Data processing agreement checklist: do your customer contracts restrict licensing records?

Do your customer contracts and DPAs allow licensing records?

Maybe, and the answer sits in the contracts, not in the data. A data processing agreement (DPA) is the contract in which a business that handles personal data on a customer's behalf agrees to use it only for the customer's instructions. If a record set contains customer data covered by a DPA or a purpose-limited customer contract, the owner should have counsel read those documents before that data goes anywhere near a licensing scope.

This page is a review checklist for business owners, general counsel and the CFOs who usually hold the contract folder. It does not interpret any specific contract. Partners who introduce companies never review, collect or describe customer records; the review below is the company's own job, done with its own counsel.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

What is a DPA and why does it matter to a licensing decision?

A DPA, also called a data processing addendum, is usually an attachment to a master services agreement. It names who decides why personal data is processed, who only processes it on instruction, what the processor may do with it, and what happens when the relationship ends.

It matters here because a licensing scope can sweep in tickets, emails, call logs or CRM notes that contain a customer's data. If the company holds that data as a processor, it generally has no freedom to reuse it for its own purposes. The official text of the General Data Protection Regulation shows where the controller and processor roles are defined, and it can reach organizations outside the EU that serve or monitor people in the EU. A US company with European customers should assume the question is live.

Two related points from US regulators are worth knowing. FTC staff have written that a company's promises not to use customer data for undisclosed purposes, including model training, are enforceable whether they appear in privacy policies, terms or promotional materials. That is staff guidance, not a rule, but it tells owners that contract language about data use is taken at face value.

Which clauses should you read first?

Start with the clauses that restrict what the company may do with data it did not create. The table lists the usual places a restriction hides.

Do not assume a de-identified carve-out settles the question. Whether a clause that permits aggregated use reaches licensing to an AI developer is a point for counsel to read in context.

How should you triage the contract folder?

Use the three-bucket sort. It keeps the review proportional, because most of a company's records are usually its own.

1. Bucket A, company-created records. Internal documents, finance, engineering, operations and process records the company wrote for itself. Contract restrictions rarely bite here, though employee data and third-party names still need attention.
2. Bucket B, mixed records. Support tickets, project files and email threads that mix company work with customer content. These need a contract check per top customer and a plan for redaction.
3. Bucket C, customer-owned records. Data the company holds only to deliver a service, such as hosted customer databases or an outsourcer's client files. Treat as out of scope unless the customer agrees in writing.

Then work through these steps:

• List the 10 largest customers by revenue and pull each signed MSA, DPA and order form.
• Mark each as controller, processor or neither for the data in question.
• Flag every purpose-limit, confidentiality and deletion clause that mentions data use.
• Note which customers are in the EU or the UK, or serve people there.
• Record any consent, notice or approval step the contract would require.
• Ask counsel which buckets can enter a data inventory and which need redaction first.

What does this mean in common situations?

What to say to the owner

Keep the conversation short and practical.

The data license term sheet checklist shows what a license itself should cover, which is the other half of this review. If the company wants a plain-language record of what it has, the quality inspection records checklist is an example of a record-type walk-through. Advisors writing to their clients can adapt the CFO fit-screen email, and the subject-line guide keeps outreach plain.

How the process handles this

SourceX qualifies the company, the company completes a data inventory, and rights review happens before price and terms are agreed. Nothing is binding until the company agrees price and terms and signs, de-identification and redaction requirements are agreed before any work begins, and data is delivered only after an executed agreement and the company's authorization. Companies keep ownership; data is licensed, not sold. A company whose records mainly belong to its clients, without their consent, is a red flag rather than a candidate.

When to stop

Pause the introduction if the company cannot identify which contracts govern its main record sets, if the key customers have already objected, or if the data is mainly customer-owned. A company can come back later once the review is done. You can check basic fit without sharing contact details using the company fit checker, and read who qualifies for the baseline of 50+ full-time employees at peak (contractors excluded).

Next step

If a company you know has done this review and wants to proceed, register as a partner and make the introduction, or point the owner to the introduction email builder to draft a note.