Definitions and comparisons
What is a no re-identification clause in a data license?
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
A no re-identification clause is a data license term in which the licensee promises not to identify, or attempt to identify, any person or household in the licensed records, and to bind everyone who handles them to the same promise. Under the CCPA, contractually binding recipients is one of three conditions for data to count as deidentified.
Key takeaways
- A no re-identification clause is a contract promise, so it supplements redaction and never replaces it.
- The CCPA's deidentification definition expects recipients to be contractually bound, alongside reasonable measures and a public commitment.
- The clause should bind affiliates, contractors and hosts, not only the named licensee.
- Linking licensed records with other datasets is the most common route to re-identification and should be banned expressly.
- The obligation should survive termination for as long as any copy or derived dataset exists.
What does a no re-identification clause say?#
A no re-identification clause says the licensee will not use the licensed records to identify a specific person or household, and will not try to. Strong versions also ban the indirect routes: linking the records to other data, contacting people who appear in them, or asking a contractor to do any of it.
The clause usually sits in the data use or restrictions section of a license, next to the permitted-use grant. It works alongside the preparation the supplier has already done. Redaction lowers the chance that a person can be identified; the clause makes any attempt a breach with defined consequences.
The term matters most for operational records such as support tickets, CRM activity, dispatch notes and call transcripts. Even after names and contact details are removed, these records describe real interactions with real customers and employees.
How the clause fits the CCPA's three conditions#
The no re-identification clause is the contractual condition in a three-part structure. California Civil Code section 1798.140(m), as amended by the CPRA, treats information as deidentified only if the business takes reasonable measures, publicly commits not to reidentify it, and contractually obligates any recipients to comply.
Each condition covers a different risk, and none substitutes for another. A perfect clause cannot rescue a file that still carries phone numbers in ticket bodies, and careful redaction cannot rescue a license that is silent on reidentification.
| Condition | Who controls it | What the clause can and cannot do |
|---|---|---|
| Reasonable technical measures | The supplier's preparation team | Cannot fix residual identifiers; can require the licensee to report any it finds |
| Public commitment | The owner of the supplier's privacy notice | Cannot create the commitment; can mirror its wording so promises match |
| Contractual obligation | Both parties, through the license | Is the condition itself; must reach every recipient, not only the signer |
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
The components of a strong clause#
A strong no re-identification clause has several components, and each closes a specific route to identifying someone. Use the table as a drafting checklist when reviewing a buyer's paper.
Definitions carry much of the weight. If 'Licensed Data' covers only the delivered files, embeddings, extracts and annotated copies may fall outside the clause. Define the term to include derived data, and define 'Licensee' to include affiliates and anyone acting on the licensee's behalf.
| Component | What it does | Drafting question |
|---|---|---|
| Core prohibition | Bars identifying or attempting to identify any person or household | Does 'attempt' cover testing, research and casual inquiry? |
| Linkage ban | Bars combining the records with other datasets to single anyone out | Does it cover public sources, purchased data and the licensee's own customer data? |
| Contact ban | Bars contacting anyone who appears in the records | Does it reach sales and recruiting teams as well as research staff? |
| Flowdown | Requires affiliates, contractors, hosts and annotators to accept the same terms | Is 'Licensee' defined broadly enough, and is the licensee liable for them? |
| Inadvertent identification | Requires the licensee to stop, notify the supplier and delete the affected records | Is there a firm notice duty and a cure process? |
| Outputs | Bars building or prompting outputs designed to reveal people in the records | Is there a takedown process if a model reproduces identifying text? |
| Verification | Gives the supplier a certification or audit right | Is the right practical, such as a periodic written certification? |
| Survival | Keeps the obligation alive after termination | Does it last while any copy or derived dataset exists? |
Why the clause matters even after careful redaction#
The clause matters after redaction because no removal process is perfect. NIST Interagency Report 8053, which surveys de-identification research, records that some data treated as de-identified has later been re-identified by researchers, typically by matching what remains against outside sources.
Operational records give that combination plenty to work with. A job record with a service date, an equipment model and a neighborhood, or a support case that quotes a customer's own description of an outage, can point to one household or one account without a single name. The clause turns that residual risk into a contractual duty with remedies.
