Leadership and readiness
How to brief outside counsel on a data licensing opportunity
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
To brief outside counsel on a data licensing opportunity, send one pack before the first call: the systems and record families in scope, the contracts and notices that govern them, the proposed scope and permitted use, and numbered open questions. Then ask for a phased review that starts with a short rights memo by record family.
Key takeaways
- A written pack sent before the first call replaces hours of discovery questions with documents counsel can read.
- Describe records to counsel with field lists and masked examples; send raw exports only if counsel asks for them.
- Phase the engagement: a rights memo by record family first, then privacy and preparation, then term sheet, then the license draft.
- Numbered, specific questions let counsel scope the work and the fee to what you actually need decided.
- Ask early whether the firm represents AI developers or data intermediaries, so a conflict does not surface mid-deal.
What should a counsel briefing pack contain?#
A counsel briefing pack for a data licensing opportunity contains six items: a system list, a record family summary, the governing documents, your privacy notices, the proposed scope and a list of open questions. Each item answers something counsel would otherwise ask on the clock.
Keep the pack short and dated. A cover memo of one or two pages with appendices is easier to review than a shared drive of loosely named folders, and it gives both sides a fixed record of what the company said and when.
| Pack item | What to include | What counsel uses it for |
|---|---|---|
| System list | Each system holding candidate records, its vendor, plan or deployment, and its administrator | Vendor terms, export routes and where records physically sit |
| Record families | Record types, years still accessible, rough scale in words, and how records link | Matching each rule to the records it touches |
| Governing documents | Customer contract templates by era, negotiated outliers, NDAs, vendor terms, employee confidentiality terms | Restrictions on reuse, confidentiality and ownership |
| Privacy notices | Every version of the privacy policy and terms in force while the records were created | Whether past notices support the proposed use |
| Proposed scope | Record families in and out, planned removals, permitted use you would accept, your stance on exclusivity | The boundary of the opinion and of any draft license |
| Open questions | Numbered questions with the facts you already know under each | The work plan and the fee estimate |
How do you describe records without sending them?#
Records are described to counsel through field lists, schemas and masked examples rather than raw exports. Counsel needs to know what a support ticket, project file or job record contains, which fields hold personal or client details and how records connect; that rarely requires thousands of live records.
A field list taken from the system's export screen, one record with names and contact details masked, and a sentence on linkage (a ticket tied to a Jira issue and a release note, for example) usually give enough to work with. If counsel does ask for real samples, agree in writing how they will be stored and when they will be returned or destroyed.
Sending customer records outside the company, even to your own law firm, is still a transfer worth minimizing. Share what the review needs and nothing more.
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
Which contracts belong in the pack?#
The contracts that belong in the pack are the templates that governed the records in scope, plus every negotiated agreement that departs from them. Counsel can review a handful of templates and a list of exceptions far faster than a folder of every signed contract.
Vendor and platform terms deserve a separate look because some now address AI training directly, apart from who owns the records. Slack's API Terms of Service bar applications offered outside your own organization from using API data to train a large language model, and HubSpot's developer changelog describes updated Developer Terms that restrict using data accessed through its APIs to train or improve AI models. Include each platform's current terms with the date you downloaded them.
- Customer agreements: each version of your standard MSA or terms of service with the dates it was in use, and any data processing agreements.
- Negotiated outliers: customer contracts with custom confidentiality, data ownership or no-reuse clauses, listed by customer and date range.
- Vendor and platform terms: the terms for each system on the system list, including any API or developer terms you would rely on for exports.
- Employee documents: handbook confidentiality sections, invention assignment agreements and any notices about monitoring email or chat.
- Corporate documents: credit agreement covenants on licensing or asset transfers, and investor consent rights.
- Inbound paper: any NDA, term sheet or proposal already received from a prospective buyer or intermediary.
How to scope the engagement so the bill stays predictable#
An engagement stays predictable when it is split into phases with a named deliverable for each. Ask counsel to price the first phase on its own, then decide whether to continue once you have read the answer.
| Phase | Deliverable to ask for | Decision it supports |
|---|---|---|
| 1. Rights screen | A short memo by record family: clear, needs consent or notice, or exclude | Whether any record family is worth preparing |
| 2. Privacy and preparation | Required removals, the de-identification approach and any notices to give | What the prepared dataset may contain |
| 3. Term sheet | Comments on permitted use, exclusivity, term, deletion, audit and liability | Whether to proceed to a draft license |
| 4. License draft | A redline and an issues list written for the signer | Signature |
Which open questions should you write down?#
The open questions worth writing down are ones counsel can answer with yes, no or 'it depends on' a named fact. A question such as 'is this legal' produces a broad memo and a broad invoice.
