Q. How do I handle data from a Contract Research Organization (CRO) in my publication? Do they become authors?

It’s important to separate out the legal requirements of data ownership from the scientific norms of authorship. Legal ownership (copyright/trade secrets) of any of the data files or images should be laid out in the contract or policies of the CRO. While I’d expect by paying the CRO you’d have full control over the data they give you, you’d want to check the contract to be sure.

Authorship is a separate concept from the legal ownership of the data. It’s a good idea to maintain professional relationships by offering to collaborate on authoring the paper (this isn’t a legal thing just a good interpersonal thing). The International Committee on Medical Journal Editors has a good definition of authorship that includes collecting data, drafting the work, and providing final approval of the publication. If the CRO does not want to be part of the publication writing or approval process, they should not be authors. Including them in an acknowledgment would be appropriate. Alternatively, you could release the files as a dataset through a data repository (like CaltechDATA or Zenodo). There you could include the CRO members as authors or contributors to the specific data files they collected, and then reference the data files in the publication.