NDAA provisions would make GPR the default for DoD technical data
For the first time, a bill would flip the burden: contractors must prove by clear and convincing evidence why internally funded technology shouldn't carry Government Purpose Rights, and the standard is higher than the preponderance rule that governs most civil disputes.
TL;DR
FY 2027 NDAA provisions moving through the House and Senate would make Government Purpose Rights the default license for technical data and computer software delivered under future DoD contracts, subcontracts, and other transaction agreements. Contractors seeking more restrictive rights would bear the burden of identifying every affected deliverable and substantiating the basis for restrictions by clear and convincing evidence, a higher bar than the preponderance standard that governs most civil disputes. Every proposal would need a compliant assertions table, deliverable by deliverable; every subcontract would flow the same requirement down. The legislation goes well beyond repair access, reaching internally funded commercial and dual-use technology that contractors currently protect with Limited or Restricted Rights.
The current data-rights framework, set out in DFARS Part 227 and the clause at 252.227-7013, reflects a decades-old compromise: the government's license rights are tied to the source of development funding. Technology developed exclusively at private expense gets Limited Rights (technical data) or Restricted Rights (software). Mixed-funding items get Government Purpose Rights, which let DoD hand the data to a competitor for sustainment work, but those rights are time-limited, ordinarily converting to Unlimited Rights after five years. Exclusively government-funded items get Unlimited Rights from the start.
The FY 2027 NDAA provisions would blow past that structure. Sections 861 of the House-passed bill and 804 of the SASC-reported bill make GPR the default for covered acquisitions. A contractor wanting anything less restrictive from the government's perspective must identify each item of deliverable data or software claimed and support the restriction with evidence of private development funding and applicable exclusions from Unlimited Rights, all to a clear-and-convincing standard.
That standard matters. Most civil disputes run on preponderance of the evidence; clear and convincing is a distinctly heavier lift. What constitutes sufficient evidence is unspecified in the text, and it will be litigated at the Court of Federal Claims if these provisions become law.
The operational impact hits primes and subs across every new DoD award. Each proposal will need a compliant assertions table, deliverable by deliverable. Each subcontract flows the same requirement down. Every CDRL marking becomes a potential dispute. A contractor with mixed internal IRAD and commercial revenue will have to reconstruct development funding trails for technology that may have been built across multiple business units over years. Failure to document restrictions adequately means the government gets GPR, and GPR means DoD can hand your technical data to your competitor for sustainment work.
Section 5811 of the SASC-reported bill raises the stakes further by strengthening government remedies in data-rights disputes. Contractors whose restriction assertions don't hold up face consequences beyond losing the license fight.
The proposal reaches well beyond the right-to-repair framing that's been its public face. It targets internally funded dual-use technology directly, and it would apply to future DoD contracts, subcontracts, and other transaction agreements. Retroactive application to existing contracts appears unlikely given the structure of the provisions, but contractors shouldn't treat that as settled. The days of marking data with Limited Rights and waiting for a challenge are, at minimum, on notice.
Published ·Deep Fathom