1. Make a descriptive inventory
Create a simple table for the systems your business uses. For each, record the category of information, its owner, the period covered, approximate volume and how often it changes. Summaries such as 'five years of engineering project documentation' are more useful at this stage than a large unexplained export.
- System and business function
- Information categories and operating history
- Approximate volume and format
- Internal owner and authorised decision-maker
- Known sensitivity or restrictions
2. Trace rights and restrictions
Ask who created the information and what agreements govern its use. Review customer contracts, employee arrangements, supplier terms and ownership of intellectual property with the appropriate advisers. A system login or senior job title alone does not establish a right to license all its contents. Record unresolved questions and keep the affected material out of scope until they are addressed.
3. Map personal and confidential information
Identify personal information, special-category information, privileged communications and contractual confidentiality. Consider both the initial processing and any later use by a buyer. Your advisers should assess applicable obligations, purpose, processing basis, transparency, international transfers and safeguards where relevant. An NDA and a promise to remove names are not substitutes for that assessment.
4. Ask the buyer for a specific process
Before access is granted, establish who receives the information, where processing occurs and which subprocessors or downstream recipients may be involved. Request a clear description of preparation, access control, testing, retention and deletion. Avoid connecting an entire workspace when only a defined subset has been approved. A sample transfer needs its own approved scope too.
5. Review the commercial deal
Compare the offer with the actual rights being granted. An exclusive perpetual licence carries different consequences from a limited non-exclusive arrangement. Confirm acceptance criteria, deductions, timing, rejected-data handling and the responsibilities of the business, buyer and broker.
- Permitted use, licence duration and exclusivity
- Onward licensing and recipient restrictions
- Price, acceptance tests and payment timing
- Preparation costs, brokerage fees and referral compensation
- Retention, deletion, termination and dispute terms
6. Record a go, revise or stop decision
Keep a decision record with the agreed scope, approvals, unresolved conditions and responsible people. If the rights or buyer requirements cannot be satisfied, stop or narrow the scope. You can still improve internal data quality or explore AI training and automation without licensing data externally.
Practical takeaways
- Prepare a summary, not an export.
- Confirm rights before technical access.
- Limit initial and ongoing disclosure to an approved scope.
- Keep a record of the commercial and governance decision.
Sources and further reading
Source information checked 25 October 2026. Programme criteria and terms may change.