What does "scrubbed by an independent third party" mean?
It means someone other than the buyer, and ideally other than the seller, removes or masks personal identifiers from the records before the buyer ever receives them. The phrase describes who does the cleaning and when. It does not describe how well the cleaning works.
That distinction is the whole issue. A buyer's statement that data will be "scrubbed of personal information by a third party before receipt" is a promise about process. An owner should turn it into a contract term, a named party and a test they can inspect.
What does independent de-identification actually involve?
In practice it is a pipeline with several stages, and each stage can be done well or badly.
- Scope the records. The company decides which systems, date ranges and units are in scope, and which are excluded entirely.
- Define the identifiers. Names, email addresses, phone numbers, account numbers, ID numbers and similar fields are listed, along with indirect identifiers such as job titles, project names, client names and locations.
- Detect. Automated tools flag identifiers in structured fields and in free text such as email bodies, chat messages and ticket notes. Free text is the hard part, because people write names and details in unpredictable ways.
- Replace or remove. Each hit is deleted, masked or swapped for a consistent placeholder, so a workflow still reads as a workflow.
- Sample and test. Reviewers pull random samples, try to find leftover identifiers, and record the miss rate and what was done about it.
- Certify and hand over. The cleaned set is released with a written description of what was done, by whom and against which rules.
The independent part matters at steps 5 and 6. A party with no stake in a fast delivery is more likely to report an honest miss rate.
What can scrubbing not promise?
Scrubbing lowers risk. It does not remove it, and no honest vendor should say otherwise.
| Claim you might hear | What is actually true | What to ask for |
|---|---|---|
| "All personal information is removed" | Detection in free text is imperfect, so some identifiers can survive | A stated sample size, a measured miss rate and a remediation step |
| "The data is anonymous" | Combinations of role, project and timing can still point to a person | A contractual ban on re-identification attempts |
| "A third party handles it" | The third party may work to the buyer's rules, not yours | Written rules the company approved before work began |
| "It is compliant" | Compliance depends on the law that applies to the records, which varies by data type and state | Counsel's review of the applicable rules |
Public criticism of recent data sales has focused on exactly this gap: opponents argue that cleaned records can sometimes be linked back to individuals. Owners should treat that argument as a reason to ask harder questions, not as a reason to dismiss the process. The companion page on re-identification risk in small teams covers the linkage problem in detail.
Is there a standard an owner can borrow?
For health information, yes. The US Department of Health and Human Services describes two recognized HIPAA de-identification methods: Expert Determination, where a qualified expert documents that the risk of re-identification is very small, and Safe Harbor, which removes 18 specified identifiers and requires no actual knowledge that what remains could identify someone.
Most business records are not health records, so HIPAA does not govern them. But the structure is a useful template: a named qualified party, a documented method and a written result. An owner can ask for the same three things on any dataset. This is general information, not legal, tax or financial advice. Confirm with your own counsel before relying on any standard for your records.
How can an owner verify the scrubbing?
Use this checklist before agreeing to anything.
- The company, not the buyer, approves the identifier list and redaction rules in writing before work begins.
- The party doing the scrubbing is named in the agreement, with its role and what it may see.
- The agreement says whether the scrubbing happens on the company's side, in a controlled environment or after transfer.
- A sample review is run on records the company chooses, and the company sees the results.
- Known problem units, such as small teams, executive mailboxes and HR channels, are excluded rather than scrubbed.
- The buyer commits in the contract not to attempt re-identification and not to pass the data on.
- Delivery waits until the company gives final authorization.
At SourceX, de-identification and redaction requirements are agreed with the company before any work begins, and data is delivered only after an executed agreement and the company's authorization. Ask in writing who performs each step, because that detail belongs in your deal terms.
What does this mean for referral partners?
Partners never handle records, so a partner's job here is to be honest and brief. If an owner raises the phrase, explain that scrubbing is a process with named steps, that the company approves the rules, and that nothing moves without a signed agreement. The guide to answering an owner worried by AI data headlines has wording for that conversation, and sponsors weighing reputational exposure can read portfolio data licensing and reputational risk. Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. The reward is paid only after the buyer pays and SourceX receives its fee; an introduction, meeting or signed agreement alone does not trigger payment, and no reward is guaranteed. The referral earnings calculator shows how the formula works.
When is scrubbing not enough?
Some records should not be licensed at all, however well they are cleaned.
- Mainly consumer personal data with no licensing basis.
- Mainly protected health information without HIPAA authorization or de-identification.
- Data that belongs to clients who have not consented.
- Small, long-tenured units where context identifies people even after names are gone.
If that describes the records, wait. The page on whether to wait before licensing and the one on what a license says about a company help owners weigh timing and optics.
Next step
If you know a US company with 50+ full-time employees at peak (contractors excluded) and years of records, register as a partner and make the introduction. Owners can also apply directly at sourcex.si/apply. Questions about the program are answered in the FAQ.