What should you ask a buyer before licensing your company data?

Updated October 25, 2026 · How we research

Who is the buyer and who ends up with the data?

Some buyers use data themselves. Many license it onward to AI labs or other customers. You should know which, because it decides who holds your records and under what rules.

You can check some answers yourself. Look up the company's registration, read its website terms and privacy policy, and see whether the person you are dealing with appears on the company's own site or professional profiles.

• What is your full legal company name and where are you based?
• Will you pass our data to other companies? Which kinds, and under what contract?
• Can we approve or block specific recipients, such as competitors?
• What may the data be used for: training, testing, evaluation, something else?

How will our data be protected?

These questions cover access, de-identification and security. The answers should be specific, not general reassurance.

• Who performs de-identification: you, a third party, or us?
• Does it happen inside our systems or after the data leaves?
• What standard do you use, and how do you handle indirect identifiers like job titles and places?
• Will we review and approve a de-identified sample before delivery?
• What access do you need to our systems, and is it read-only and time-limited?
• Who at your company can see raw records?

What exactly is in scope?

Scope should be written down system by system. Vague scope is one of the easiest ways for a deal to cover more than you meant.

• Which systems, teams and date ranges are included?
• What do you exclude by default (HR, health, financial account details, credentials)?
• Can we add our own exclusions?
• Does the license cover only data we have now, or future data too?

How and when do we get paid?

If a third party introduced you, also ask whether any referral fee affects your payment. See the guide on how referral fees work.

• Is payment upfront, a revenue share, or both?
• What event triggers payment: signing, acceptance, delivery, or resale?
• How many days after that event?
• For revenue share, how is it calculated, how often is it paid, and can we audit it?
• Are there any fees, deductions or holdbacks?
• Can any payment be clawed back, and why?

What happens at the end?

Legal commentators on AI licensing recommend that deletion terms cover backups and other copies, not just the main dataset, and that the vendor certify destruction.

• How long can you keep and use the data?
• Will you delete raw copies, backups and caches, and by when?
• Will you certify deletion in writing?
• What happens to models already trained on the data?
• What happens if you are acquired or shut down?

Who carries the risk if something goes wrong?

Ask what promises the contract asks you to make about your rights to the data, what happens if a privacy problem is found later, and whether each side will cover the other's losses for its own mistakes. That last point is called indemnity. Your lawyer should review these terms carefully; they matter more than the headline price.

Also ask about insurance. Some contracts require one or both sides to carry insurance that would pay for privacy or data claims. If the buyer is small or new, a promise to cover your losses is only as good as its ability to pay.

• What do you need us to promise about our rights to the data?
• Will you cover our losses if your processing causes a privacy problem?
• Is there a cap on each side's liability?
• What insurance do you carry?

How do you keep the answers organized?

Write the questions in a short document and send the same list to every buyer you are talking to. Ask them to answer in writing. That makes it easy to compare buyers later and to check the final contract against what you were told. The guide on comparing offers shows one way to lay the answers out side by side.

General information, not legal, tax or financial advice.