Privacy and preparation
What to bring to privacy counsel before a data licensing review
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
Before a data licensing review, bring privacy counsel six things: an inventory of the records in scope, every privacy notice in force when they were collected, the contracts that govern them, privacy request logs, incident history and your proposed preparation method. Counsel answers faster from dated documents than from recollection, and labeled gaps beat guesses.
Key takeaways
- Counsel reviews documents, not descriptions, so bring the actual notices, contracts and logs rather than summaries.
- The privacy notice that matters is the version in force when the records were collected, not the one on the website today.
- Request logs show whether people who asked to be deleted still appear in archives and exports.
- A written preparation method lets counsel judge residual risk and the license terms needed before any work starts.
- Counsel advises on which laws may apply; the company decides what to license once that advice is in hand.
What belongs in the packet for privacy counsel?#
The packet for privacy counsel holds six items: a record inventory, the notice history, the governing contracts, privacy request logs, incident history and a proposed preparation method. Together they answer the questions counsel would otherwise spend the first meetings asking, and they keep the review focused on the records actually in scope.
Assemble the packet before the first call, even if pieces are incomplete. A gap labeled as unknown is useful information for counsel; a gap covered by a guess tends to resurface late, after a buyer has seen a draft scope.
| Packet item | What to include | What counsel uses it for |
|---|---|---|
| Record inventory | Systems, record families, date ranges, whose data, where those people are | Deciding which laws may apply and to whom |
| Notice history | Every version of privacy policies, terms and employee notices, with dates | Checking what people were told at collection |
| Contracts | Customer agreements, DPAs, NDAs, vendor terms, acquisition agreements | Finding use limits, confidentiality duties and deletion commitments |
| Request logs | Access, deletion and opt-out requests, and how each was handled | Confirming honored requests reach archives and exports |
| Incident history | Security incidents, notices sent, regulator or customer inquiries | Spotting records with open obligations or extra sensitivity |
| Preparation method | What will be removed, how, how it is checked and what remains | Judging residual risk and the terms the license needs |
How detailed should the record inventory be?#
The record inventory should be detailed enough that counsel can tell whose personal information is in scope and where those people are, without opening a single record. System names alone do not answer that; one Salesforce org can hold prospects, customer contacts, partner reps and comments about employees in the same objects.
Describe the records as a buyer would receive them, not as the system stores them. If the planned scope is resolved support tickets with linked engineering notes, inventory exactly that, including attachments and custom fields, and list what is deliberately left out.
- Source systems and the specific objects, projects or mailboxes in scope
- Date range, and whether older history was migrated in from another tool
- People who appear: customers, customers' end users, prospects, employees, contractors, applicants
- Where those people are likely located, including any EU, UK or Canadian contacts
- Known sensitive content, such as health mentions, financial account details or government IDs
- Whether the company holds the records for itself or processes them on behalf of customers
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
Why the notice history matters more than today's privacy policy#
The notice history matters because counsel will weigh what people were told when their information was collected, and today's privacy policy may not have been in force then. Older records can sit under promises that are narrower, broader or simply different from the current text.
FTC staff have flagged after-the-fact changes. In February 2024, they warned that a company adopting more permissive data practices, such as using consumers' data for AI training, and disclosing the change only through a surreptitious, retroactive update to its terms or privacy policy may be engaging in unfair or deceptive practices. That was staff guidance, not a rule, but it explains why counsel asks for dated versions.
Collect website privacy policies, terms of service, in-app consent screens, employee handbooks and applicant notices, each with the dates it applied. If old versions are missing, check the website platform's revision history, old email announcements and public web archives, and tell counsel which periods remain unknown.
Which contract clauses should you flag for counsel?#
The contract clauses to flag are those that limit use, define confidential information, require deletion or restrict sharing with third parties. Counsel will read the documents, but a company that pre-flags known clauses shortens the review and adds business context the paper lacks, such as which customers are still active.
Bring signed versions, not templates. Enterprise customers often negotiated their own paper, and the clause that matters may sit in an order form or side letter rather than the master agreement.
| Document | Clauses to flag | Why counsel needs it |
|---|---|---|
| Customer agreements and DPAs | Permitted use, aggregated or de-identified data rights, deletion at termination | May limit, or expressly allow, use of customer-related records |
| NDAs and partner agreements | Definition of confidential information, residuals, term | Deal discussions and shared specifications may be covered |
| Vendor and platform terms | Ownership of customer data, API and export restrictions | Some platforms restrict how exported data is used or stored |
| Employee and contractor agreements | Confidentiality, IP assignment, monitoring notices | Shapes use of internal messages, code and work product |
| Acquisition agreements | Data representations, assigned contracts, privacy covenants | Acquired records may carry the seller's earlier promises |
Request logs and incident history: what counsel checks#
Request logs and incident history show counsel whether the company kept the promises it made to individuals, and whether any records carry open obligations. A deletion request honored in the live CRM but not in an older backup export is exactly the gap a licensing review should catch.
