A founder's guide to telling employees about a data licence

If your company licenses its operational data, the people who created that data should hear about it from you, not from a rumor. A clear, honest note does more to build trust than any policy document. Here is how to think about what to say, when to say it and how to answer the questions that follow.

Employees spent years writing the messages, tickets, documents and code that make up the dataset. Even with every name replaced by a token, many will feel a sense of ownership over that history, and some will have strong views about AI. Hearing about a licence secondhand can feel like a breach of trust, even when every protection is in place.

Telling people directly also gives you the chance to explain those protections in your own words. Most concerns come from imagining the worst version of the arrangement. A plain description of the real one usually settles them.

Whether you have any formal obligation to notify current or former employees depends on your jurisdiction and your company's own policies. This is general information, not legal advice, so check with counsel on what is required as opposed to what is simply good practice.

A good note is short and specific. It should cover:

• What is being licensed: the systems in scope, such as chat, email, tickets and code, and the time period
• What is excluded: HR, payroll, medical and legally privileged folders by default, direct messages unless you chose to include them, and any channels or clients you removed
• How it is anonymized: every person, company, email and phone number replaced with a consistent token, with credentials and government IDs removed outright
• What buyers can and cannot do: training and evaluation only, and never marketing to, profiling, contacting or re-identifying anyone
• What happens to the raw data: deleted within 30 days of sign-off, with a deletion certificate
• Who to contact with questions

If you can, add a sentence about why the company chose to do this. In a wind-down, it may be part of returning something to creditors and shareholders. For an operating company, it may simply be a source of revenue. People respond better to a reason than to a bare announcement.

Resist the urge to soften it with vague language. "We are partnering with AI companies on research" sounds evasive. "We licensed an anonymized copy of our work tools' history to an AI lab for model training" sounds like what it is.

People will ask whether their name appears in the data. It does not: names, emails and handles are replaced by tokens, and the same token is used everywhere that person appears, so the data stays coherent without saying who anyone is.

They will ask about direct messages. Be precise about what you decided. If DMs are excluded, say so. If you chose to include them, explain why and confirm the company had the right to.

They will ask whether someone could work out who they are anyway. Be honest that anonymization reduces risk rather than making it impossible, and explain the layers: tokenization, removal of secrets and identifiers, blacked-out faces and signatures, default exclusions, and a contract that prohibits re-identification. Our employee privacy standard and trust page describe these in detail, and you are welcome to share them.

Some will ask where the money goes. Payment goes to the company entity. In a wind-down, it is handled under the same process as any other company asset.

For an operating company, tell employees before the data is delivered, ideally once scope and exclusions are settled so you can describe them accurately. You will have reviewed an anonymized sample before delivery, and mentioning that you looked at it yourself is reassuring.

For a company that is winding down or closed, the audience is mostly former employees. A short email to last known addresses, or a post in an alumni group if one exists, is usually enough. Many will appreciate that you thought to tell them at all.

If your company has employee representatives, a works council or a union, they may expect to hear before everyone else. Counsel can tell you what applies in your case.

In either case, put it in writing. A spoken announcement gets retold inaccurately, while a written note can be forwarded as it is. Keep a copy with the rest of the licence records so you can point to exactly what was said.

Not everyone will be comfortable, and that is fine. Listen to specific concerns, because some are actionable. If someone points out a channel that held sensitive personal conversations, it may be worth asking whether it can still be excluded, especially if the data has not yet been delivered.

What you should avoid is promising things the process does not do. Do not say the data is impossible to trace or that nobody will ever read it. Say what is true: it is anonymized, restricted to training and evaluation, and the raw copy is deleted. We discuss the wider question of fairness to the people in a dataset in data licences and the people in the data.

It can also help to name one person, ideally you, as the point of contact for follow-up questions. A single, consistent voice keeps answers accurate and shows that the decision was made deliberately rather than quietly.

The easiest note to write is one where you already know exactly what is in scope and how it is protected. If you are considering a licence and want those details before you talk to your team, book a 15-minute call.