What is a customer data ownership clause, and can it block a data license?

The short answer

A customer data ownership clause states who owns information that a client supplies, or that a vendor generates while serving the client, and what the vendor may do with it. Whether a services company can license records involving client work depends on how that clause reads together with the confidentiality, use-rights and deletion terms in the same contract, and on any privacy promises made to the people in the data.

That is why client contracts are one of the first checks before an introduction, not the last. A company that owns its operating records outright is in a very different position from one whose most valuable records are its clients' material.

What the clauses usually say

Wording varies, but most master services agreements and SaaS terms contain some version of these provisions. The patterns below are typical, not quotations from any real contract.

What the law adds to the contract

Three sets of rules sit alongside the contract wording.

Copyright ownership. The Copyright Office explains that work an employee prepares within the scope of employment is a work made for hire owned by the employer, while commissioned work from an outside contractor counts as work made for hire only in listed categories and with a signed written agreement (Circular 30). Internal documents written by a company's staff are therefore generally its own, while an agency's client deliverables usually turn on the assignment clause, and contractor-written material may need a written assignment.

Privacy and AI-training promises. FTC staff wrote in January 2024 that promises not to use customer data for undisclosed purposes, such as training or updating models, are enforceable wherever they appear, including privacy policies, terms of service and marketing materials (FTC staff post, January 2024). A February 2024 staff post added that quietly adopting more permissive practices, such as using data for AI training, through a surreptitious, retroactive change to terms could be unfair or deceptive (FTC staff post, February 2024). Both are staff guidance, not rules.

Service-provider limits under state privacy law. Under the California Consumer Privacy Act, a business that discloses personal information to a service provider or contractor must have a written agreement limiting its use to specified purposes. A vendor acting as a service provider should expect its client contracts to carry that kind of limit. Other states have their own privacy laws, so check where your clients and their customers are.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

How the clauses apply in common situations

How to separate your records from your clients'

1. Collect each version of your standard contract template, plus the signed agreements with your largest clients.
2. Build a grid of the ownership, confidentiality, use-rights, deletion and AI clauses in each one.
3. Sort every business system into three groups: your own records, mixed records and client-owned records.
4. Decide with counsel which mixed records can be included after redaction, which need client consent and which stay out.
5. Record the result in the data inventory, so scope, de-identification and redaction rules are agreed before any work begins.

The guide on telling company data apart from customer-owned data walks through the sorting step in more detail, and the comparison of data owners, custodians and stewards explains who can authorize a license.

Disclosure and consent good practice

• Ask clients for written consent rather than relying on a broad reading of an aggregated-data clause.
• Change contract templates going forward with clear notice, never through a quiet retroactive edit.
• Keep client names and record contents out of any introduction. A referral partner shares only basic fit information and never exports, uploads or describes confidential records.
• Treat de-identification as a privacy safeguard, not as permission. Permission comes from the contract and from consent.

Questions to ask your counsel

• Which of our contract versions give clients ownership of data we generate while serving them?
• Does our confidentiality clause bar reuse even of de-identified or aggregated records?
• Do any agreements expressly prohibit AI or machine-learning training?
• What did our privacy policy and terms say when the data was collected?
• Which contractor-created materials were assigned to us in writing?

Next step

Once rights are mapped, check the rest of the fit: a US company with 50+ full-time employees at peak (contractors excluded), several years of documented operations and an authorized sponsor, as set out on who qualifies. The company fit checker gives a preliminary read, and owners can apply at sourcex.si/apply. Advisors can register as a partner to introduce a client whose records are clearly its own; the explainer on what a data asset is covers the wider picture.