Security questionnaire to send a data licensee (template)

When to send a security questionnaire to a data licensee#

A security questionnaire for a data licensee works best after the dataset scope is agreed and before the license is signed. At that point the recipient knows what it will receive, and you can still turn weak answers into contract terms or change the delivery method.

Most companies know questionnaires from the other direction, answering a customer's vendor review. Standardized sets such as the Shared Assessments SIG family are broad and cover a whole vendor relationship. This template is narrower: it asks about one licensed dataset, how it will be used for AI training or evaluation, and what happens to it when the license ends.

Expect some recipients to reply with existing attestation reports plus short written answers. That is reasonable, provided the dataset-specific questions on copies, training use and deletion get direct answers.

Storage and environment: questions 1 to 5#

Storage questions establish where your records will live and how many copies will exist. Geography deserves a direct question: the Data & Trust Alliance's Data Provenance Standards include metadata fields for allowed and excluded processing and storage geographies, a sign that dataset recipients already track it.

Access and personnel: questions 6 to 10#

Access questions show how many people and systems can reach the raw dataset, which is usually where exposure risk concentrates. Ask about contractors explicitly, because annotation and evaluation work is often outsourced.

Training use and permitted purpose: questions 11 to 15#

Training use questions are the part generic questionnaires leave out. They check that the recipient's plans match the permitted-use clause and that nobody intends to undo your preparation work.

Retention, deletion and return: questions 16 to 20#

Deletion questions decide what you can prove at the end of the term. Ask about derived copies, not only the original files, and settle in advance whether trained model weights are affected, which licenses usually address in a separate clause.

Incident response and notification: questions 21 to 25#

Incident questions set expectations before anything goes wrong. Negotiate the notification window in the contract rather than accepting whatever the recipient's standard policy says.

Read any attestation report for what it actually covers. A SOC 2 report is an attestation by a CPA firm, not a certification; the security criteria appear in every report, while availability, processing integrity, confidentiality and privacy are included only if chosen. Check that the systems named in the report are the ones that will hold your dataset.

How to read the answers and close the gaps#

Answers become useful once each one is accepted, turned into a contract term or treated as a reason to change the delivery. Judge them against your own risk and the sensitivity of the dataset, not against a perfect standard.

Illustrative: a fictional engineering firm sends this questionnaire before licensing its internal project review records. The recipient's answers are solid on storage and access but vague on derived copies and contractor access, so the firm's general counsel adds a deletion certificate clause covering evaluation sets, requires named annotation vendors, and attaches the full answers to the license as an exhibit.

• 1No inventory of copies, or an answer that copies are not tracked.
• 2Training use described more broadly than the permitted-use clause.
• 3No answer on re-identification, or a refusal to commit to a prohibition.
• 4Deletion limited to the original files, with derived copies left out.
• 5Contractor access with no named firms or agreements.

How SourceX uses questionnaire answers#

SourceX treats the recipient's security and use commitments as part of the Approval and Delivery steps of the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery. The supplier sees those commitments before approving release.

Permitted use and release authorization are both components of the SourceX Evidence Packet, so what a licensee commits to in its answers sits beside the record of what was prepared and approved.