How does data licensing work for a holding company with several subsidiaries?
Each subsidiary usually owns the records it created, so the right to license sits with that entity, not automatically with the parent. Shared email, chat or ERP (business management) systems make this harder, because one export may mix data from several companies with different contracts and obligations.
Which entity actually owns the data?
In a group structure, the parent owns shares in its subsidiaries, while the subsidiaries own their own assets, including business records. A license of a subsidiary's records is therefore normally signed by, or on behalf of, that subsidiary.
Intercompany agreements, shared-services arrangements and IT contracts may say otherwise. Check them with counsel before assuming the parent can license everything.
- CheckAre these records your company's own?
Records you create running your business usually are. Data you hold for customers, under their contracts, often is not.
- CheckDo contracts or NDAs restrict use?
Customer, supplier and partner agreements can bar sharing even de-identified material. Read them, or have counsel read them.
- CheckDo they contain personal data?
Employee and customer details must be removed, and some laws (for example California's) give people rights over their data.
- CheckIs any of it regulated?
Health records, financial-account data and professional client files carry their own rules. Exclude them unless counsel says otherwise.
Why do shared systems complicate things?
Many groups run one email account setup, one chat workspace or one ERP system for several companies. An export from that system mixes records from entities with different customers, NDAs and privacy notices. Each entity's limits still apply to its part of the data.
In practice this means deciding up front which entities are in scope, then filtering the export by domain, channel, workspace or company code so that out-of-scope records stay out.
What can limit a subsidiary's right to license?
Commercial contracts, NDAs and platform terms can restrict selling data, as can privacy law and employee protections, according to a 2026 overview by a technology law firm. Regulated data, such as health or financial records, may have separate rules. The guide on employee and customer privacy covers the privacy side.
Different subsidiaries can land in different places. One may be free to license; another may not.
- List each subsidiary and the systems it uses.
- Note which systems are shared across entities.
- Pull the key customer contracts and NDAs for each entity.
- Collect the privacy notices given to employees and customers.
- Decide what to exclude, such as HR files, legal advice and regulated data.
Should proceeds go to the parent or the subsidiary?
Generally the entity that owns and licenses the records receives the payment, and how money then moves within the group is a tax and corporate question. Talk to your accountant and lawyer before structuring it.
Keep the paperwork consistent with that choice. The license, the invoice and the bank account receiving payment should all match the entity that owns the data. Mismatches can cause problems later in audits, lender reviews or a sale of the subsidiary.
How do you set the scope of a group license?
Scope is the list of what is in and what is out. For a group, it usually has three layers: which entities, which systems, and which date range. A clear scope protects entities that are not part of the deal and makes offers easier to compare.
It also helps to write down exclusions that apply across the whole group, such as HR and payroll files, legal advice, board materials and regulated data. Buyers generally expect a defined scope before they look at a sample.
Expect the scoping step to take longer than for a single company. Several finance, IT and legal owners may need to agree, and records from shared systems may have to be separated before anything leaves the group. Building that time into your plan avoids rushed decisions later.
Is there help for larger groups?
Groups with 250 or more employees can request a call with us. We are a disclosed matching service: we point companies to buyer programs that fit, and a buyer may pay us a referral fee if a company we sent signs. We never see or hold your records, and we do not give legal or tax advice.
Common questions
Can the parent license all subsidiaries' data in one deal?
Only if it has the right to do so for each entity. Usually each subsidiary holds its own rights, so counsel should confirm authority.
We use one Microsoft 365 tenant for every company. Is that a problem?
Not necessarily, but you will need to separate records by entity and apply each entity's restrictions to its own data.
Can we license one subsidiary and not the others?
Yes. Many groups start with the entity that has the cleanest rights and best-kept records.
Who pays tax on the proceeds?
That depends on your structure. Ask your accountant.
What should a group leave out?
Common exclusions are HR files, legal advice, board papers and regulated health or financial data. Agree the list with counsel.
Sources
General information, not legal, tax or financial advice.