If no formal request log exists, say so and gather what does: help desk tickets tagged as privacy requests, messages to a privacy inbox, or CRM fields that mark contacts as do-not-contact. Counsel can work with partial evidence that is described honestly.
- Access, deletion, correction and opt-out requests, with dates and the systems each was applied to
- Suppression lists that keep deleted or opted-out people from being re-added
- Security incidents involving in-scope systems, and any notices sent to individuals or regulators
- Customer complaints or regulator inquiries that touched data use
- Active litigation holds, which may restrict changes to the records
What to say about your proposed preparation method#
The proposed preparation method should state what will be removed, how it will be detected, how the result will be checked and what will remain in the records. Counsel needs the method in writing because residual risk, and the contract terms the license will need, depend on it.
Be specific about detection and review. Pattern matching catches structured identifiers such as phone and account numbers, named-entity models catch many names and organizations, and human review of a sample catches what both miss. State how replaced values will look, such as role labels or consistent placeholders, and which fields will be dropped entirely.
De-identification standards can reach beyond the data itself. Under the California definition as amended by the CPRA, information counts as deidentified only if the business takes reasonable measures against re-association, publicly commits not to reidentify it, and contractually obligates recipients to follow the same rules. Counsel will check whether the draft license carries those obligations.
Illustrative: a mechanical contractor prepares for its first review#
Illustrative: a fictional commercial HVAC and mechanical contractor wanted to license its ServiceTitan job records, technician notes and equipment service histories. Before meeting outside privacy counsel, the CEO and office manager built the packet: a field-level inventory of jobs, invoices and notes, every website privacy policy version they could recover, signed service agreements with their largest property management clients, and the CRM's do-not-contact list.
The packet changed the scope early. One recovered policy version said customer information would not be shared with outside companies, and it covered years when the contractor also served homeowners. The CEO proposed excluding residential jobs from that period, and counsel focused the review on commercial service records, the property manager agreements and the method for removing tenant names and phone numbers from technician notes.
Questions to put to counsel, and how SourceX fits#
The questions to put to counsel are the ones that turn the packet into decisions: what may apply, what must change and what must be excluded. Asking them directly keeps the review from ending in a memo that lists risks without a recommended scope.
SourceX does not give legal advice; the supplier's counsel makes these calls. In the SourceX five-step transaction, counsel's conclusions are applied at the Rights and Preparation steps, and the supplier approves the scope and a prepared sample before anything moves. Counsel's sign-off on scope and the preparation results are recorded in the SourceX Evidence Packet as the privacy record and release authorization.
- Which privacy laws may apply to the people in these records, and what do they require for this use?
- Do any notice versions or contracts rule out specific record sets or periods?
- Is the proposed preparation method adequate, and what would strengthen it?
- Which license terms are needed, such as no reidentification, permitted use limits and deletion at term end?
- What should we document now so a buyer's diligence can rely on it?
What kind of data privacy attorney do you need for a data licensing review?#
For a data licensing review you need a data privacy attorney who has advised on secondary use of existing records, not only on writing privacy policies or responding to breaches. Privacy practices are broad, and a lawyer who mostly handles incident response may not have worked through de-identification standards, notice history or license restrictions on reidentification.
Match the profile to the records in scope. Most companies end up with one lead and, where the records touch a regulated sector, a second opinion on that sector.
| Attorney profile | Fits best when | Signals to look for | Gap to watch |
|---|---|---|---|
| In-house general counsel | Records and contracts are well documented and the deal is small | Has already handled your customer DPAs and privacy requests | May lack time or depth on state privacy laws and de-identification |
| Outside privacy specialist | Records hold consumer, employee or end-user personal information | Recent work on state comprehensive privacy laws, de-identification and data sharing deals | May need corporate counsel for the commercial license terms |
| Regulated-sector privacy counsel | Records may include health, financial, education or children's data | Specific experience with the sector law that may apply, such as HIPAA, GLBA, FERPA or COPPA | Narrow focus; pair with a generalist for the rest of the scope |
| Outside commercial or corporate counsel | Privacy questions are settled and the work is negotiating the license | Has negotiated data or IP licenses with permitted-use and audit terms | Should not be the only reviewer when personal information is in scope |
How do you find and vet a data privacy attorney?#
Find candidates through referrals from peers and your existing counsel, your state or local bar's referral service, and privacy specialists your corporate lawyer already works with, then vet them on matters similar to yours. The ABA maintains a Lawyer Referral Directory of state and local bar referral programs, searchable by city and state.
