Data rights due diligence checklist: does the target own its records?

Why a data rights checklist belongs in the deal file

Records used to be diligenced only as a liability: privacy exposure, breach history, retention gaps. Acquirers now also diligence them as an asset, because operational records can be licensed for AI training and a buyer wants to know whether that value is real. A data rights review answers one question per dataset: does the target own it, and may it be used the way the buyer or a licensee intends?

The checklist serves both sides of a lower-middle-market deal. Sell-side advisors can run it with the CFO before the CIM goes out; buy-side teams can use it to frame legal diligence requests; and an owner weighing a data license can treat it as a readiness review. It does not replace counsel's legal diligence. It gives the advisor a structured way to raise the right questions before the LOI rather than during confirmatory diligence.

The checklist

Who created the records

• Employees created most records within the scope of their jobs; under the Copyright Act's definition of work made for hire, that material generally belongs to the employer.
• Contractors, agencies and offshore teams signed agreements assigning their work to the company. Commissioned work is made for hire only in nine listed categories and only with a signed written agreement, so most contractor output needs an express assignment.
• Founder material created before incorporation, or inside a predecessor entity, was assigned to the company.
• Earlier acquisitions transferred records and IP; asset purchase schedules list books, records and software.

What customer and partner contracts allow

• Confidentiality clauses: which information is the customer's, and what the company may do with it.
• Data-use clauses: whether aggregated or de-identified use is permitted, and whether AI or model training is mentioned at all.
• Return or deletion on termination: whether former customers' data should already be gone.
• Outsourced work: where the company serves its clients' customers, as contact centers, agencies and BPO firms do, whether those records belong to the client.

Third-party content inside the records

• Purchased research, licensed images, vendor documentation and syndicated data in shared drives, with their license terms.
• Open-source license obligations in code repositories.
• Awareness that AI training on copyrighted material is under active policy review; the Copyright Office's AI initiative page links its report on generative AI training, released in pre-publication form in May 2025.

What employees, customers and callers were told

• Handbook and IT policy language on company ownership and monitoring of business communications.
• Privacy notices and customer terms, with every past version and its dates.
• Call and meeting recordings: notice and consent practice by state. Federal law permits recording where one party consents (18 U.S.C. 2511), but California requires the consent of all parties to record a confidential communication (California Penal Code 632).
• Consumer personal data: whether California residents are involved, since the CCPA gives covered consumers rights to know, delete and opt out of the sale or sharing of their personal information.

Regulated data

• Protected health information: whether it can be de-identified by Expert Determination or Safe Harbor under HHS de-identification guidance, or is otherwise authorized.
• Financial customer information: whether the company is a financial institution facing Gramm-Leach-Bliley Act limits on sharing customer information.

Existing encumbrances

• Prior data licenses, especially AI-training licenses and any exclusivity still running.
• Liens on intellectual property under the credit agreement.
• Litigation holds, regulatory orders or settlement terms that restrict data use.

This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

How to use the results

Where the checklist fits in a sell-side process

For the buy-side view of the same questions, see the guide to secondary buyout due diligence; for how a vendor report differs from a licensing review, see vendor due diligence vs a data licensing review. Owners preparing to license can follow up with the rights readiness checklist, and founder-led clients fixing gaps will find the sequence in professionalizing a founder-led business.

Red flags that stop the conversation

• The most valuable records describe a client's customers, and the client has not agreed to any secondary use.
• The dataset is mainly consumer personal data, or protected health information without authorization or de-identification.
• A court, trustee or assignee controls the assets and has not been involved.
• Records were generated with AI in order to be sold.
• Archives were deleted, or nobody at the company can run an export.
• The same data is already licensed for AI training.

Turning a clean result into an introduction

For clients weighing an exit, a deferred sale or a recapitalization, a data license can be another source of proceeds. When the checklist comes back clean and the client is a US company that reached 50+ full-time employees at peak (contractors excluded), has operated with documented records for several years and has an executive who can sponsor an application, a preliminary company fit check is the sensible next step. A suggested line for the client:

The advisor's role ends at the introduction; the client works with SourceX on inventory, redaction rules and terms. Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. Rewards become payable only after the buyer pays and SourceX receives its fee; no reward is guaranteed. Review your engagement terms and professional obligations first; the page for M&A advisor partners covers the points to check.

Next step

Add this checklist to your exit-preparation workplan for the next engagement. When a client passes it, register as a partner and make the introduction, or have the owner apply at sourcex.si/apply with your referral link.