Legal and privacy checklist before you license company data

This checklist covers the legal and privacy questions to settle before a data license is signed. It sits alongside the overview of how licensing company data to AI works and the safety page, which lists what never leaves and eight questions to put to a buyer. We are not a law firm and this is not legal advice. Use it to prepare for the conversation with your own counsel, not to replace it.

How should you use this checklist?

Work through it in order. Each item should end in one of three answers: in scope, out of scope, or ask counsel. Write the answers down. The “out” list becomes the exclusions schedule in your agreement, and the “ask counsel” list becomes the agenda for your lawyer.

1. Does the company own the data, and who can sign?

• Confirm the accounts are the company’s. Company-paid workspaces on the company domain are the starting point. Founders’ personal accounts, contractor-owned tools and systems a client hosts for you are not.
• Separate what you hold under someone else’s terms. Vendored code, MLS listing data and ad platform data came to you under third-party licenses. The pages for software companies and real estate cover the common cases.
• Check who can sign. Read your operating agreement or bylaws for approvals needed to license a company asset or sign a material contract. If you have investors or a lender, check their documents for consent rights over company assets.
• Check acquired data. Records that came with an acquisition are governed by the purchase agreement and by the privacy promises the acquired company made.
• Closing or closed? Ownership and authority work differently in a wind-down or bankruptcy. See closing a company.

2. Do your privacy policy and customer contracts allow it?

• Read the policy that was in force when the data was collected, not only today’s version. In February 2024 the FTC warned that a company may act unfairly or deceptively if it adopts more permissive data practices, such as sharing data with third parties or using it for AI training, and tells people only through a surreptitious, retroactive change to its terms or privacy policy (FTC). A new policy today does not cover data you already hold.
• Read the notices you gave staff and job applicants. They matter as much as the customer policy. See employee and client consent.
• List customer contracts with data-use limits. Look in MSAs, NDAs and data processing agreements for clauses that limit customer data to providing your service. Note which customers’ data sits in which systems, so it can be excluded system by system.

3. Which state privacy laws reach your data?

• Check whether the CCPA applies. The California Attorney General says the CCPA applies to for-profit businesses that do business in California and meet any one of a set of revenue and data-volume thresholds, and generally not to nonprofits or government agencies (California AG). Check the thresholds on that page against your own figures.
• Do not assume employee data is exempt. The same page says the CCPA’s exemptions for employment-related personal information expired on December 31, 2022. If the law applies to you, treat information about California staff in email and chat as covered, and ask counsel what notice and rights follow.
• Check your notice at collection. The Attorney General’s page says a notice at collection must list the categories of personal information collected, and that some businesses must include a “Do Not Sell or Share” link in it. Ask counsel whether the license you are planning changes what your notices must say.
• Ask the same questions for every other state where your employees or customers live.

4. Do sector rules put whole systems out of scope?

Sector rules rarely change the price. They decide which systems are never connected. The industry pages cover each one in detail; this is the short version.

Rule	What it reaches	Usual effect on scope	Detail
26 U.S.C. § 7216	Disclosure or use of tax return information by return preparers	Tax-practice systems stay out entirely	Accounting firms
Gramm-Leach-Bliley Act and FTC Safeguards Rule	Financial institutions as the FTC defines them, which include tax preparation firms and mortgage brokers	Customer financial information stays out; your security program records the new connection	Insurance, accounting firms
HIPAA Privacy Rule	Health information	We do not handle health data; those systems stay out	Is it safe?
ITAR and EAR	Defense articles and dual-use technology, including technical data	Controlled technical data stays out; ask where the buyer’s staff and contractors are	Manufacturers

If the Safeguards Rule covers you, two points from the FTC’s guidance apply. The rule requires periodic reassessments in light of changes to your operations, and it expects contracts with service providers to spell out security expectations and allow monitoring (FTC). Whether a buyer counts as a service provider is a question for counsel. A buyer platform that connects into your systems, as Mercor’s does (Mercor), is still a change your written security program should record.

5. Does the DOJ bulk sensitive data rule apply?

The Department of Justice rule at 28 CFR Part 202 restricts access to U.S. sensitive personal data and government-related data by countries of concern and covered persons. Three points matter for a data license:

• A license counts as data brokerage. The rule’s definition covers licensing access to data where the recipient did not collect it from the people it relates to (§ 202.214).
• Some counterparties are off limits. U.S. persons may not knowingly engage in covered data transactions involving data brokerage with a country of concern or a covered person (§ 202.301). The countries of concern are China, Cuba, Iran, North Korea, Russia and Venezuela (§ 202.601).
• Other foreign counterparties need a contract clause. Where data brokerage gives any other foreign person access to bulk U.S. sensitive personal data or government-related data, the U.S. company must contractually bar onward data brokerage of the same data to a country of concern or covered person, and report known or suspected violations (§ 202.302).

Two details catch people out. First, de-identification does not take data outside the rule: bulk U.S. sensitive personal data counts regardless of whether it is anonymized, pseudonymized, de-identified or encrypted (§ 202.206). Second, “bulk” is set per category, from health and financial data to covered personal identifiers on more than 100,000 U.S. persons (§ 202.205), and names and contact details linked only to each other are excluded from covered personal identifiers (§ 202.212). Ask counsel to test the thresholds against what is actually in scope after your exclusions.

Then ask the buyer whether it, its affiliates, its annotators or its end licensees include foreign persons, and whether its agreement contains the onward-transfer clause. One broker we track, AIData.Broker, lists bulk U.S. sensitive data under 28 CFR 202 among the data it excludes (AIData.Broker).

6. Has the buyer passed your vendor security review?

Treat the buyer like any vendor that will touch company systems. The safety page has the questions about breaches and who sees raw data; this is the paperwork.

• Ask for the current SOC 2 Type II report, not a badge. Mercor says it is SOC 2 Type II (Mercor); Turing offers its report under NDA (Turing).
• Get the access model in writing: which accounts, which permissions, for how long. Mercor says credentials are held per session and no data leaves until you approve it (Mercor); Polyshares says access is scoped to what the license covers (Polyshares).
• Ask for a subprocessor list and processing locations. The answers feed item 5.
• Name an internal owner who grants access, watches the transfer and revokes access at the end. Rotate the credentials the buyer used; see how to prepare your data.

7. Have you checked your insurance?

• Ask your broker whether your cyber, privacy and directors-and-officers policies respond to claims arising from a data license, and whether the policy requires notice of a material change in how you handle data.
• Ask the buyer what breach and liability insurance it carries, and for a certificate.
• Line up the agreement with the policy. The liability cap and indemnities in the license should not leave you holding a risk your policy excludes.

8. Is every decision written into the agreement?

The checklist protects you only if its results appear in the signed license: the exclusions schedule, the deletion date, any onward-transfer clause, the security commitments and the payment trigger. The agreement terms guide goes clause by clause. When you are ready to compare buyers, the value check matches your answers to each published criterion, and the tracker shows each buyer’s terms with the date we checked them.