Portfolio data licensing and reputational risk: a sponsor's guide to doing it cleanly

Where does reputational risk in portfolio data licensing come from?

It comes from a short list of record types and behaviors, not from licensing as such. When a data deal goes wrong in public, the story is almost always that someone's personal or confidential information was used without their knowledge. Take those out, and what remains is a company licensing records of its own work under a contract it chose to sign.

Silent use is the one sponsors underestimate. FTC staff have cautioned that adopting more permissive data practices, such as using consumer data for AI training, and disclosing them only through a quiet, retroactive change to terms of service or a privacy policy may be unfair or deceptive. That is staff guidance rather than a rule, but it is how the story gets told when it breaks.

For health data, HHS guidance on de-identification describes the two HIPAA methods, Expert Determination and Safe Harbor; information de-identified under either is no longer protected health information under the Privacy Rule. A portfolio company whose records are mainly PHI, without authorization or de-identification, is a pass. This is general information, not legal, tax or financial advice.

Why operating partners should own the risk question

Operating partners already sit where the upside and the exposure meet: across the portfolio, inside value creation plans and in front of LPs at the annual meeting. McKinsey's Global Private Markets Report 2026 found that 53 percent of 300 surveyed LPs ranked a GP's value-creation strategy among their top five selection metrics, and that firms have more than doubled their operating groups since 2021. A new lever will be scrutinized, so it has to be clean.

You also see patterns a single CEO cannot. If three portfolio companies run similar ticketing, CRM and engineering stacks, one screen and one set of controls can cover all three. The operating partner referral overview covers the opportunity; this page is about keeping it defensible.

The clean-source screen

Run it before licensing comes up with a CEO. Every box should be ticked; one clear no means park the company.

• The records were created by the company's own people in the course of its own business.
• Little of the value sits in client-owned files, such as an agency's creative work or an outsourcer's client tickets, unless those clients have agreed.
• Consumer personal data is absent or can be excluded without hollowing out the dataset.
• Protected health information is absent, de-identified or covered by authorization.
• Archives still exist and someone at the company can export them.
• The same data has not already been licensed for AI training.
• The company had 50+ full-time employees at peak (contractors excluded) and several years of documented operations.
• No records were generated with AI to pad the dataset.
• The owner, CEO or CFO would consider an exclusive AI-training license for an agreed term and has authority to sign it.
• No court, trustee or assignee controls the assets without being involved.

The guide to assessing portfolio company data opportunities covers the value side of the same review.

Which portfolio companies carry the least exposure?

Exposure tracks the share of personal and third-party information in the records, not the industry label.

When to raise it, and with whom

Raise it when governance is already looking at data, so the decision gets a proper owner from the start.

Exit timing brings its own objections; the M&A advisor's guide to seller objections covers buyer perception and exclusivity.

How one sponsor relationship can cover several companies

Each company is introduced and assessed on its own, but you register once.

1. Register as a partner and list the companies that passed the clean-source screen.
2. Introduce each CEO or CFO through the referral form, or send your referral link so the company can apply with your credit attached.
3. SourceX checks headcount, operating history, the spread of systems and the company's rights.
4. The company lists its systems and records in a data inventory; scope, exclusions and de-identification are settled before any work starts.
5. SourceX agrees one all-in price and terms with the company, and only then do AI labs and data buyers review the opportunity.
6. The company signs, prepares the agreed records and authorizes delivery; it is paid once, typically within about 60 days of invoicing after a buyer selects the data.

At no point does the sponsor's team handle, copy or describe the records.

What to say to a CEO who worries about headlines

How rewards work, and what to clear first

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. Payment comes only after the buyer pays and SourceX receives its fee, and no reward is guaranteed. The reward is a share of SourceX's fee and is never deducted from what the portfolio company receives.

Before registering, check your fund documents and firm policy on fees received in connection with portfolio companies, and decide how you will disclose the reward to each company's board. The four-part disclosure test for referral fees on client deals helps here, and whether you are liable if a client's data deal goes wrong covers the introducer's exposure. The referral earnings calculator shows how the published formula works.

When to leave a company off the list

• Most of the useful records belong to the company's clients.
• The business is built on consumer data or health records.
• Management is mid-crisis and cannot own a decision of this kind.
• A sale process is live and the deal team has not agreed.
• The CEO would only consider a non-exclusive arrangement.

Next step

Run the clean-source screen across the portfolio this quarter. For companies that pass, register as a partner and introduce the CEO, or send the referral link so the company can apply directly at sourcex.si/apply.