The data rights checklist: what to confirm before you license anything

The fact that records sit in your systems does not mean you can license them. Some belong to clients. Some are covered by contracts you signed years ago. Some contain information about people who never agreed to anything. Some are regulated. A good manifest sorts records into what you can license cleanly, what you can license with conditions, and what stays out.

This checklist is the sorting process. It is not legal advice, and the last step on every item is your own counsel. What it does is make sure the right questions get asked before a buyer sees anything, so the deal does not fall apart in diligence.

Start with who created the record and under what arrangement.

• Employee work product is normally the company's. Check that employment agreements say so, especially for staff in jurisdictions where the default runs the other way.
• Contractor work product is the contractor's unless an agreement assigns it. Code, designs, and documents written by contractors without an IP assignment are excluded until that is fixed.
• Client-owned deliverables. Many service contracts assign the final deliverable to the client. Your process records around it (proposals, drafts, reviews, internal notes) are usually still yours.
• Third-party content such as vendor manuals, licensed templates, stock assets, and anything copied from a platform is not yours to license onward.
• Acquired companies. Records from an acquisition are yours if the purchase agreement transferred them. Check the schedule.

Pull the agreements that touch the records in scope and look for four kinds of clause.

• Confidentiality. Most customer and client agreements restrict disclosure of the other party's information. De-identification often satisfies this, but some clauses are drafted broadly enough to require consent or exclusion. Standalone NDAs usually mean exclusion.
• Data ownership and use. Outsourcing, BPO, and managed-service contracts frequently state that interaction data belongs to the client. If so, licensing needs the client's consent or scope limited to your own operational records.
• Vendor and platform terms. Your CRM, helpdesk, and chat providers have terms that govern export and reuse. Most permit export of your own data; a few restrict commercial redistribution. Read the current version.
• Exclusivity you already granted. If you have licensed records before, check whether that license was exclusive and for what field.

Where a clause is unclear, the conservative answer is to exclude the affected records from the manifest and revisit once counsel has read the agreement. Excluded records can be added later; a breach cannot be undone.

Operational records are full of personal information: customer names, employee names, contact details, sometimes much more. Licensing does not require that information. De-identification removes or replaces it before any sample is built. The rights question is whether your privacy notices and the law where people live permit the use.

• Customers and contacts. Check your privacy notice and the law in your customers' jurisdictions. De-identified data is treated differently from personal data in most frameworks, and the de-identification standard in the contract should be one your counsel accepts.
• Employees. Their messages and work product are in nearly every record type. Employee privacy notices and, in some countries, works-council or union consultation apply. Direct messages and HR matters are excluded by default.
• Callers. Recorded calls need a consent record. Two-party-consent jurisdictions require that the notice was given at the time. Audio is more sensitive than transcripts.
• Candidates, tenants, patients, and other individuals with their own regulatory protections are covered under the next heading.

Some records carry rules that go beyond ordinary privacy law. The usual approach is to exclude the regulated content as a class and license the workflow around it.

This table is a starting point, not a complete list, and the rules change. Your counsel decides what applies to you.

Two platform questions come up in nearly every deal. First, does your software vendor's agreement allow you to export and license your own data? For the mainstream business systems the answer is generally yes, with the caveat that data the vendor supplied, such as enrichment fields or benchmark data, is theirs. Second, did any records originate on a third-party platform whose terms restrict reuse? Profile data copied from a professional network, listings pulled from a multiple listing service, and content scraped from the web are the common cases, and they are excluded. Your own notes about those records are yours.

The manifest is where the checklist lands. For each system and record type it records three things: the rights basis (owned outright, owned with conditions, or excluded), the exclusions applied (by class, by counterparty, by date), and the de-identification rules. Buyers read this section first, because it tells them whether a deal can close. A manifest with clear rights and sensible exclusions attracts better offers than a larger one with open questions.

If your counsel has not seen a data license before, the licensing 101 guide and the glossary are a useful briefing. If you want to know how rights clarity affects price, read what drives value.