General counsel at a PE-backed company: reviewing a data license

What does a general counsel at a PE-backed company need to check before a data license?

A general counsel should confirm four things before the company signs anything: that the company owns or controls the rights in each record type, that customer and employee terms allow the use, that de-identification and redaction scope are agreed in writing, and that sponsor and lender consents are in hand. Nothing is binding until the company agrees price and terms and signs.

This page is a working checklist for the GC or deputy GC who receives a licensing proposal from the CEO, CFO or the sponsor's operating team. It is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

Why does the GC of a sponsor-backed company get this request?

A PE-backed legal team usually sits at the center of credit agreement compliance, board approvals, customer contract disputes and add-on diligence. A license of operational records touches every one of those files at once, so the proposal lands on the GC's desk even when the commercial idea came from finance.

The company licenses, not sells, its data. It keeps ownership, approves scope and price, and typically grants an exclusive right for AI training for an agreed term. It receives one all-in price with no separate charges, paid once, typically within about 60 days of invoicing once the buyer selects the data.

Which rights questions come first, record type by record type?

Work through the record types the company actually holds, not the whole archive at once.

What should the GC check in customer and employee contracts?

Start with the customer contract templates and the top accounts by revenue, then work down by exception.

• Confidentiality clauses: does the customer's information qualify, and does the clause survive termination?
• Data protection addenda: are there limits on secondary use or on onward transfer?
• Ownership language: who owns work product, tickets and configuration records?
• Consent mechanics: can consent be obtained, and is it practical for the accounts that matter?
• Employee policies: do handbooks and monitoring notices address email, chat and recordings?
• Contractor agreements: do assignment clauses cover the material?

If the data mostly belongs to customers, as at many agencies and outsourcers, the company needs their consent before any of it is in scope. If consent is not available, the right answer is to exclude that data or decline the license.

How are de-identification and redaction scope settled?

The partner never sees records. The company and SourceX agree redaction and de-identification requirements before any work begins, and data is delivered only after an executed agreement and the company's authorization. The GC should ask for the scope in writing: which fields are removed, which record types are excluded, how exceptions are handled and who signs off on a sample before delivery.

Records that are mainly consumer personal information, or mainly protected health information without proper authorization or de-identification, are red flags and generally do not qualify. Privacy and health-data rules vary by state and sector, so take advice specific to your records.

Which consents and approvals does a sponsor-backed company need?

The controller's guide to booking a one-time license covers the accounting side. For the lender conversation, see the outline for a refinancing lender presentation if a refinancing is live.

What does the exclusivity term do to the company?

An exclusive license for AI training for an agreed term means the company cannot license the same data for that use to someone else during the term. Ask what exactly is exclusive (use, dataset, field), when the term starts and ends, and what happens on a sale of the company or a change of control. If the owner will not consider exclusivity at all, the license is not a fit.

Defense and regulated suppliers add a layer of export-control and contract-flowdown questions; the aerospace and defense suppliers brief shows how those records are screened.

How do the COO, CIO and controller fit into the GC's review?

The GC rarely holds the exports. The COO guide covers who owns the workflows, the CIO guide covers exportability and retention, and the operating partner guide covers the sponsor's view. The data opportunity assessment guide helps the deal team frame the first conversation, and the network opportunity finder helps partners identify relationships.

How do partner rewards work if the GC's firm introduces a company?

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 cumulative per referred company. Rewards become payable only after the buyer pays and SourceX receives its fee, and no reward is guaranteed. The reward is a share of SourceX's fee and is never deducted from what the company receives. Lawyers should check their state's rules on referral fees and disclosure first; the program terms set the details.

When should the GC say no?

• The company has not reached 50+ full-time employees at peak (contractors excluded).
• Customers own the data and have not agreed.
• Records are mostly consumer data or health data without a basis.
• The data is already licensed for AI training.
• A court, trustee or assignee controls the assets and is not involved.

Next step

Take one proposal through this list with the CFO present. If the company passes, register as a partner to introduce it, or have the sponsor apply at sourcex.si/apply. The who qualifies page lists the baseline.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.