Private equity and portfolios
Prior data-sharing agreements at an acquired company: how to find them
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
To find prior data-sharing agreements at an acquired company, search six places: the contract repository by keyword, accounts payable, accounts receivable, connected apps and API keys, scheduled file transfers, and privacy notices with partner integrations. The rule: every live data flow needs a matching agreement and every agreement needs a matching flow, so check paper and pipes against each other.
Key takeaways
- Data-sharing terms rarely sit in documents titled data license; they hide in order forms, co-marketing deals, rebate programs and API terms.
- Technical traces such as API keys, connected apps and SFTP jobs reveal flows that no contract file mentions.
- Payments in and out expose data relationships: vendors that receive records and partners that pay for reports.
- A prior exclusive grant or a surviving use right can limit what the company licenses next.
- Record every finding in one register with counterparty, records, permitted use, term, exclusivity and status.
Why prior data-sharing agreements are hard to find#
Prior data-sharing agreements are hard to find because few of them are called data-sharing agreements. The obligation may sit in a reseller agreement, a co-marketing deal, a manufacturer rebate program, a benchmark survey, API terms accepted by a developer, or a pilot with a software vendor that asked for sample records.
Founder-led companies add a second problem. The person who agreed to share data may have done it by email, and the feed kept running long after the relationship faded. A contract review alone misses those flows, and a systems review alone misses agreements with no live connection.
Treat everything the search turns up as input for counsel. The effect of any prior agreement depends on its exact wording and governing law, and what it may require is assessed case by case.
The search checklist: six places to look#
A complete search for prior data-sharing agreements covers six places, three on paper and three in systems. Run them in parallel and reconcile the results at the end, matching each agreement to a flow and each flow to an agreement.
- Contract repository and shared drives: keyword searches across executed agreements, order forms, amendments and statements of work.
- Accounts payable: vendors that receive company records, such as analytics, enrichment, benchmarking and marketing platforms.
- Accounts receivable: customers or partners paying for reports, feeds, insights or data access.
- Connected apps and API keys: OAuth apps, private apps and integration users in the CRM, help desk, chat tool and ERP.
- Scheduled transfers: SFTP accounts, ETL jobs, scheduled reports and automated email exports.
- Privacy notices and partner pages: statements about sharing with partners, and integrations listed in software marketplaces.
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
Which keywords surface data terms in a contract repository?#
Keyword searches surface data terms faster than reading every contract, as long as the list goes beyond the obvious words. Include signed PDFs, which often need text recognition before they can be searched, and email attachments saved to shared drives.
Read every hit in context. A clause titled confidentiality may grant the counterparty a right to use aggregated data, and a pricing exhibit may include a data feed as a deliverable.
| Search terms | What they tend to surface |
|---|---|
| data license, license to data, data rights | Formal licenses and grant clauses |
| aggregate, aggregated, de-identified, anonymized | Rights to use pooled or de-identified customer data |
| benchmark, insights, index, market report | Benchmark programs and report products built on company records |
| feed, extract, SFTP, API access | Recurring transfers and technical access rights |
| exclusive, exclusivity, right of first refusal | Grants that may limit future licensing |
| machine learning, artificial intelligence, train, model | AI-specific permissions or prohibitions |
| survive, survival, perpetual, irrevocable | Rights that continue after the agreement ends |
Follow the money and the pipes#
Payments and technical connections reveal data relationships that the contract file misses. A vendor paid regularly for enrichment or benchmarking usually receives records, and a partner that pays the company for reports may hold a license to the underlying data.
Platform terms matter for every connection found. The Slack Developer Policy lists using data to train an LLM under any circumstances among prohibited practices for apps, and a Hunton Andrews Kurth alert describes Slack API terms, effective May 29, 2025, that prohibit bulk export of API data, persistent archives and use of that data in large language models. A connected app pulling chat history may therefore be outside its platform's rules, whatever the company agreed with the app's vendor.
| Trace | Where to look | What it can reveal |
|---|---|---|
| Vendor payments | AP ledger and corporate card statements | Analytics, enrichment and marketing tools that receive records |
| Data or report revenue | AR ledger and revenue accounts | Partners paying for feeds, reports or access |
| Connected apps | CRM, help desk, chat and ERP admin consoles | Third parties with ongoing read access |
| API keys and integration users | Developer settings and service accounts | Automated pulls by current or former partners |
| SFTP and scheduled jobs | File servers, ETL tools and report schedulers | Recurring exports to outside parties |
What privacy notices and partner integrations tell you#
Privacy notices show what the company told people about sharing, which is the promise any past or future data flow has to match. Collect current and archived versions of the website privacy notice, in-product notices and employee notices, and compare their sharing statements with the flows the search found.
