Owning your systems doesn't automatically mean you can license everything in them. Before any data changes hands, answer these five questions. They're the same ones we walk through on every scoping call. This is general information, not legal advice; your own lawyer should review any agreement.
1. Do your customer contracts restrict it?
Many B2B contracts include confidentiality clauses that cover information customers share with you. Some allow de-identified use; some don't. Check your standard terms and any large customer contracts, and exclude anything you're not sure about.
2. What does your privacy notice say?
If your business collects personal data, your privacy notice describes how it's used. De-identified data generally falls outside most privacy laws, but you should make sure your disclosures and the de-identification method line up.
3. Are you subject to UK or EU data protection law?
If your data includes people in the UK or EU, GDPR applies to the raw data until it's de-identified. The processor doing the de-identification needs proper data processing terms, and transfers to the US need a recognized safeguard.
4. Is any of it regulated data?
Health records, financial account data, children's data, and government IDs carry special rules. Paid4Data excludes them entirely.
5. Who signs, and are they authorized?
The person signing the data license needs authority to bind the company. If you have partners or investors, check your operating agreement.
What a good data license includes
- A schedule listing every approved source and date range
- Your warranties about rights, matched by the buyer's restrictions
- A documented de-identification method
- Deletion of raw data after processing
- Clear payment terms tied to actual sales
Have questions about your situation? Contact us or start with an estimate.