A data licensing FAQ for general counsel

General counsel usually get the data licensing question after the business has already decided it likes the idea. Below are the questions in-house lawyers tend to raise, answered in plain English, with pointers to more detail. This is general information, not legal advice, and any licence should be reviewed by your own counsel against your company's contracts and jurisdiction.

*Is this a sale of data?* No. The company grants a licence to use an anonymized copy for training and evaluation of AI models. Ownership of the underlying records does not transfer. See licensing vs. selling data for the distinction.

*What can the licensee do with it?* Training and evaluation only. Buyers may never market to, profile, contact or re-identify anyone in the data, and it is never resold for marketing or people search. What a training-only licence should include covers how those restrictions are typically framed.

*Who decides what is in scope?* The company. Scope and exclusions are set by the seller and annexed to the contract before any data moves. That annex is the document to scrutinize, because it lists the systems, date ranges and everything carved out. Our post on exclusions shows what tends to go in it.

*How is personal information handled?* Every person, company, address, email, phone number and account becomes a consistent token across every tool. Credentials, API keys, card numbers and government IDs are removed outright. Faces, logos and signatures in images and PDFs are blacked out.

*What is excluded by default?* HR, payroll, medical and legally privileged folders. Direct messages are excluded unless the company chooses to include them and has the right to, and counsel's view on that right is often the deciding factor.

*Who touches the raw data?* Anonymization is done in-house, and no third party touches raw data. The company reviews an anonymized sample before anything is delivered, which gives legal a concrete artifact to check rather than a description.

*Does anonymization take the data outside privacy law?* That depends on the jurisdiction and on how the applicable law treats anonymized or pseudonymized data, which is a question for your privacy counsel. The process is designed to reduce re-identification risk through tokenization, removal, exclusion and contractual prohibition, and it should be assessed against the regimes that apply to you.

*What about customer confidentiality clauses?* This is usually the most important diligence item. Many customer contracts restrict use or disclosure of customer information. Specific customers can be excluded entirely, and anonymization tokenizes customer names and contacts, but whether that satisfies a particular clause is a contract-by-contract judgment. Customer confidentiality clauses and your data walks through common patterns.

*What about vendor terms and third-party code?* Repositories containing licensed or vendored code, and any systems whose terms limit how their content may be used, can be scoped out. It is easier to list these during scoping than to address them later.

*What if a customer's information appears in a channel that is otherwise in scope?* Customer names and contacts are tokenized wherever they appear. Where a contract calls for more than that, the customer can be excluded, or the channels and folders dedicated to that customer can be removed from scope in the annex.

*What will the company be asked to represent?* Typically, authority to grant the licence and the right to include what is in scope. Representations and warranties in data licences explains the usual ones in plain terms.

*What happens to the raw archive?* It is deleted within 30 days of sign-off, as a contract obligation, and a deletion certificate is issued. What raw data deleted should mean in a contract discusses what that obligation should cover.

*How much of the company's time does this take?* About an hour in total, spread across a 15-minute intro call, granting read-only access for the evaluation and reviewing the anonymized sample. Legal review of the contract and annex is separate and depends on your own process.

*Should employees be told?* Notice requirements vary by jurisdiction and by your own policies, so that is a question for counsel. Many companies choose to tell people regardless, and a founder's guide to telling employees suggests how.

*Who can sign?* An authorized officer of an operating company. For a company that is winding down or closed, a director, officer, liquidator or assignee with authority over company assets can sign, and the authority document is requested up front. See who can sign a data licence when a company is closing.

*Where does the money go?* To the company entity, never to an individual, in two to four weeks. Typical licences range from $20K to $400K+, and no firm number is given before the data has been counted in a read-only evaluation.

Most in-house reviews come down to a handful of documents and decisions. Before signing, it is worth confirming:

• The scope and exclusions annex lists every system, date range and carve-out the business intends
• Customer contracts with confidentiality or data-use restrictions have been checked, and affected customers excluded where needed
• The company's position on direct messages is settled and documented
• The use restrictions bind the licensee to training and evaluation only, with no re-identification, profiling or contact
• The deletion obligation, timing and certificate are written into the contract
• The signatory's authority is documented, especially in a wind-down

Because the operational burden on the company is small, most of the real work sits with legal at the scoping stage, and that is where careful review pays off. If your business team has raised a licence and you want to bring your questions to the first conversation, book a 15-minute call.