At least one public deal for operational records uses this structure. Reporting in August 2026 on the proposed sale of Spirit Airlines' internal business data in its bankruptcy, which was subject to court review at the time, stated that a third party would strip personally identifiable information before the buyer received the data, and that the agreement bars attempts to re-identify individuals.
Where buyers push back, and workable middle ground#
Buyers usually accept the core prohibition and push back on scope, verification and model outputs. The negotiation is about making each promise specific enough that an engineering team can actually perform it.
- Testing: allow narrowly defined privacy testing only by the supplier or an agreed independent reviewer, with results shared and no linkages kept.
- Model outputs: buyers rarely promise a model will never reproduce text, so a workable middle ground is a duty to apply reasonable output filtering and act on takedown requests.
- Audit rights: replace open-ended audits with a written certification plus an audit right triggered by a credible report of breach.
- Business identities: state whether the clause covers company names in B2B records or only individuals, and handle customer companies through confidentiality terms.
- Remedies: pair termination and deletion rights with injunctive relief, since money damages rarely undo an identification.
Illustrative: a consulting firm licenses its project review archive#
Illustrative: a fictional management consulting firm wants to license project review memos, proposal drafts and resource plans from its Confluence and SharePoint archive. Client names, client staff names and engagement codes have been removed or replaced, and partners appear only as role labels.
The buyer's draft license bans re-identification by the licensee but says nothing about its annotation vendor, permits linkage for quality purposes and ends all restrictions at termination. The firm's general counsel asks for a flowdown to all contractors, a linkage ban that covers public company filings and news coverage, a notice-and-delete duty for inadvertent identification, and survival for as long as any copy exists.
The buyer accepts everything except a broad audit right, which becomes a written certification plus an audit on credible report. The firm approves release, and the final clause matches the deidentification commitment in its own privacy notice.
How SourceX handles re-identification terms#
SourceX treats re-identification terms as part of the Approval step in the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery. Preparation removes personal and confidential details first, and the supplier reviews the license restrictions before anything is released.
The SourceX Evidence Packet records the permitted use and the privacy record for each package, so the removal method and the contractual restrictions sit side by side. Whether a package meets a particular state's deidentification standard is assessed deal by deal with the supplier's counsel.
Frequently asked questions
Does a no re-identification clause cover company names in B2B records?
Not automatically. Most clauses are written around individuals and households, which is where privacy laws focus. If client or customer company names matter, handle them separately through confidentiality terms or by removing them during preparation, and make sure the definitions say which approach applies.
What should happen if the licensee identifies someone by accident?
A good clause requires the licensee to stop using the affected records, notify the supplier promptly, delete or isolate the records and confirm in writing. Treating accidental identification as a reportable event, rather than an automatic breach, encourages buyers to disclose it instead of hiding it.
Should the clause survive the end of the license?
Yes. Trained models, derived datasets and backups can outlast the license term, so the obligation should continue for as long as any copy or derivative of the records exists. A clause that ends at termination leaves the most durable copies unprotected.
Can a strong clause replace redaction?
No. A contract allocates risk between the parties; it does not change what the records contain. The CCPA structure expects reasonable technical measures as well as contractual commitments, so redaction comes first and the clause backs it up.
Who enforces the clause in practice?
The supplier does, through the license. That is why verification terms, notice duties and injunctive relief matter: without them, the supplier may never learn of a breach. Some suppliers also ask the licensee to name a person responsible for compliance with the restrictions.
Sources
- Under Cal. Civ. Code 1798.140(m), as amended by the CPRA, information is deidentified only if the business takes reasonable measures, publicly commits not to reidentify it, and contractually obligates any recipients to comply. Source
- NIST Interagency Report 8053, De-Identification of Personal Information, notes that researchers have shown some de-identified data can be re-identified. Source
- Reporting on the Spirit Airlines data sale states that a third party would strip personally identifiable information before the buyer receives the data and that the agreement bars attempts to re-identify individuals. Source
- SiliconANGLE reported on August 17, 2026 on the sale of Spirit Airlines' internal business data in a bankruptcy auction, according to filings in the U.S. Bankruptcy Court for the Southern District of New York. Source
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.