Partner integrations listed on the company's website or in software marketplaces point to data relationships that may carry their own terms. Ask the product or partnerships lead for every integration partner and whether any of them received bulk records rather than transactional access.
Confidentiality also affects what remains protectable. Under the Defend Trade Secrets Act, information qualifies as a trade secret only if the owner has taken reasonable measures to keep it secret, so records sent to partners without confidentiality terms may be harder to protect later.
Illustrative: a vertical software company with an old benchmark program#
Illustrative: a fictional holding company acquires a vertical software company that sells job management software to pool and spa service businesses. The contract repository holds customer subscription terms, a reseller agreement and a co-marketing agreement with an equipment manufacturer.
Keyword searches show that the co-marketing agreement lets the manufacturer use aggregated job data for a yearly benchmark report, with a perpetual right to reports already published. The AP ledger shows payments to a data enrichment vendor. The CRM admin console shows a connected app from the former reseller with read access, and an SFTP job still sends service summaries to the same reseller.
The holdco general counsel logs all three. The reseller's app is revoked and the SFTP job stopped after notice under the old agreement, the enrichment vendor's terms are reviewed for retention and reuse, and the manufacturer's surviving right goes into the disclosure register. Any future licensing excludes the aggregated job data covered by that right until counsel confirms its limits.
What should the data-sharing register record?#
The data-sharing register should record one row per agreement or flow with the facts counsel needs to judge it. A register turns scattered findings into something a board, a lender or a future buyer can rely on. Keep one row per agreement or flow, even when no paper exists.
- Counterparty, and the entity that signed the agreement or allowed the flow.
- Records covered and how they were transferred.
- Permitted use, including any AI or model-training terms.
- Term, survival clauses and termination steps.
- Exclusivity, first-refusal or most-favored terms.
- Status: active, ended with surviving rights, or informal with no agreement.
Where the register fits in a SourceX transaction#
SourceX asks for a data-sharing register during the Rights step of the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery. Prior grants feed the licensing rights and permitted use sections of the SourceX Evidence Packet, so a new license does not overlap an earlier exclusive grant or a surviving right.
Nothing is shared during the initial fit check, which works from metadata. The register itself stays with the company and its counsel until a specific package is scoped and the company decides to proceed.
Frequently asked questions
What if a data feed exists but no agreement can be found?
Treat it as an informal flow. Record what is sent and to whom, ask the recipient for any terms it holds, and let counsel decide whether to document, renegotiate or stop it. An undocumented flow can still create expectations or disclosure duties, so it belongs in the register.
Do aggregated or de-identified data feeds count?
Yes, for this search. Aggregated and de-identified data can still be subject to contract terms, privacy commitments and exclusivity, and a counterparty may hold rights to reports built from it. Record these feeds alongside identifiable data flows and note the method used.
Can a prior exclusive grant block a new license?
It can limit one. An exclusive grant over a record type, field of use or period may prevent licensing the same records to others while it lasts. Read the scope closely, because many exclusive grants are narrower than their headings suggest.
Who should run the search, legal or IT?
Both, with one owner. Counsel runs the contract and notice review, IT or the CTO runs the systems review, and finance pulls payment records. The general counsel usually owns the register so findings reach the disclosure schedules and the board.
Should old feeds be shut off immediately?
Not before checking the agreement. Some feeds support live customer obligations or require notice before termination. Pause and review first, then stop or document each flow with the counterparty, and keep a record of the date and the reason.
Sources
- Slack's Developer Policy lists "Using Data to train an LLM under any circumstances" among prohibited practices for apps, alongside collecting, storing or using Data without obtaining proper consent. Source
- According to a Hunton Andrews Kurth client alert, Salesforce modified the Slack API Terms of Service, effective May 29, 2025, to prohibit (i) bulk exporting of data accessible through Slack's APIs, (ii) the creation of persistent copies, archives, indexes or long-term data stores, and (iii) the usage of such data in large language models. Source
- Under 18 U.S.C. 1839(3), information qualifies as a trade secret only if the owner has taken reasonable measures to keep it secret and it derives independent economic value from not being generally known to, and not readily ascertainable through proper means by, another person who can obtain economic value from its disclosure or use. Source
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.