When are redaction rules agreed, and can we review a sample first?

What is the short answer on timing?

Redaction rules come first. SourceX and the company agree what must be removed, masked or excluded before any preparation work begins, and delivery happens only after an executed agreement and the company's authorization.

For an owner, the practical meaning is simple: you set the rules, you can see them applied, and you decide whether to proceed. Nothing is binding until the company agrees price and terms and signs.

What is the order of events?

The sequence below shows where redaction sits relative to the other steps. Partners are involved only in the first step and never handle records.

1. A partner introduces the company by referral form or referral link, with basic fit information only.
2. SourceX qualifies the company on size, history, data breadth and rights.
3. The company completes a data inventory: which systems exist, how far back they go and who can export from them.
4. Price and terms are agreed, including the redaction and de-identification requirements.
5. Buyers review what is on offer.
6. The deal closes, data is delivered and the company is paid.

The company can raise redaction rules as early as the first conversation with SourceX, and they must be agreed before any preparation work begins. The inventory in step 3 lists systems and categories, not the confidential content itself.

Can we review a sample first?

Yes, a company can ask for a reviewed sample to be built into the plan. The point of a sample is to test the rules on a small slice before anything larger is prepared, so mistakes show up when they are cheap to fix.

A sensible sample plan has these parts:

• A small slice of one system, chosen by the company rather than by the buyer.
• The written rules that were applied to it.
• A list of what the rules removed or masked, by category.
• A named reviewer on the company side who can approve or reject the result.
• A record of the decision, so the agreed rules can be updated if they were too loose or too strict.

Treat the sample as a proposal to raise during terms, not as a promise of a specific process. The signed agreement is what fixes the steps.

Who decides what gets redacted?

The company decides what it is willing to license, and the agreed requirements reflect that. Typical decision points are listed below.

If your records include health-related information, the federal HHS guidance on de-identification under HIPAA describes two recognized methods, Expert Determination and Safe Harbor. This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting. Records that are mainly protected health information, without proper authorization or de-identification, are a red flag for this program.

What happens if something is missed after delivery?

Agree the answer before signing. A good agreement says how a buyer must handle and report material that should not have been delivered, and how it is removed. The page on sensitive data slipping through after delivery covers the contract side, and the internal access controls guide covers the internal controls that reduce the chance in the first place, and the delivery manifest template shows how to record what was handed over.

How should a partner explain this to an owner?

Keep it factual: the owner sets the rules, a sample can be tested, and the owner signs only if the terms work. Do not promise any outcome on what a buyer will accept. For the internal conversation, see who to involve first and the stakeholder objection map.

Next step

If an owner you know keeps raising redaction as the reason to hesitate, send them this page and register as a partner to make the introduction. The contract review workflow data type page shows one kind of record where these rules matter a lot, and the FAQ covers the rest of the process.