Can you license company data? Rights checklist

Short answer

Sometimes, but having the files does not settle it. Before approaching a buyer, record who can authorise access and who holds licensing rights. Then check whether the dataset contains personal information or is covered by confidentiality duties. A yes on one gate says nothing about the others.

This operational checklist uses UK sources, not rules for every jurisdiction. It is not legal advice or clearance. A completed checklist is not a licence and is not approval to share anything. For the general picture, start with the data licensing overview.

The four gates, in order

1. Access and authority

Name the person who can approve sharing this dataset on behalf of the company. Admin login or export rights show you can reach the data. They do not show you may license it. If nobody can be named, stop here.

2. Rights to license

Content is often created by staff, contractors, customers or third-party tools. In UK law, an employer generally owns copyright in works made by an employee in the course of employment. That is "subject to any agreement to the contrary" (Copyright, Designs and Patents Act 1988, section 11). Contractors and customer-supplied material need their own check. Where ownership has to move, the same Act says an assignment is not effective unless it is in writing and signed. Other jurisdictions differ, so confirm where the data was created.

3. Personal information

UK GDPR Article 4 defines personal data as "any information relating to an identified or identifiable natural person". Names, emails, handles and message text can all qualify. Removing obvious identifiers is a risk-reduction step, not a conclusion that the data is no longer personal. Test whether people could still be identified, and decide who is responsible for that test.

4. Confidentiality and contracts

Customer contracts, NDAs, vendor terms and employment agreements may restrict disclosure or reuse regardless of copyright. Read the agreements that cover the content, not only the tool it sits in. The ICO frames sharing as something to do "in a fair, safe and transparent way" (data sharing code of practice), which is a sound test for any dataset.

A note on mixed datasets

Most real company datasets mix several kinds of content: staff messages, customer text, pasted vendor material and machine-generated logs. Treat each kind as its own line in the worksheet. If one part fails a gate, you can often exclude that part, but only if you can actually separate it and say how.

The evidence matrix

For each dataset, build a proof bundle before anyone talks to a buyer. Each gate needs a recorded answer. A single agreement may address several gates, but an unanswered question still holds the review.

Download the blank rights-review worksheet (CSV). It has the checklist fields with empty owner, evidence and result columns. It contains no company records and grants no rights. A filled-in copy is not legal approval. It records what you checked so an adviser can review it faster.

What to share, and when

Release information in steps, and only as far as your evidence goes.

• Metadata first. Where confidentiality permits, describe the dataset: source type, date range, field names, rough volume and format. Do not attach content or disclose sensitive field names.
• Sample only with authority. A sample is still the data. It needs the approver, the rights check and the privacy review above, plus a written scope.
• Hold raw exports. Full exports stay with you until the agreements, the review and an agreed scope are in place.

Our Slack and Teams guide applies this to chat exports. The data valuation page covers what buyers weigh once rights are clear.

Stop conditions

Pause and get qualified advice if nobody can approve or ownership is unclear. Do the same when contractors or customers contributed content without clear terms. Stop if personal information is present and the basis for sharing is undecided, or an agreement restricts disclosure. A request exceeding the agreed purpose, or pressure to share before checking permissions, also means stop. Anonymisation is not a shortcut. Nothing here makes a transfer lawful by itself.

Write down who made each decision and when. Keep a dated record of the approver, agreements checked and scope agreed. It is more useful than recollection if a buyer, adviser or regulator asks why you shared the dataset. Keep the record even when the answer was no.

Sources

1. Copyright, Designs and Patents Act 1988, section 11 (legislation.gov.uk). Checked 31 October 2026. Relevant text: his employer is the first owner of any copyright in the work subject to any agreement to the contrary
2. Copyright, Designs and Patents Act 1988, section 90 (legislation.gov.uk). Checked 31 October 2026. Relevant text: An assignment of copyright is not effective unless it is in writing signed by or on behalf of the assignor
3. UK GDPR Article 4 definitions (legislation.gov.uk). Checked 31 October 2026. Relevant text: ‘personal data’ means any information relating to an identified or identifiable natural person
4. ICO data sharing code of practice. Checked 31 October 2026. Relevant text: the confidence to share data in a fair, safe and transparent way

Related guides

• Data licensing overview
• Data valuation
• Slack and Teams data licensing