Phase III SBIR Data Rights: Your 20-Year Protection, Explained

SBIR data rights are one of the most valuable things a small business gets from the SBIR program — and one of the least well-understood. They are also one of the most common things to lose by accident, through poor marking, poor contract review, or a contracting officer who attempts to apply the wrong data-rights clause to a Phase III award. Knowing what the rights are, how long they last, and how to protect them is essential before Phase III.

The 20-year protection period.

Under DFARS 252.227-7018 (the DoD SBIR/STTR data-rights clause) and corresponding agency clauses, the government receives SBIR/STTR Data Rights in technical data and computer software developed under an SBIR contract. These rights last 20 years from the date of the original SBIR/STTR award. The clock starts at the Phase I award, not at Phase III.

During those 20 years, the government may use the data only for internal government purposes. It cannot:

• Release the data to a contractor outside the government.
• Use the data to enable a competitor to bid on follow-on work.
• Publicly disclose the data without the awardee's permission.
• Manufacture or have manufactured items from the data outside its own facilities.

After 20 years, the rights expand. The government typically receives unlimited rights to use, disclose, and re-procure based on the data. That endpoint is a long way off — but it is the reason the rights are described as a "protection period" rather than permanent ownership.

The 2024 DFARS final rule.

DFARS 252.227-7018 was substantially revised in a 2024 final rule. The headline did not change — SBIR data rights still last 20 years — but the rule clarified several practical issues that frequently came up in audits and protests:

• Marking requirements were tightened. Data must be marked with the SBIR rights legend at delivery to retain its protection. Unmarked or improperly marked data risks falling into a broader rights category.
• The scope of "SBIR data" was clarified to include both technical data and computer software produced under the SBIR award.
• The relationship between Phase I/II rights and Phase III rights was made explicit — rights carry forward, and a Phase III contract cannot strip them.

For a Phase II awardee preparing for Phase III, the practical upshot is that good marking discipline during Phase II is what protects you in Phase III. Errors at delivery are very hard to fix later.

What to watch for in a Phase III contract.

A Phase III contract should include the SBIR data-rights clause (DFARS 252.227-7018 for DoD; analogous clauses for civilian agencies). Several things can go sideways in the drafting:

• The contracting officer attaches the wrong clause. Standard FAR data-rights clauses (e.g., FAR 52.227-14) are not appropriate for a Phase III award and would erode your protections.
• The contract is silent on data rights. Without the clause, the default rights regime can apply — not what you want.
• Newly-developed data under Phase III is unmarked. Mark everything, every time. The protection regime relies on it.
• A subcontract flow-down is missing. If you subcontract Phase III work, the data-rights clause must flow down.

Why this matters for your business.

SBIR data rights are the thing that prevents a competitor from buying your technology out from under you using your own technical data. They are also the thing that makes your company an attractive acquisition target — a small business with valid SBIR data rights on a deployed defense capability is a uniquely defensible asset. Treating these rights as a paperwork detail rather than a strategic asset is one of the most expensive mistakes a Phase II awardee can make.