Portfolio company data monetization: a legal checklist for PE teams

What should a portfolio data monetization legal checklist cover?

A portfolio data monetization legal checklist should test five gates for each company before any introduction: title to the records, contract restrictions, privacy footprint, sector rules, and third-party consents. A company that clears all five is ready to be introduced; a company that fails one is either a task for counsel or a pass for now.

The commercial screen comes first: headcount, years of history, depth of systems. This page covers the legal questions that follow, the ones an operating partner can work through with a portfolio CFO or general counsel before anyone outside the company hears about it. For the commercial side, see how private equity teams assess portfolio company data opportunities.

Why run a legal screen across the whole portfolio?

Operating levers now carry more of the return, and a consistent screen shows which companies can actually use this one. McKinsey's Global Private Markets Report 2026 found that multiple expansion and cheap leverage, which accounted for 59 percent of PE returns between 2010 and 2022, have faded, leaving operational value creation as the likely primary source of returns.

Running the same five gates across every company pays off in practical ways:

• One sponsor relationship can cover several eligible businesses, and a shared screen keeps you from asking six CEOs for work that only two can use.
• Legal gaps such as missing contractor assignments are cheaper to fix in an internal review than in a buyer's rights review.
• Portfolio CEOs see a consistent, documented reason for each yes and each no.
• The screen sorts; it does not approve. SourceX still qualifies each company and reviews rights with the company directly.

The five-gate checklist

Work through each gate with the company's CFO, general counsel or outside counsel. Record each answer as yes, no or unknown, and treat unknown as open until someone has checked.

Gate 1: title to the records

Work employees produce in their jobs is the easy part; contractor work, acquired archives and founder-held IP need checking. Under US copyright law, a work prepared by an employee within the scope of employment is a work made for hire owned by the employer, while commissioned work from outside parties qualifies only in listed categories and with a signed written agreement (Copyright Office Circular 30). Ownership can also be divided: any of the exclusive rights can be transferred and owned separately (17 U.S.C. 201), which is how a company can license a defined use while keeping ownership.

• Most records were created by employees in the course of their jobs
• Contractor, offshore and agency agreements include a written assignment of work product
• For each add-on, the purchase agreement transferred systems and records, not only customer contracts
• No founder, affiliate or former parent owns the IP and licenses it back to the company
• The records are the company's own operating history, not mainly client deliverables or client data held as a vendor
• No open dispute, carve-out or transition services agreement leaves records with someone else

Gate 2: contract restrictions

Customer, vendor and partner contracts can limit use even where the company owns the records outright.

• Customer MSAs and DPAs reviewed for data ownership, confidentiality, permitted use, deletion on termination and any bar on AI or machine-learning use
• Reseller, channel and vendor agreements checked for limits on shared data
• No existing data license, data-sharing deal or prior AI-training license covers the same records
• Settlement agreements and regulator orders checked for data-use limits
• Third parties' confidential information inside the records identified, so it can be excluded or redacted

Gate 3: privacy footprint by state and country

Where customers, staff and contractors are located decides which privacy laws counsel has to consider.

• Customers, employees and contractors mapped by state and country
• California exposure assessed: the California Privacy Protection Agency's current regulations took effect January 1, 2026, including rules on risk assessments, cybersecurity audits and automated decisionmaking technology, with some compliance deadlines phased in from 2027 to 2028
• EU exposure assessed: the GDPR can apply to organizations outside the EU that offer goods or services to, or monitor the behavior of, people in the EU (Regulation (EU) 2016/679); the page on whether GDPR applies to a US company walks through common cases
• Privacy policy history and employee notices pulled, including any promise not to sell or share data
• Likely redaction and de-identification needs noted for the company's later discussion with SourceX

For a company that is also heading toward a sale, the privacy due diligence checklist for M&A goes deeper on notices, consents and incident history.

Gate 4: sector rules

Some categories of data carry their own rules regardless of who owns the records.

• Health: protected health information stays out unless authorized or de-identified; HHS recognizes two de-identification methods, Expert Determination and Safe Harbor, after which the information is no longer protected health information under the Privacy Rule (HHS guidance)
• Financial: ask counsel whether the company is a financial institution under GLBA; the Safeguards Rule guide for CPA firms shows how that question plays out for one portfolio type
• Government contracts: ask counsel about contract clauses, markings or export controls that restrict information
• Recordings: call-recording consent rules in the states where callers sit
• Children's, student, biometric or tax-return information identified and excluded unless counsel clears it

Gate 5: third-party consents

Someone outside management may need to approve before the company signs.

• Credit agreement and any intercreditor terms checked for limits on licensing IP or disposing of assets; see whether lender consent is needed to license company data
• Shareholders' agreement checked for reserved matters, including rights of minority holders, management rollover investors and co-investors
• Board approval and the authorized signatory confirmed (owner, CEO, CFO or another authorized representative)
• If a sale is under way, LOI exclusivity and interim operating covenants reviewed
• Sponsor policies checked: conflicts (for example, a sister company building AI products), fees connected to portfolio companies, and any fee-offset terms in the fund documents

How to score each company

Score each gate, then let the weakest gate decide the call.

Illustrative: a fictional five-company screen

The companies below are invented to show how a completed screen reads.

Which results mean park the company, and which mean fix first?

A parked company is not a permanent no. An export preserved during an ERP consolidation, or signed assignments for contractor work, can reopen it.

Who does what after the screen

1. The operating partner shares the gate results with the portfolio CEO and agrees who at the company will sponsor the conversation.
2. The CEO or CFO applies through the partner's referral link, which lands on sourcex.si/apply with the partner's code attached, or the partner submits the company's name, a contact and basic fit details through the referral form. Contracts, policies and the screen itself stay inside the company.
3. SourceX confirms size, history, data breadth and rights with the company's sponsor.
4. The company completes a data inventory, and redaction and de-identification requirements are settled before work begins.
5. Company counsel reviews the license, and the company agrees one all-in price, with SourceX's fee included, and the terms.
6. AI labs and data buyers review the opportunity, typically responding within about two weeks once the company is deal-ready. Data moves only after an executed agreement and the company's authorization, and the company receives a one-time payment, typically within about 60 days of invoicing once the buyer selects the data.

How rewards work across several portfolio companies

Each referred company counts separately. Partners earn 25% of the eligible platform fees SourceX actually collects from that company's licensing deals, with a cap of $100,000 per referred company. The reward becomes payable only after the buyer pays and SourceX receives its fee, no reward is guaranteed, and nothing is deducted from what the portfolio company receives.

Decide in advance whether the firm or an individual registers, and check the fund documents and your compliance policies before accepting any payment connected to a portfolio company. The PE operating partner page covers the role-specific questions.

This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

Next step

Pick the two portfolio companies with the longest operating histories and run them through the five gates with their CFOs this month. For each one that clears, use the company fit checker for a preliminary, non-binding read, then register as a partner and send the CEO your referral link.