What can be excluded?

Updated October 25, 2026 · How we research

Can I really choose what to leave out?

Yes. A license covers only what it describes. Buyers may prefer more, and exclusions may reduce what they pay, but defining the scope is your right as the owner. Reporting in October 2026 describes data suppliers leaving out HR records and removing personal details, and buyers saying they scrub data too.

It is easier to exclude whole categories (a system, a channel, a mailbox) than to pick through individual messages, so think in categories first.

What do companies most often keep out?

This is a common starting list. Your lawyer may add to it.

• HR, payroll and benefits records, including performance reviews, medical leave and disciplinary files.
• Regulated personal data, such as health information, Social Security numbers, bank and card numbers, and consumer financial records.
• Communications with lawyers. Sharing privileged advice with a third party may put the privilege at risk.
• Trade secrets. Information keeps trade-secret protection only while the owner takes reasonable steps to keep it secret.
• Customer and partner material covered by confidentiality clauses or NDAs.
• Passwords, keys and credentials pasted into chats or documents.
• Board, investor and M&A discussions.
• Private channels and direct messages, or specific people's mailboxes.

Why exclude customer data in particular?

Many customer agreements say the customer's information may be used only to serve that customer. If you handled health data as a vendor to a health care provider, federal rules limit you to what your business associate agreement allows. Financial institutions have their own sharing rules under federal law. Breaching these can cost far more than any data payment.

What about employee data?

Your records are full of employees' words, names and sometimes private details. Even work email can mention medical appointments or family matters. In California, employee information has been covered by the CCPA since January 1, 2023, for businesses that meet its thresholds. Some companies exclude certain individuals entirely, such as those who ask, or limit the license to business channels only. Talk to your lawyer about what applies to you.

How do I decide what to exclude?

A simple method is to go system by system. For each one (email, chat, tickets, documents, CRM, accounting, code), list the main folders, channels or projects, and mark each one as include, exclude or check with counsel. Anything you are unsure about stays out until you get advice.

Ask a few practical questions as you go. Does this area mainly hold personal or HR matters? Does a customer or partner contract cover it? Would it reveal a secret process or formula? Did lawyers take part in these conversations? Does it contain passwords or keys? A yes to any of these is a reason to exclude it or to remove the sensitive parts first.

Keep the list. It becomes the scope section of the contract and the checklist for whoever prepares the delivery. The guide on preparing a data inventory explains how to build it.

How are exclusions written into the deal?

Put the scope in writing: the systems included, date ranges, excluded channels or mailboxes, categories of content to remove, and who is responsible for removing them. Ask the buyer to confirm in the contract that it will delete anything it later finds that should have been excluded, and tell you when it does.

Then check the work. Review a sample of what will actually be delivered before it leaves your hands.

General information, not legal, tax or financial advice.