How to evaluate an unsolicited offer to buy your company's data

What should you do first when someone offers to buy your company's data?

Pause, say nothing binding, and do not send any records. An unsolicited offer is a request for information about an asset you may not have valued, and the right first move is to slow it down. You decide the pace, not the bidder.

This guide is for owners, and for the advisors who sit beside them: M&A advisors, fractional CFOs, outside counsel and operating partners. It walks through a response sequence, a red-flag checklist and a comparison with a managed licensing process. Companies keep ownership; data is licensed, not sold, and nothing is binding until the company agrees price and terms and signs.

Before you reply: prerequisites

Gather these in a shared folder that holds no confidential records, only descriptions:

• The inbound message, sender, company and how they found you, saved as received.
• A named internal owner for the response, usually the CEO, CFO or general counsel.
• A list of your systems (email, Slack or Teams, CRM, finance, support, engineering, operations) with years of history, at metadata level only.
• Your customer contracts, employee handbook and privacy notices, so someone can check what you have promised.
• Any pending sale, financing or lender covenant that might restrict a license.

If a sale process is live, tell the deal team before you answer. An undisclosed side conversation can cause problems later. The page on licensing data after signing an LOI is relevant here.

Seven steps to evaluate the offer

1. Acknowledge, do not commit. Reply that you received it and will respond after an internal review. Do not confirm what systems you have or how much data exists.
2. Ask who is buying and why. Request the legal name of the buyer, what the data will be used for and whether the buyer is acting for itself or for another party. A vague purpose is a reason to stop.
3. Build a metadata-only inventory. List each system, its years of history and whether anyone can still export it. The data inventory builder helps with this, and the inventory should never include contents.
4. Run the rights check. Who created the records? What do customer contracts, NDAs, employee notices and privacy policies allow? Records that belong to your clients, or that contain mainly consumer or health information, are different from your own operating records. The FTC's staff guidance on keeping privacy and confidentiality commitments is a useful reminder that promises made to customers can be enforceable. This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.
5. Define scope on paper. Which systems, which date ranges, what is excluded, what redaction applies. Insist that no raw, unredacted export is handed over before a signed agreement.
6. Ask for the terms in writing. Price structure, term, exclusivity, permitted uses, deletion, audit and who bears legal risk. Compare against the points in how to negotiate an AI data licensing deal.
7. Decide whether to run a process. If the interest is genuine, a managed process lets AI labs and data buyers review the same opportunity, so you are not negotiating against a single bidder's first number. Nothing guarantees a better outcome.

Red flags in an unsolicited offer

Score the offer with this checklist. Any one of the first four is usually enough to decline.

• The buyer asks you to transfer ownership of the data rather than license it.
• The purpose of use is unstated or described only as "research."
• They want a raw, unredacted sample before any written agreement.
• There is no written agreement, or the buyer insists on its paper without negotiation.
• A short deadline is used as pressure ("this offer expires Friday").
• The buyer will not name the end customer or the model developer.
• Payment is vague, contingent on future results or paid in equity or credits.
• The buyer contacts employees directly instead of the sponsor.
• The scope includes client-owned records, health records or consumer personal data without a basis to license them.

Common mistakes

How does an inbound offer compare with a managed process?

A managed process does not guarantee a deal, and nothing is binding until the company signs. The comparison above is about structure, not outcomes. The CFO view in how a fractional CFO evaluates a data licensing proposal and the explainer on how to keep ownership of your data when licensing are good companions.

Illustrative example

Illustrative: A 140-person logistics software firm, fictional, receives a LinkedIn message from a startup asking to "acquire" five years of support tickets and Slack history, with a call requested within three days and a sample requested first. The CFO replies that she will respond after review, runs the seven steps, and finds the request asks for ownership transfer and an unredacted sample. She declines the bilateral route. The owner then asks an advisor about a managed licensing process, where scope and redaction are set first.

How a referral partner fits

Advisors often hear about these offers first. If you are an M&A advisor, CFO or board member and the company looks like a fit, you can introduce it to SourceX instead of leaving it with a single bidder. Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company, payable only after the buyer pays and SourceX receives its fee. No reward is guaranteed. Check your own professional rules on referral fees and disclosure first, and read the program terms.

For the broader pros and cons, see the pros and cons of licensing company data to AI developers. The explainer on what data valuation means helps when the owner asks what the offer should be compared against, and how it works shows the full process.

Next step

If the company holds years of records across many systems and the owner is open to an exclusive license, register as a partner and introduce it, or have the sponsor apply at sourcex.si/apply.