Data privacy vs the right to license business records: 4 permissions

Is data privacy the only question before licensing business records?#

No. Privacy law answers one question: whether personal information inside the records may be used and disclosed for a new purpose. A company can pass that test and still lack the right to license, because it does not own the content, a contract forbids the use, or the system access it has does not cover exporting the data for that use.

Treat licensing as four separate permissions that must all be true at once: system access, privacy permission, ownership and IP, and contractual rights. Each one is decided by different people, proven by different documents, and fails for different reasons. The common mistake is clearing one layer and assuming it cleared the others.

This page gives you the framework, a matrix you can reuse, and a walkthrough of five common record types. It is general information, not legal advice; counsel should review the specific records, notices and contracts before anything is released.

What is data privacy, and what does it actually govern?#

Data privacy is the body of law that controls how information about identifiable people is collected, used, disclosed and kept. It governs personal data, not business data as a whole, so a pricing table sits outside it while a support ticket signed by a named customer sits inside it. GDPR Article 4(1) and California Civil Code section 1798.140 both define personal data broadly, so a work email or customer ID in a CRM can count, and of the seven GDPR Article 5 principles, purpose limitation does the most work for licensing. The notice vs consent page explains how the two instruments differ.

The four-permission matrix: what each permission answers#

Use this matrix to assign each permission to an owner and to know what evidence closes it. A record set is licensable only when all four rows are resolved for the specific records and the specific use; a gap in any row narrows the scope rather than ending the conversation.

Permission 1: does system access mean you may export the data?#

Not by itself. System access means technical access: who can log in to a system and export from it under the vendor's terms. Being able to click export in Salesforce, Zendesk, Slack or NetSuite proves you have that access, not that you may take the data out for a new commercial use. The software vendor's terms, your own access policies and the account's ownership all sit on top of the export button.

Check three things. First, whose account is it: records in a founder's personal Google Drive, a free-tier tool or a contractor's workspace may not be the company's to export. Second, what the vendor agreement says about export, automated extraction and reuse of vendor-generated content such as benchmarks or AI summaries. Third, whether the export is complete and faithful, because a partial or altered export creates provenance questions a buyer will ask about later.

System access is usually the easiest permission to close, which is why it is the most often assumed. It is also the one that surfaces surprises late, such as message history held only in a paid tier that lapsed.

Permission 2: what does privacy permission require for licensing?#

Privacy permission means the new use and disclosure of personal information fits what people were told, the purpose it was collected for, and a legal basis that covers the new purpose. Under US state laws it also means checking whether the transaction is a sale or a share, and a paid license of identifiable records will usually look like a sale under Civil Code section 1798.140. A company holding records as a processor for customers can process them only on the controller's documented instructions under GDPR Article 28, and the FTC has warned that a retroactive or quiet policy change may be unfair or deceptive. The page on consent to license de-identified records works through what the notice must have said.

Permission 3: who owns the content, and why doesn't ownership settle it?#

Ownership asks whose content the records are and whether anyone else holds intellectual property rights in them. Records employees created at work typically belong to the company, but customer-written messages, contractor work without an IP assignment and third-party attachments may belong partly or wholly to someone else; in the United States facts are not copyrightable (Feist, 1991), though original prose and selection or arrangement can be protected. Ownership does not settle the license question either way, because you can own records outright and still be barred by a contract or privacy notice from disclosing them. The pages on copyright in business records and on owning data vs having the right to license it cover these distinctions.

Permission 4: what can customer contracts, vendor terms and NDAs block?#

Contractual rights are the promises the company made about the data, and they often bind more tightly than privacy law. A customer MSA that classifies everything submitted as confidential information usable only to provide the service can block licensing even after de-identification, unless it carves out aggregated or de-identified data. The output of this layer is a list of carve-outs: customers to exclude, fields to remove and contracts that need an amendment or consent. The data rights review page covers what to look for in customer contracts and vendor terms.

Which permissions do common business records implicate?#

The same four questions land differently on each record type. This walkthrough shows typical patterns; your contracts and notices decide the actual answer.

What does de-identification change, and what does it not?#

De-identification can reduce or remove privacy obligations for the records it covers, but it creates no ownership or contractual rights: a customer contract that makes submissions confidential still applies to a de-identified ticket unless it says otherwise. The standard depends on the regime: GDPR Recital 26 excludes anonymous information but keeps pseudonymised data personal, the CCPA requires reasonable measures, a public commitment and contractual flow-down to recipients, and HIPAA recognizes Expert Determination and Safe Harbor. Whatever the standard, document the method and test for re-identification risk, because free text in tickets, Slack and transcripts is where identifiers hide. The anonymized vs de-identified page and the page on whether de-identification reduces value cover the terminology and trade-offs.

How should a GC or COO run the four-permission check?#

Run the four permissions in parallel, record by record type, and turn the results into a scope rather than a yes or no. The goal is a defined set of records, fields and customers that clears all four layers. The page on documents that prove the right to license your data lists the evidence to collect under each permission.

• 1Inventory the record types and the systems they live in, with date ranges and rough volumes.
• 2Close access first: confirm account ownership and vendor terms for each system.
• 3Pull every privacy notice version in force during the date range and map each to the records collected under it.
• 4Sort content by author: employees, contractors, customers, third parties.
• 5Search customer, vendor, NDA and financing agreements for confidentiality, use restrictions and consent requirements.
• 6Decide what de-identification removes and what it leaves, and document the method.
• 7Write the scope: included record types, excluded customers and fields, and conditions. Have counsel review it before anything leaves the company.

How does this apply when licensing records through SourceX?#

SourceX is the enterprise data transaction layer for AI: it runs sourcing and qualification, rights review, contracting, data preparation, delivery and payment for businesses licensing operational data to AI developers. The rights review is where the four permissions get worked through for a specific deal.

The first step is a short company assessment, and no data uploads are needed to see whether a company qualifies. Under SourceX's standing offer terms, de-identification is performed by SourceX directly or through its processing partner, and the company approves exactly what is released, once per deal, seeing what would leave before anything is shared. De-identification still sits alongside, not in place of, your own review of ownership and contracts.