited rights to everything developed through it.

A final rule effective January 17, 2025 updated the DFARS SBIR/STTR data rights framework. The key provisions under DFARS 252.227-7018 (the current controlling clause) are:

Civilian agencies handle SBIR data rights through FAR 52.227-20. The protection is similar in concept but implemented differently. If your SBIR work spans both DoD and civilian agency contracts (common in Phase II commercialization), you'll be dealing with both clause frameworks and need to track which applies to which deliverable.

Marking is not optional. It's the mechanism by which you assert restrictions. If you deliver technical data or software without the required restrictive legend, the government can claim unlimited rights even if you developed the underlying IP entirely at private expense. Courts have consistently upheld this: the government's rights are determined at the time of delivery, and improper marking forfeits your protections.

Each rights tier has a corresponding legend specified in the applicable clause. Here's what you need to apply:

The legends must be verbatim or substantially similar to the text in the clause. Don't paraphrase. Include the specific information the legend requires — for GPR, that means the actual expiration date of the protection period. For SBIR, it means the contract number and award date from which the 20-year clock runs.

If you discover after delivery that you failed to mark data correctly, the regulations do provide a procedure to correct the omission — but it requires prompt action and is at the contracting officer's discretion. Don't rely on it. Build marking into your delivery process as a standard checklist item, similar to verifying technical compliance before submission. CapturePilot's proposal management tools can help you build pre-delivery checklists that include data rights marking verification.

“Background IP” is the IP you bring to a contract — technology you developed before the contract, or during the contract but with your own funds and separately from the government work. “Foreground IP” (sometimes called “deliverable data”) is what you create specifically under the contract using government funds.

The government generally has no rights to your background IP — unless you bring it into the contract scope without protecting it. This is where contractors most commonly make costly mistakes. They incorporate background IP into contract deliverables without marking it, or they agree to contract language that inadvertently sweeps in background IP through overly broad data delivery requirements.

For DoD contracts, DFARS 252.227-7017is your pre-award assertion mechanism. This clause requires offerors to identify, before award, any technical data or software they intend to deliver with restrictions. Miss this window, and you may lose the ability to assert restrictions on that data even if you legitimately developed it at private expense. Treat the 7017 form seriously — it's not boilerplate to fill out quickly.

One additional protection available under DFARS: the right to withhold. For certain categories of limited-rights data, the contractor may withhold the actual data and deliver a notice instead, stating that limited-rights data exists but is being withheld. The government gets notice but not the data itself. This option doesn't work for all contract types, and the contracting officer can challenge a withholding assertion, but it's a legitimate tool when you need to protect particularly sensitive core IP.

The Department of Defense released a comprehensive Intellectual Property Guidebook in May 2025. This document is significant not because it creates new law — it doesn't — but because it signals how DoD contracting officers are expected to approach IP in acquisitions and clarifies the department's current thinking on contested areas.

A few practical implications from the guidebook:

The guidebook also addresses how DoD handles IP in Other Transaction Authority (OTA) agreements, which operate outside FAR/DFARS. OTAs give agencies more flexibility to negotiate IP terms directly — which is both an opportunity and a risk. In OTA negotiations, the government's opening position is often more aggressive on IP than a standard contract because the regulatory floor doesn't apply. If you're pursuing OTA work, read our guide on OTA contracts before entering those discussions.

These are the most common ways contractors lose IP protection they were legally entitled to keep.

Data rights is a topic where knowing the framework is not enough — you need to apply it systematically on every contract. The contractors who protect their IP aren't necessarily the ones with the most sophisticated legal teams. They're the ones who built the right processes and apply them consistently.

If you're building out your federal contracting operation, data rights is just one piece of a larger compliance picture. Check out our guide on key FAR clauses for small business contractors for a broader look at the contract terms that matter most, and our proposal compliance matrix guide for how to make sure you never miss a mandatory requirement in a submission.

The federal government spent over $750 billion on contracts in FY2025. The agencies writing those contracts will all have opinions about the data your work produces. Understanding exactly what you owe — and exactly what you don't — is worth the time it takes to learn the rules.