Buy-side due diligence: how to identify and document a target's data assets

Why transaction advisors should record data assets in diligence

Buy-side diligence already touches every fact needed to judge a target's data assets. The IT workstream lists systems, legal reads customer contracts and privacy notices, and the quality of earnings team sees how far the ledger goes back and who runs finance. Pulling those facts into one short note adds little to the workload and gives the sponsor a post-close option it would otherwise have to rebuild from scratch.

That option carries more weight than it used to. McKinsey's Global Private Markets Report 2026 says multiple expansion and cheap leverage, which accounted for 59 percent of private equity returns between 2010 and 2022, have faded, so operational value creation is now likely the primary source of returns. Licensing years of operational records to AI developers is one operational lever a sponsor can weigh in the first year of ownership.

The note is not a valuation. Nobody can price a data license during diligence. The job is to record what exists, whether it can be exported and whether the target is free to license it.

Which targets carry data assets worth recording

Industry matters less than how the work is recorded. Look for these signals in the data room.

B2B software, IT services, professional services, engineering, logistics and distribution targets tend to hold the deepest records. Carve-outs need extra care, because the records may stay with the parent and reach the target only through a transition services agreement.

The SHER note: four lines for the diligence report

Add a half-page section to the IT or legal diligence report built on four headings. If any line comes back empty, say so plainly; a gap is a finding too.

• Systems: each business system with its function, year adopted and administrator, including retired systems still accessible.
• History: how far back the main systems go, and whether past migrations kept or dropped older records.
• Export: who can run complete exports, and whether vendor contracts, retention settings or backups limit them.
• Rights: whether the target created the records, what customer contracts and privacy notices say about data use, and whether any data was previously licensed or shared.

The requests that feed the note are metadata only, and most already sit on a standard request list:

• IT systems inventory with adoption dates and administrators.
• Data retention and deletion policies; the data retention policy template shows what a complete one covers.
• Standard customer terms, plus confidentiality and data-use clauses from the largest customer contracts.
• Every version of the privacy notice in force during the period the records cover.
• Employee IP assignment terms and contractor agreements.
• Any data sharing, licensing or reseller agreements.
• Planned migrations, downgrades or system shutdowns.

Two legal points deserve a line in the rights section. Under the Copyright Act, any exclusive right may be transferred and owned separately (17 U.S.C. 201), so an earlier exclusive grant can limit what the target may license later; ask for every agreement that grants rights in data or content. And if the target has customers, users or staff in the EU, records holding their personal data raise questions under the GDPR, which can apply to organizations outside the EU that offer goods or services to, or monitor the behavior of, people in the EU.

This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

When to raise it in the deal calendar

Once the sponsor owns the company, the operating partner can run the same screen as a first-year initiative. The note does not change the accounting either; whether data can be recorded on the balance sheet is a separate question, covered in can company data be recorded as an asset.

How the introduction works after close

You make the introduction; you never handle the data.

1. Confirm your client's permission. Diligence findings belong to your engagement, and your engagement letter and NDA govern what you may share; the confidentiality limits under a client NDA follow the same principles.
2. After closing, the sponsor and company leadership decide whether to explore a license.
3. You register as a partner and share your referral link with the company's authorized sponsor (owner, CEO, CFO or authorized representative), or submit the company through the referral form.
4. SourceX qualifies the company on size, history, data breadth and rights.
5. The company completes a data inventory, then agrees one all-in price and the licensing terms; the portfolio CFO can work through a finance-side agreement checklist at this stage.
6. AI labs and data buyers review the opportunity; once a company is deal-ready, buyers typically respond within about two weeks.
7. The agreement is signed, the data is prepared under the agreed redaction rules and delivered with the company's authorization, and the company is paid.

What to put in front of the deal partner

Keep the note factual and short. Illustrative wording, for a fictional target:

If a red flag appears, lead with it. A deal partner will trust the note more if it says plainly why a target does not qualify.

How partner rewards work for transaction advisors

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company, and the reward becomes payable only after the buyer pays and SourceX receives its fee. It comes out of SourceX's fee, so the company's proceeds are untouched. Attribution follows the first valid referrer whose introduction produces a verified company application inside the attribution window.

Two checks come first. If your firm audits the target or the acquirer, independence rules may restrict outside compensation. And your engagement terms with the buyer may limit how you use diligence knowledge. Clear both with your firm's risk partner before registering.

When not to bother

Skip the note, or keep it to one line, when any of these apply:

• The target has fewer than 50 full-time employees at peak, contractors excluded.
• The most valuable records belong to the target's own clients, as at many agencies and outsourcers, without their consent.
• The data is mostly consumer personal data or protected health information.
• Old systems were wiped, or no one has the access or skills to export them.
• Someone already holds an AI-training license to the same records.
• In a carve-out, the records stay with the seller and no agreement gives the target access.

Next step

Add the SHER note to your next diligence scope. After close, if the target passes the company fit checker and the who qualifies baseline, register as a partner and introduce it with your client's agreement.