A privacy credential is a useful signal but not a license to practice. The IAPP's CIPP/US certification covers U.S. federal and state privacy statutes, sectoral laws and enforcement, so it shows study of the field; bar admission in the relevant state is what authorizes the lawyer to advise you.
Run a conflict check early. Under ABA Model Rule 1.7 comments, a lawyer asked to represent a seller in a deal against a buyer the lawyer represents in another, unrelated matter cannot take it on without each client's informed consent. Name the likely buyer, if you know it, before the first substantive call.
- Confirm bar admission and good standing through the state bar's lawyer search
- Ask for two or three anonymized examples of data sharing or de-identification matters the lawyer handled
- Ask who will do the work day to day and their experience
- Ask how the lawyer would approach your six-item packet and what they would need first
- Confirm there is no conflict with the expected buyer or with a key customer whose records are in scope
What should the engagement letter with a privacy attorney cover?#
The engagement letter should state the scope of the review and how fees and expenses will be charged, before substantial work begins. ABA Model Rule 1.5(b) says the scope of the representation and the basis or rate of the fee and expenses should be communicated to the client, preferably in writing, before or within a reasonable time after the representation starts; your state's version of the rule may differ, so ask the lawyer what it requires.
Ask for scope language specific to the licensing review rather than a general privacy retainer. That keeps the review from drifting into a full privacy program overhaul you did not plan to fund at this stage.
- Which record sets, systems and date ranges the review covers
- Deliverable: a written recommendation on scope, exclusions, preparation method and license terms
- Whether drafting or negotiating the license is included or a separate phase
- Fee basis: hourly rates by person, a fixed fee per phase, or a cap, and how changes are approved
- Who the client is: your company only, not the buyer or any intermediary
Sources for this section
- The ABA Lawyer Referral Directory lists state and local bar lawyer referral programs, searchable by city and state. Source
- The IAPP's CIPP/US training covers U.S. federal and state privacy statutes, sectoral laws and enforcement, aligned with the CIPP/US certification exam. Source
- ABA Model Rule 1.7 comments say a lawyer asked to represent a seller in negotiations with a buyer the lawyer represents in another, unrelated matter could not do so without the informed consent of each client. Source
- ABA Model Rule 1.5(b) says the scope of the representation and the basis or rate of the fee and expenses shall be communicated to the client, preferably in writing, before or within a reasonable time after commencing the representation. Source
Frequently asked questions
Do I need a privacy specialist, or will our usual corporate lawyer do?
A corporate lawyer can handle the license agreement, but the privacy questions benefit from someone who regularly works with state privacy laws, GDPR where relevant and de-identification standards. Many companies have regular counsel coordinate and bring in a privacy specialist for the notice, request and preparation questions.
Should we send sample records to counsel?
Only if counsel asks, and then through a channel counsel approves. A small, representative sample can show what free text really contains, but it is still personal information. Communications with counsel for legal advice may be privileged, so let counsel decide how samples are requested, stored and discussed.
What if we cannot find old versions of our privacy policy?
Tell counsel which periods are missing rather than assuming the current text applied. Website revision history, archived emails announcing policy changes and public web archives often fill gaps. For periods that stay unknown, counsel may treat the records more cautiously or recommend excluding them from scope.
Does counsel need to see the buyer's draft contract?
Yes, once one exists. The privacy review and the license terms depend on each other: permitted use, onward transfer limits, reidentification bans, security requirements and deletion at the end of the term all shape residual risk. Share the draft early so counsel can propose terms rather than only react to them.
Can the same packet support a second licensing deal later?
Largely, if it is kept current. The inventory, notice history and contract review carry over, but each new buyer, scope or permitted use needs a fresh look, and requests or incidents since the first review must be added. Date every document so counsel can see what changed.
Sources
- On February 13, 2024, FTC staff published 'AI (and other) Companies: Quietly Changing Your Terms of Service Could Be Unfair or Deceptive', warning that a company that adopts more permissive data practices, such as using consumers' data for AI training, and tells consumers only through a surreptitious, retroactive change to its terms of service or privacy policy may be engaging in unfair or deceptive practices. Source
- Post-CPRA, Cal. Civ. Code 1798.140(m) treats information as deidentified only if the business takes reasonable measures to ensure it cannot be associated with a consumer or household, publicly commits to maintain and use it in deidentified form and not attempt to reidentify it, and contractually obligates any recipients to comply with these requirements. Source
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.