How do you check a seller’s right to license business data?

Why does the right to license matter more than the price?

The legal risk stays with the data after the deal. A low price does not make it smaller.

Bricker Graydon Wyatt, a US law firm, tells acquirers to evaluate whether a company “has the legal right to collect, use, and store” its data, and whether any contractual restrictions apply. That advice is written for company acquisitions. The same test applies when you license a dataset.

Lawyers who spoke to Lexpert made the same point about valuation. One said a buyer needs to understand where the data came from, whether the company has the legal rights to use it, and whether the proposed uses align with what users originally consented to. Another said that when a company cannot clearly establish its rights to its data, the gap can materially affect valuation or even derail a transaction.

What did the business promise the people in the records?

Business records are full of people: customers, staff, suppliers. Each of them was told something about how their information would be used. That promise limits what the business can license, and so it limits what you can receive.

The Federal Trade Commission wrote about this in 2024. It said a business that collects user data under one set of privacy commitments cannot then drop those commitments on its own after it has the data. It also said it may be unfair or deceptive for a company to start using consumers’ data for AI training and to tell them only through a quiet, retroactive change to its terms.

So ask the seller for the privacy notice as it stood when the records were collected. Ask whether it has changed, and when. A notice that was rewritten last month to allow AI training does not cover records collected five years ago.

Which records does a business usually not own?

Access is not ownership. These are the common gaps:

• Client files. Agencies, accountants, law firms and consultants hold records that belong to their clients.
• Contracted limits. Many customer agreements allow use of the data only to deliver the service.
• Content from others. Reports, images, code and documents that came from a supplier under that supplier’s licence.
• Private staff messages. Direct messages and personnel channels that staff did not expect anyone to read.

A careful seller leaves these out and tells you so. A list of what was left out is a good sign, not a weakness.

What should the seller put in writing?

Ask for the provenance of the dataset as a document, not as a sentence in an email.

There is a standard you can borrow. The Data & Trusted AI Alliance, a group of large companies, publishes cross-industry data provenance standards. It says they consist of 22 metadata fields, grouped into 3 standards: source, provenance and use. The fields include the data origin geography, the range of dates for data generation, the consent documentation location, the licence to use, and the intended data use. The alliance says IBM tested the standards in early 2024 in its clearance process for training datasets, and saw gains in clearance time and in data quality.

Slaughter and May described the first draft of those standards as a uniform way to label a dataset, so a business can decide whether to acquire it and whether it suits the intended purpose.

You do not need the full standard for a mid-sized deal. You need its questions answered.

What does a marketplace check, and what stays your job?

On Korra, every seller confirms a company email on the company’s own domain, signs the seller terms, and states its right to license in its own words on every listing. We read each listing before it is shown. The buyer page lists each check.

That is a check on the seller and the listing. It is not legal clearance of the data, and we do not open the records. The warranty in your licence, the questions you ask, the sample you test and your own counsel’s read stay with you.

If you want to see how the questions, the sample and the offer fit together, read how buying works or the buyer agreement.