Customer Contracts and DPAs: Checking Whether Customer Data May Be Used for AI Training

This page is general information, not legal advice. Confirm requirements with counsel for your jurisdiction and use case.

Why the supplier's customer contracts decide the question

The supplier's contracts decide the question because the records describe its customers' businesses and people, and the supplier can only license what its own commitments permit. A support platform export, a Gong or Chorus call library, or a Salesforce opportunity history typically contains customer names, contact details, product configurations, pricing and complaints. Each of those is covered by some mix of confidentiality, data-use and data protection terms the supplier signed.

Breaking those commitments has regulatory teeth, not just contract exposure. FTC staff warned in a January 2024 post that companies may be liable if they break promises not to use customer data for undisclosed purposes such as training models [1], and commentators read related FTC staff guidance as saying that quietly or retroactively changing terms to permit AI use can itself be unfair or deceptive [2]. For a buyer, a supplier's breach becomes a provenance defect in your corpus. The cluster hub on data provenance for AI training data covers the wider chain; this page covers the customer-contract link only.

Controller or processor: classify every customer data set first

Classify each data set by role before reading clauses, because a processor's permitted use is fixed by its customer's instructions. Under GDPR Article 28, a processor processes personal data only on the controller's documented instructions, and a processor that determines its own purposes and means is treated as a controller for that processing [3]. US state laws use parallel concepts: the CCPA's "service provider" and "contractor" definitions depend on a written contract limiting how the recipient may retain, use or disclose personal information [5].

In practice the split often looks like this:

• Supplier as controller (or "business"): its own sales-call recordings with prospects, its CRM notes, its own support tickets about its own product. Use is governed by its privacy notice and the confidentiality terms in its customer contracts.
• Supplier as processor (or "service provider"): data it hosts or handles for customers, such as a helpdesk vendor's tenant data or an outsourced contact center's call recordings. Training use usually needs the customer's authorization, covered on client data held by service providers.
• Mixed: a SaaS vendor's tickets where the customer's end users describe problems inside the customer's account. The ticket thread may be the vendor's record while attached logs or screenshots are customer content.

If a supplier cannot say which role it holds for a given data set, treat that as an open finding, not a technicality.

Clauses to search for in MSAs, DPAs and order forms

Search the contract set for six clause families, because AI training permission rarely appears under a heading that says so. Older agreements predate the question entirely, while newer DPAs often address it expressly in either direction.

Read the order form last but carefully: it can override the MSA, and enterprise customers frequently negotiate data-use carve-outs there. The neighboring guide on SaaS platform terms and exported data covers the separate question of what the tool vendor's terms allow.

Sector overlays that tighten customer-contract terms

Sector rules can restrict reuse even where the customer contract looks permissive, so flag regulated customers before reviewing clauses. A supplier that received nonpublic personal information from a bank or lender may be bound by Regulation P limits on redisclosure and reuse [6]. Records from healthcare customers usually arrive under a business associate agreement, and any training release needs HIPAA de-identification by Safe Harbor or Expert Determination [7].

EU personal data adds a model-level risk. The EDPB's Opinion 28/2024 addresses when models trained on personal data can be considered anonymous and how unlawfully processed training data can affect later use of a model [4]. A GDPR Recital 26 analysis of whether released records are truly anonymous is a separate step from the contract check [3].

Exclusions versus renegotiation

Excluding restricted customers is usually faster and cleaner than asking a supplier to renegotiate contracts, as long as the exclusion is mechanical and auditable. Renegotiation means the supplier asking its customers for new rights, which raises the FTC concern about retroactive changes if it is handled through a quiet terms update [2]. Exclusion means removing every record tied to a restricted account ID before release.

For exclusions to hold, the supplier needs a stable customer key across systems: Salesforce Account ID, Zendesk organization_id, HubSpot company ID, or the tenant ID in a call-recording platform. Check that the exclusion also catches forwarded emails, CC'd contacts and transcripts where the restricted customer appears as a third party. Track each exclusion in a training data use register so later model work can show which customers were never in scope.

The contract-review memo to request

Ask for a contract-review summary or counsel memo that ties the review to the exact sample and date range you are licensing. A generic statement that "our contracts allow this" does not survive diligence. The memo should list contract templates by version, the population of customers covered, and how outliers were handled.

Illustrative example: invented to show structure; it does not describe an available dataset.

contract_review_summary:
  dataset: "support_tickets_2021-01_to_2025-12"
  record_scope: "ticket threads, internal notes, CSAT fields; attachments excluded"
  supplier_role:
    own_product_tickets: controller
    white_label_tenant_tickets: processor  # excluded from release
  contract_population:
    customers_in_range: 412
    template_versions_reviewed: ["MSA v3 (2019)", "MSA v4 (2022)", "DPA 2023-06", "AI addendum 2025-02"]
    negotiated_contracts_reviewed_individually: 38
  findings:
    - clause: "MSA v4 s.8.2 confidentiality limits use to performing Services"
      treatment: "customer business identifiers redacted; counsel view attached"
    - clause: "AI addendum 2025-02 no-training covenant"
      customers_affected: 17
      treatment: "excluded by Salesforce Account ID"
    - clause: "Regulation P customers (banks, lenders)"
      customers_affected: 9
      treatment: "excluded"
  exclusion_key: "salesforce_account_id, zendesk_organization_id"
  personal_data_treatment: "names, emails, phones, account numbers replaced; method recorded"
  reviewer: "outside counsel; memo dated 2026-08-30"
  open_items: ["three legacy contracts not located; customers excluded"]

Test the memo against the data. Pull a sample of records, map each to its customer key, and confirm the governing contract version for that customer and date, as described in testing a supplier's provenance claims on a sample.

What this check does not cover

This check covers B2B contract terms only; consumer notices, employee authorship and copyright each need their own review. Consumer-facing privacy notices and consent records are handled in consent and notice records for AI training data. The owner question of whether suppliers need end-customer consent for support tickets is answered on do I need customer consent to license support tickets, and the supplier-side view is in can I sell customer data to AI companies.

For dataset scoping, see customer support transcripts for AI training and sales CRM histories. The contract review then becomes one document in the supplier's chain of title for AI training data.

Where SourceX fits in rights review

SourceX sources operational datasets from US companies on request, including support and sales histories, and manages the licensing process. Every dataset is rights-reviewed for ownership and consents, diligence materials covering source, rights, preparation and allowed use are prepared per dataset, and every release is approved by the supplying company. Personal details such as names, emails, phones and account numbers are removed or replaced before delivery, the method is recorded and a sample is checked, though no method is perfect. You can describe the customer-related records your team needs without naming suppliers.

Sourcing customer-related records with contracts reviewed

If your model work needs support tickets, sales calls or CRM records, describe the data, the intended use and the date range rather than the businesses. SourceX looks for US businesses that hold it, assesses data and licensing permissions, and nothing is contracted until a supplier agrees; a request does not guarantee a match. Start at SourceX for AI data buyers.