FAR SBIR Data Rights Clause Remains Unchanged After Overhaul – The SBIR/STTR 20-Year Protection Period Applies Anyway

     In its overhaul of FAR Part 27, the FAR Council, unfortunately, made no changes to the outdated 4-year SBIR/STTR protection period contained in FAR clause 52.227-20.  The SBIR/STTR protection period is a unique and important aspect of the SBIR/STTR Program because it defines the period in which the federal government’s otherwise expansive rights in technical data computer software generated under an SBIR/STTR contract or funding agreement remain restricted.  The FAR council’s failure to update FAR 52.227-20 to reflect the current 20-year minimum protection period in the SBIR/STTR Policy Directive was a missed opportunity to dispel confusion and the persistent notion that there are two different protection periods under the SBIR/STTR Program - one under FAR for civilian agencies and another under the DFARS for defense agencies.  But as explained below, currently there is only one protection period authorized for the SBIR/STTR Program - namely, the 20-year protection period set out in SBA’s SBIR/STTR Policy Directive.

The SBA Has Exclusive Authority To Develop SBIR Program Rules

     When Congress creates a federal program it often delegates to a federal agency the authority to create rules for the program.  In section (j) of the Small Business Act, Congress gave the SBA the exclusive authority to establish the general rules for the SBIR/STTR Program.  Consequently, no other federal agency including DoD, GSA, NASA, OMB  - or, collectively, all of them as the FAR Council - has authority to set the rules for the SBA’s SBIR/STTR program.

     Although Congress typically directs agencies to issue rules in federal regulations, with respect to the SBIR/STTR Program, Congress chose instead to require the SBA to issue “policy directives” that contain the SBIR/STTR Program’s general rules.  In other words, Congress made it clear that the definitive rules for the SBIR/STTR Program should be found in the SBA’s policy directives and, thus, not in any regulations, including those issued by other agencies.

The Policy Directive Sets The Definitive Protection Period

     Having required placement of the SBIR/STTR Program rules to be in the SBA’s policy directives, Congress went one step further and instructed the SBA to provide in its policy directives an SBIR/STTR  protection period of not less than 4 years.

     In 2019, the SBA revised its SBIR and STTR Policy Directives to state that the SBIR/STTR protection period begins on the award date and ends twenty years, or longer at the discretion of the SBIR/STTR agency, from that date.  The revised policy directives also provide that an alternative protection period can only apply if, after award, the SBIR/STTR agency and the SBIR/STTR small business negotiate a different protection period.  In sum, after 2019, the only congressionally authorized SBIR/STTR protection period is the minimum 20-year protection period in the SBA’s policy directives.

Any Conflicting Protection Period Is Unauthorized

     In 2020, DoD issued a class deviation adopting the SBA policy directive’s 20-year protection period and requiring contracting officers to use that protection period in lieu of the protection period defined in the existing DFARS clause 252.227-7018.  At the time of the 2020 class deviation, the DFARS clause defined the protection period to begin upon contract award and to end 5 years after completion of the SBIR/STTR project.  More recently, in January 2025, DoD revised DFARS 252.227-7018 to adopt the SBIR/STTR policy directive’s definition of the SBIR/STTR protection period - i.e., at least 20-years unless negotiated by the SBIR/STTR agency and the small  business after award.

     The FAR clause at 52.227-20, on the other hand, has not yet been updated to incorporate the SBA’s minimum 20-year protection period.  Rather, it still provides a mandatory 4-year protection period that commences after deliverables have been accepted.  Until 2019, this mandatory 4-year protection (and, for that matter, the now-rescinded 5-year protection period under DFARS for defense agencies) complied with the SBA’s policy directives because the pre-2019 policy directives instructed SBIR/STTR agencies to provide an SBIR/STTR protection period of not less than 4 years from the date of the last deliverable and gave SBIR/STTR agencies discretion to adopt protection periods longer than 4 years.  

     The 2019 revisions to the SBIR and STTR policy directives removed any discretion on the part of SBIR/STTR agencies to impose their own protection periods and, instead, set out a uniform protection period for the entire SBIR/STTR Program that could be mandated by SBIR/STTR agencies – namely, a protection period of at least 20 years from the date of award.    In addition, on the issue of SBIR/STTR data rights specifically, every SBA policy directive published after the 2019 changes has stated explicitly that solicitation and funding agreement provisions and clauses must implement policy directive requirements and that solicitation clauses must reflect the key elements contained in the sample data rights clause that is attached to the policy directive.  The SBA, in fact, is required by the SBIR/STTR policy directives to report to Congress any attempt by a federal agency to condition an SBIR/STTR award on lesser data rights or to exclude an appropriate data rights clause from an award.

     In sum, the 4-year mandatory protection period contained in FAR clause 52.227-20 is unauthorized, and may be unenforceable under contract principles, because (1) the four-year protection period under that clause was established by the FAR Council and not the SBA, the only agency authorized by Congress to define the SBIR/STTR protection period, (2) the four-year protection period is not contained in the SBA’s policy directives, and (3) the four-year protection period conflicts with the current 20-year minimum protection period that was established by the SBA and is set forth in the SBA’s policy directives.  Any agency that would unilaterally impose the 4-year protection period under FAR 52.227-20 on a contract or funding agreement would violate both the SBA’s policy directives and congressional mandates on the SBIR/STTR Program.

So What Should Civilian Agency Contractors Do?

     If a solicitation for an SBIR/STTR contract or funding agreement incorporates FAR 52.227-20 without explicitly identifying a mandatory protection period of at least 20 years, government contractors should consider submitting appropriate pre-bid questions in order to obtain agency clarifications or acknowledgments that the applicable SBIR/STTR protection period will be at least 20 years.

     As for contracts or funding agreements that have already been awarded, government contractors and SBIR/STTR agencies should follow the instructions posted by the SBA on its website on the issue of FAR and DFARS clauses that conflict with the SBIR/STTR policy directive 20-year protection period:

• SBIR/STTR awardees should check their funding agreements before signing them to ensure the agency has included these revisions in the proposed agreement. 

• Agencies should include special language that acknowledges and affirms application of the sample policy directive data rights clause and the SBIR/STTR policy directive, notwithstanding contrary provisions in FAR clauses

• SBIR/STTR awardees should report a failure of an SBIR/STTR agency to do so immediately to SBA.