What if something sensitive slips through after a data delivery?
If sensitive data reaches a buyer by mistake, the company freezes further delivery, notifies the buyer in writing under the agreement, requests isolation and certified deletion of the affected items, traces them through the delivery manifest, and asks counsel about notification duties. Agreeing that plan before signing makes a mistake manageable.
What happens if something sensitive slips through after delivery?
If a record that should have been excluded reaches the buyer, the company treats it as an incident: it notifies the buyer under the notice terms in the agreement, asks for the affected items to be isolated and deleted with written confirmation, documents what happened against the delivery manifest, and asks counsel whether any notification duty applies. A mistake is recoverable when the contract and the paper trail already exist.
This page is for owners who want to know the plan before they sign, not after. The point of agreeing the plan early is that nobody has to improvise on the day a mistake is found.
What is actually true about over-sharing in a data license
Three facts shape the answer.
- Redaction and de-identification requirements are agreed with the company before any work begins, and data is delivered only after an executed agreement and the company's authorization. Slips are a failure of that filter, not the normal path.
- The company keeps ownership of its data. It licenses a defined scope, so anything outside the scope is, by definition, not licensed and can be pulled back by contract.
- Some data license agreements include return-or-destroy and certification language. Whether yours does, and how fast the buyer must act, depends on the terms you negotiate, so read that clause before you sign.
SourceX handles the process between the company and AI labs and data buyers, from rights review to delivery and payment. Partners who introduced the company never touch the records and are not part of an incident response.
The incident plan: seven steps
- Freeze further delivery. Stop any remaining transfers of the affected batch until the cause is understood.
- Identify the items. Use the delivery manifest to find the exact files, date ranges and source systems involved. The delivery manifest template shows the fields worth recording at handover.
- Notify under the agreement. Send written notice to the buyer's named contact within the window the agreement sets. If the agreement is silent, notify promptly and in writing anyway.
- Request isolation and deletion. Ask the buyer to quarantine the affected items, stop using them, delete them from every copy and environment, and confirm in writing.
- Get a certificate. Ask for a signed statement listing what was deleted, when and by whom, matched to your manifest line items.
- Assess duties with counsel. Whether a customer, employee or regulator must be told depends on what the items contain and where the people are. Rules vary by state and by data type, so this is a question for your own counsel.
- Fix the filter. Add the missed pattern to the redaction rules, rerun the check on the remaining batches and record the change.
This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting on a real incident.
Who does what when a slip is found
| Step | Company | Buyer | SourceX |
|---|---|---|---|
| Spot the problem | Reports it internally and to its counsel | May find it during review and flag it | Raise it with your SourceX contact so the licensing process can be adjusted |
| Written notice | Sends notice under the agreement | Receives and acknowledges | Point of contact for the licensing process |
| Quarantine and delete | Requests it in writing | Isolates, deletes, certifies | Ask your contact what the agreement provides |
| Legal assessment | Decides with counsel | Decides with its own counsel | Does not give legal advice to either side |
| Prevention | Approves updated rules | Applies the updated exclusions | Agree updated exclusions before the next batch |
Questions to settle before you sign
- Does the agreement name a notice contact and a notice window for both sides?
- Is there a return-or-destroy clause that covers copies, backups and derived working files?
- Will the buyer certify deletion in writing?
- Is the manifest detailed enough to isolate one batch without recalling everything?
- Who at the company can authorize an emergency hold on a delivery?
- Which categories are excluded outright (for example privileged material, health information, credentials)?
A useful companion is the guide to internal access controls while preparing records, because most slips start with who could reach the export folder.
What to say to a customer or board member who asks
If a customer asks the broader question about whether their information was licensed, the customer response guide covers that conversation.
When the concern is valid
If your records are poorly indexed, nobody owns the export, or you cannot say which systems hold personal or privileged material, a slip is more likely. Fix that first. Contract terms can also shift when laws change, which is covered in what happens if AI law changes after you license.
Next step
Read your draft agreement's notice, deletion and certification clauses with counsel before you agree terms. Owners can check fit at sourcex.si/apply, and advisers who know an owner worried about this can register as a partner and make the introduction. Common questions are answered in the program FAQ.
- Step 1Share your linkSend your personal link to a company you know.
- Step 2Company appliesThe company applies itself at /apply.
- Step 3Buyer selects and paysThe buyer selects and pays for the data and SourceX receives its fee.
- Step 4You get your rewardYour share of SourceX fees becomes payable.
Common questions
Does the buyer have to delete data that was delivered by mistake?
Only if the agreement says so, which is why return-or-destroy and certification clauses matter. Some data license agreements include them, but the wording, timing and scope of copies covered vary. Ask counsel to confirm that the clause reaches backups and derived working files, and that the buyer must certify deletion in writing.
Who should be told first when a mistake is found?
Tell your own counsel and the internal owner of the project at once, then give the buyer written notice under the agreement's notice terms. Whether customers, employees or regulators must be told depends on what the items contain and where those people are located, so counsel should make that call.
How does the delivery manifest help after an incident?
A manifest records what was delivered, from which systems, for which date ranges and in which batch. That lets the company point the buyer to exact items to isolate and delete, rather than asking to recall everything, and it gives counsel a clean record of what was exposed.
Can a partner who introduced us help with the clean-up?
No. Partners make the introduction and give basic fit information only; they never export, upload or handle confidential records. Incident response sits between the company, its counsel and the buyer, with SourceX coordinating the licensing process.
Does a slip-up cancel the license or the payment?
Not automatically. The effect depends on the agreement. A well-drafted contract separates a cure process, covering notice, deletion and certification, from termination rights. Ask counsel to check how your draft treats out-of-scope data before you sign.
Related pages
Free resources
- MOIC calculator — Multiple on invested capital from realized and unrealized value.
- PDF bank statement to CSV converter — Turn Chase, Bank of America or Wells Fargo PDF statements into CSV, privately in your browser.
- Client data licensing eligibility checker — A transparent preliminary screen for one company.
- All free tools · MCP resource center
By SourceX Partnerships Team · Published 2026-10-09 · Updated 2026-10-09
Know a US company with valuable proprietary data?
Become a referral partner from anywhere we support, get your link and introduce an owner or authorized decision-maker.
Refer a company →I own a business
Explore licensing your company's data to AI developers worldwide. Start a short assessment; no uploads needed.
Start an assessment