Data license agreement vs data sharing agreement vs DPA: what each contract does

The short answer: three contracts, three jobs

A data license agreement grants rights. A data sharing agreement sets the rules of an exchange. A data processing agreement (DPA) gives a vendor instructions. If an AI developer will use your company's records to train or evaluate its own models, you are granting rights for its purposes, so the paper you need is a license agreement, not a DPA.

The confusion is understandable. All three documents describe data, all three carry confidentiality and security language, and most companies already hold a stack of DPAs from their software vendors. But they answer different questions: who may use the data, for whose purpose, for how long, and who gets paid.

Owners who keep the three apart negotiate better. They know which clauses set the economics (the grant, field of use, exclusivity and price) and which are hygiene that appears in almost every data contract (security, deletion, breach notice).

How do the three agreements compare side by side?

The fastest way to tell them apart is to ask whose purpose the data serves once it leaves your systems.

The license column rests on a simple idea: ownership and permission can be separated. Under the Copyright Act, ownership of a work can be transferred in whole or in part, and any exclusive right can be transferred and owned separately, so a company can license specific rights in content it owns while keeping the rest (17 U.S.C. 201).

When is a data license agreement the right contract?

Use a license when the other side needs its own, independent right to use your records and is paying for that right. An AI training deal fits exactly: the developer uses the records to build or test its models, for its own commercial purpose, within limits you set.

Signs you are in license territory:

• The recipient will use the data for its own product, model or research, not for a service it performs for you.
• A price is being negotiated for rights, not for a service.
• Field of use matters, for example training and evaluation only, with no resale.
• Exclusivity is on the table for a defined term.
• The recipient asks you to warrant that you have the right to grant what you are granting.

Licensing through SourceX works this way. The records are licensed, not sold; deals are typically exclusive for AI training for an agreed term; and the company receives one all-in price as a one-time payment. What a full agreement contains is covered in what is in a data license agreement, and the risk clauses get their own treatment in indemnification in AI training data licenses.

When is a data sharing agreement the better fit?

Choose a data sharing agreement when two or more parties exchange data toward a joint or parallel goal and nobody is buying rights. Typical cases: a manufacturer and its distributors pooling demand data, a company giving a university lab records for a study, member firms feeding an industry benchmark, or affiliates moving records inside a group.

These agreements focus on purpose limits, reciprocity, who may publish results and how each party protects what it receives. Where both sides decide their own purposes, privacy practitioners sometimes describe the arrangement as controller to controller; the right label depends on which law applies.

A sharing agreement is a poor container for a commercial training deal. It rarely contains a clean rights grant, a field-of-use definition, exclusivity or a price, which are the clauses that matter most when a developer is paying for your records.

What does a DPA do, and why is it the wrong paper for a training deal?

A DPA governs a vendor that handles personal data on your instructions and for your purposes. Your CRM provider, helpdesk platform and payroll processor typically sit under one. The vendor gains no right to use the data for its own ends.

Privacy laws push companies to paper these relationships. California's consumer privacy law, for example, requires a business that sells or shares personal information, or discloses it to a service provider or contractor, to have a written agreement limiting use to specified purposes (California Civil Code 1798.100 et seq.). Records that include people in the EU raise further questions, because the GDPR can apply to organizations outside the EU that offer goods or services to, or monitor the behavior of, people there (Regulation (EU) 2016/679).

A training developer is not your vendor. It wants to use the records for itself, so a DPA alone would not give it the rights it needs, and dressing a training deal in DPA language would misdescribe the relationship. Privacy terms do not disappear, though: a training license usually carries its own data-protection schedule covering de-identification, redaction, security and deletion. In SourceX deals, de-identification and redaction requirements are agreed with the company before any work begins.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

The 3P test: which agreement are you holding?

When a draft lands on your desk, run three questions in order.

1. Purpose: whose purpose does the data serve after it leaves your systems? Yours alone points to a DPA; the recipient's own points to a license; a shared project points to a sharing agreement.
2. Payment: is money paid for rights in the data? If the recipient pays you, it is a license. If you pay the recipient, it is a service with a DPA attached. If nobody pays, it is usually a sharing agreement.
3. Permanence: what can the recipient keep or build after the term? A license addresses models and copies; a DPA requires return or deletion; a sharing agreement sets publication and retention rules.

If the answers point in different directions, the document is probably a hybrid, which is common. Ask counsel which clauses control.

Illustrative: one company, three contracts

Illustrative and fictional. Larchmont Freight Software, a 140-person logistics software firm, signs all three agreement types in the same year.

• A DPA with its helpdesk platform, which stores customer tickets and may only process them to run the service.
• A data sharing agreement with a university transport lab, which receives anonymized shipment-delay data for a research paper; nobody pays and both sides may publish aggregate findings.
• A data license agreement with an AI developer, through SourceX, covering eight years of de-identified support tickets, runbooks and engineering change records for model training and evaluation, exclusive for AI training for an agreed term, in return for a one-time payment.

Only the third agreement brings in revenue, and only the third needs a hard look at the rights grant, exclusivity, warranties and indemnities. The helpdesk contract still matters: its terms shape how Larchmont exports the tickets it wants to license.

Where SourceX fits

SourceX manages data licensing for US companies that hold proprietary records, from sourcing and rights review to delivery and payment. For an owner, the license agreement is the document that counts, and it binds no one until the company agrees the price and terms and signs; see when a data licensing deal becomes binding.

The usual sequence:

1. The company applies directly or through a referral partner's introduction.
2. SourceX checks fit: 50+ full-time employees at peak (contractors excluded), several years of documented operations, breadth of records, rights and an authorized sponsor.
3. The company lists its systems and record types in a data inventory; the data inventory builder helps draft that list using metadata only.
4. Price and terms are agreed with the company, buyers review, and the agreement is signed before anything is delivered.

Your vendor DPAs and any SOC 2 commitments still need checking; does licensing data conflict with SOC 2 commitments covers that overlap, and the full sequence is on how it works.

Next step

If you advise owners and one of them is weighing a training license, register as a partner and make the introduction: you introduce, and SourceX and the company handle the rest. Owners can also apply directly at sourcex.si/apply.