- Do the customer agreements from each era allow us to use de-identified support records outside the services we provided?
- Does our privacy policy history support licensing de-identified records, or would any group need a new notice?
- Which entity in our group holds the records of the business we acquired, and who must sign for it?
- Do any vendor or API terms restrict how we export these records for this purpose?
- Does our credit agreement require lender consent for a non-exclusive license?
- What warranty, indemnity and liability cap position should we accept as the supplier?
Who should be on the first call with counsel?#
The first call with counsel works best with three people: the executive who will recommend or sign the deal, the person who administers the systems, and whoever owns finance. The CEO or general counsel frames the decision, the CTO, COO or IT lead answers export and retention questions, and the CFO raises deal structure and tax questions to route to advisors.
Ask which specialties the matter needs. Data licensing usually touches commercial contracts, privacy and intellectual property, and some firms staff each with a different partner; knowing that up front avoids paying several lawyers to learn the same facts. Ask too how counsel wants materials labeled and routed so that privileged communications keep that protection where it applies.
Illustrative: an engineering firm briefs counsel in one pass#
Illustrative: a fictional civil and structural engineering firm runs Deltek Vantagepoint for projects and staffing, Bluebeam for markups, Procore on construction-phase work and Microsoft 365 for email. Leadership wanted to know whether its RFI logs, submittal review comments and internal QA checklists could be licensed. Before calling counsel, the operations director built a system list and a one-page description of each record family, with a field list and one masked example of each.
The pack led with one question. Many of the firm's owner-engineer agreements were based on EJCDC forms; the 2014 edition of EJCDC E-500, for example, describes the documents as instruments of service in which the engineer retains an ownership interest, though wording varies by edition and some clients had negotiated ownership transfers. Counsel's phase-one memo split the archive along those lines: internal QA checklists and review comments were treated as firm records, deliverables under transfer clauses were excluded, and RFI logs went to a second look because they quote contractor and owner correspondence.
The firm reached a scoped answer after one phase of legal work, and entered the term sheet phase with a scope counsel had already shaped.
How SourceX works alongside your counsel#
SourceX works alongside the supplier's own counsel rather than replacing it. In the SourceX five-step transaction (Supply, Rights, Preparation, Approval, Delivery), counsel's phase-one answers are applied in the Rights step, record family by record family, before any preparation begins, and the supplier approves every step.
Because the fit check asks for metadata rather than files, the system list and record family summary prepared for counsel can be reused for it. For each package that proceeds, the SourceX Evidence Packet documents what counsel will want to compare against the final license: provenance, licensing rights, permitted use, the privacy record and release authorization.
Frequently asked questions
Do we need a specialist data or AI lawyer, or will our usual corporate counsel do?
Your usual corporate counsel can often run the rights screen, because it turns on your own contracts and history, which they may already know. For privacy preparation and the license draft, ask whether the firm has represented suppliers in data or technology licensing. Many companies keep their regular firm and add a specialist for one phase.
Should we sign a buyer's NDA before talking to counsel?
Talk to counsel first if you can. NDAs from prospective buyers or intermediaries sometimes include residuals clauses, non-solicitation terms or broad definitions of what may be retained, and those matter later. If an NDA is already signed, put it in the pack so counsel can check whether it limits what you share during the review.
What if counsel says a record family cannot be licensed?
Treat it as a scope decision, not a dead end. Ask what would change the answer: a narrower permitted use, more removals, written consent from specific customers, or excluding a date range governed by a stricter contract template. Some record families stay out entirely, and the remaining scope may still be worth pursuing.
Should the board see counsel's memo?
The board usually needs counsel's conclusions rather than the full memo. Summarize which record families are clear, which need further steps and which are excluded, and ask counsel how to share the memo itself without weakening privilege.
How long should we keep the briefing pack?
Keep it with the deal records for as long as the license and any audit or deletion obligations last. The pack shows what the company knew and what counsel reviewed at the time, which helps if a customer, buyer or future acquirer asks how the decision was made.
Sources
- Slack's API Terms of Service state that a provider of an application offered for use outside its own organization may not use API Data to train a large language model, and may not bulk export Slack message and file data except where an additional agreement expressly allows it. Source
- HubSpot's developer changelog says its updated Developer Terms restrict using data accessed through HubSpot APIs to train, fine-tune or improve AI or machine learning models, with a carve-out for legitimate single-customer use cases. Source
- EJCDC E-500 Owner-Engineer agreement language (2014 edition excerpt) states that all Documents are instruments of service and the Engineer retains an ownership and property interest therein, including the copyright and the right of reuse at the Engineer's discretion, whether or not the Project is completed. Source
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.