How do companies go about extending their data rights from Phase I to Phase II to Phase III?

The small business is primarily responsible for ensuring that its data rights are correctly reported and maintained. SBIR|STTR contractors should always ensure that any data or software delivered is correctly marked, IAW DFARS 252.227-7018, and maintain records sufficient to justify the validity of any restrictive markings on data, computer software, or computer software documentation delivered under the contract. Small businesses should assert data rights from previous SBIR|STTR efforts when proposing follow-on efforts. This incorporates such data rights into the new award, which will extend the data rights for five years under the new contract.

SBIR Data Rights Tutorial: https://www.sbir.gov/tutorials/data-rights/tutorial-4