diff --git a/lib/galaxy/config.py b/lib/galaxy/config.py
index c6507d3dc78..87f8da2429b 100644
--- a/lib/galaxy/config.py
+++ b/lib/galaxy/config.py
@@ -46,6 +46,7 @@ class Configuration( object ):
         self.require_login = string_as_bool( kwargs.get( "require_login", "False" ) )
         self.allow_user_creation = string_as_bool( kwargs.get( "allow_user_creation", "True" ) )
         self.allow_user_deletion = string_as_bool( kwargs.get( "allow_user_deletion", "False" ) )
+        self.new_user_dataset_access_role_default_private = string_as_bool( kwargs.get( "new_user_dataset_access_role_default_private", "False" ) )
         self.template_path = resolve_path( kwargs.get( "template_path", "templates" ), self.root )
         self.template_cache = resolve_path( kwargs.get( "template_cache_path", "database/compiled_templates" ), self.root )
         self.local_job_queue_workers = int( kwargs.get( "local_job_queue_workers", "5" ) )
diff --git a/lib/galaxy/security/__init__.py b/lib/galaxy/security/__init__.py
index 430c2c6825f..9662e6d98a7 100644
--- a/lib/galaxy/security/__init__.py
+++ b/lib/galaxy/security/__init__.py
@@ -206,12 +206,16 @@ class GalaxyRBACAgent( RBACAgent ):
             else:
                 return None
         return role
-    def user_set_default_permissions( self, user, permissions={}, history=False, dataset=False, bypass_manage_permission=False ):
+    def user_set_default_permissions( self, user, permissions={}, history=False, dataset=False, bypass_manage_permission=False, default_access_private = False ):
         # bypass_manage_permission is used to change permissions of datasets in a userless history when logging in
         if user is None:
             return None
         if not permissions:
-            permissions = { self.permitted_actions.DATASET_MANAGE_PERMISSIONS : [ self.get_private_user_role( user, auto_create=True ) ] }
+            #default permissions
+            permissions = { self.permitted_actions.DATASET_MANAGE_PERMISSIONS : [ self.get_private_user_role( user, auto_create=True ) ] }
+            #new_user_dataset_access_role_default_private is set as True in config file
+            if default_access_private:
+                permissions[ self.permitted_actions.DATASET_ACCESS ] = permissions.values()[ 0 ]
         # Delete all of the current default permissions for the user
         for dup in user.default_permissions:
             dup.delete()
diff --git a/lib/galaxy/web/controllers/user.py b/lib/galaxy/web/controllers/user.py
index 42b6b1faefc..a19d661b9d7 100644
--- a/lib/galaxy/web/controllers/user.py
+++ b/lib/galaxy/web/controllers/user.py
@@ -157,7 +157,7 @@ class User( BaseController ):
                 user.flush()
                 trans.app.security_agent.create_private_user_role( user )
                 # We set default user permissions, before we log in and set the default history permissions
-                trans.app.security_agent.user_set_default_permissions( user )
+                trans.app.security_agent.user_set_default_permissions( user, default_access_private = trans.app.config.new_user_dataset_access_role_default_private )
                 # The handle_user_login() method has a call to the history_set_default_permissions() method
                 # (needed when logging in with a history), user needs to have default permissions set before logging in
                 trans.handle_user_login( user )
diff --git a/universe_wsgi.ini.sample b/universe_wsgi.ini.sample
index 817781e5c11..0e99a1300df 100644
--- a/universe_wsgi.ini.sample
+++ b/universe_wsgi.ini.sample
@@ -156,6 +156,9 @@ use_interactive = True
 # Can an admin user delete user accounts?
 #allow_user_deletion = False
 
+# Should default dataset access permissions be private for new users; default is False (datasets are public)
+new_user_dataset_access_role_default_private = False
+
 # ---- Job Execution --------------------------------------------------------
 
 # Number of concurrent jobs to run (local job runner)