Data licensing agreement terms, clause by clause

A data licensing agreement turns everything decided during scoping into obligations. This guide walks through the clauses you are likely to see, what they usually do, and what to ask for. It follows the overview of how licensing company data works and assumes you have worked through the legal and privacy checklist. This is not legal advice. Have your own counsel review the draft before you sign.

Who is the agreement actually with?

Check the counterparty before the clauses. With a buyer such as Handshake AI, you license to the company that uses the data for training and evaluation. With an aggregator, you license to a company that then licenses the data on: Mercor licenses de-identified data to frontier AI labs (Mercor), and Endless Data names micro1, Mercor and Handshake as labs it licenses to (Endless Data). With a broker, the agreement is between you and the buyer it introduces: Korra says the buyer and the company agree how records move (Korra), and AIData.Broker says the buyer pays the data holder directly (AIData.Broker). Who buys company data explains the four kinds.

What does each clause do, and what should you ask for?

Clause	What it does	What to ask for
Parties and authority	Names who licenses to whom, and confirms each side can sign	The right legal entity on both sides, and a signer with authority under your governing documents
Grant and permitted use	Gives the buyer rights to use the data for stated purposes	A license to a copy, limited to AI training and evaluation, with no transfer of ownership
Scope schedule	Lists the systems, workspaces and date ranges covered	Named systems, containers and dates, plus a written list of exclusions
Term	Sets how long the license runs	A fixed term, or a clear reason and a higher price for perpetual
Exclusivity	Decides whether you can license the same data elsewhere	Non-exclusive, or exclusivity that is narrow, time-limited and priced
Derived models and outputs	Says who keeps what is built from the data	Limits on outputs that reproduce your data, and deletion of derived copies
Deletion and certification	Sets when copies are destroyed	A date, coverage of backups and subcontractors, and a signed certificate
De-identification	Assigns who removes identifiers, and how	A described method, a duty to fix misses, and a ban on re-identification
Confidentiality	Sets how the buyer protects the data	Your data treated as your confidential information, de-identified or not
Resale and sublicensing	Decides whether the buyer can license it on	Named categories of end licensees, flow-down of your restrictions, notice of each one
Reps and warranties	Records what you promise about the data	Promises limited to your knowledge and to the scope schedule
Indemnities	Allocates who covers whose losses	Mutual cover, with the buyer covering misuse, breach and re-identification
Liability caps	Limits what either side pays	A cap for both sides, with the buyer’s misuse of your data outside it
Payment and acceptance	Sets amount, trigger and timing	Objective acceptance criteria and a fixed review window
Audit	Gives you a way to check compliance	Annual certificates, current security reports and, for revenue shares, license records
Governing law	Picks whose law and courts apply	Your state’s law, or a neutral one, and a venue you could use

What should the grant and scope say?

The grant is the heart of the agreement. Look for the word license, a defined purpose and a copy of the data. Handshake says use is restricted by contract to AI model training and evaluation, and that the company keeps ownership (Handshake); micro1 also says companies keep ownership (micro1). Wording that grants “all right, title and interest” reads as a transfer of ownership, and “any lawful purpose” is far wider than training.

Tie the grant to the scope schedule, and tie your warranties to the same schedule, so that you promise nothing about data you never provided. If the buyer connects to your tools rather than receiving an export, the schedule should also say which accounts and permissions the connection may use.

How long does it last, and is it exclusive?

Term and exclusivity work together: a perpetual, exclusive license is the most you can give. Published defaults range from exclusive unless agreed otherwise at Polyshares (Polyshares), whose case studies describe a perpetual exclusive license (Polyshares), to non-exclusive at Endless Data (Endless Data). Exclusivity explained compares every program and lists the questions to ask.

What happens to models trained on your data?

Usually they survive. Endless Data’s buyer terms let its customers keep models and derived output trained during the term, and delete the data within 30 days of expiry (Endless Data terms). Assume the same unless your agreement says otherwise, and negotiate what you can:

• a definition of derived data that separates trained model weights from extracted, labeled or synthetic copies of your data, with those copies deleted like the original;
• a ban on outputs that reproduce your data verbatim or identify your company, staff or clients;
• a ban on attempts to extract training data from the model.

What should deletion cover?

micro1 says raw data is deleted according to an agreed schedule (micro1), and Endless Data says deletion happens at the end of the agreed term (Endless Data). Several programs on our tracker publish no deletion term at all. Ask for a date; coverage of backups, intermediate copies and subcontractors; and a certificate signed by an officer. Make the deletion and confidentiality clauses survive termination.

Who is responsible for de-identification?

Put the method in an exhibit, not a marketing page. micro1 says its contract commits it not to pass data on until it is anonymized (micro1). Korra, by contrast, makes no promise that your records are anonymous (Korra). Ask for the method in writing, a duty to tell you about and fix missed identifiers, a ban on attempts to re-identify anyone, and your right to review a sample before transfer.

Can the buyer license your data on?

Aggregators exist to do this. Turing pays the company a share of each license it grants (Turing), and micro1 publishes only the geography of its end licensees: labs and enterprises in the US and allied countries (micro1). Ask for named categories of end licensees, flow-down of your use, deletion and confidentiality terms, and notice of each new licensee.

If the data could include bulk U.S. sensitive personal data and any recipient is a foreign person, the DOJ data rule requires a contract clause barring onward data brokerage to countries of concern or covered persons (28 CFR 202.302). The checklist explains when that applies.

What will you be asked to promise?

Expect to warrant that the company owns the data or has the right to license it, that the signer has authority, that the data was collected lawfully and consistently with your privacy policy, and that no contract forbids the license. These promises carry most of your legal risk, so ask counsel to:

• limit them to your knowledge after reasonable inquiry, and to the data in the scope schedule;
• disclaim accuracy, completeness and fitness for the buyer’s purpose;
• make indemnities mutual, with you covering breaches of your warranties and the buyer covering misuse, security incidents, re-identification and use outside the grant;
• cap liability for both sides, ideally at the fees paid, and keep the buyer’s misuse of your data outside its own cap.

The consent guide covers the staff and client checks that let you give these warranties honestly.

When do you get paid, and what counts as acceptance?

Most published terms pay on delivery or acceptance, not on signing; how payouts work lists each program’s trigger and timing. In the agreement, ask for objective acceptance criteria, a review window after which data is deemed accepted, and a rule for rejected data: returned or deleted, never used. For a revenue share, add regular reporting and the right to audit the buyer’s records of each license. Check who pays any intermediary too: under Korra’s buyer agreement, its 10% facilitation fee is paid by the buyer on top of the price (Korra).

What about audit and governing law?

Ask for an annual certificate of compliance, the buyer’s current security report, and notice of any breach involving your data. Turing offers its SOC 2 Type II report under NDA (Turing).

Governing law matters because counterparties may sit in another state or country. Endless Data is a trade name of Seldon Ventures, L.L.C., a Delaware company (Endless Data), AIData.Broker is operated by a Delaware corporation (AIData.Broker), and Korra is the business name of an Ontario corporation (Korra). Ask for your own state’s law, or a neutral one, and a venue you could actually use.

Where does SellData.ai fit?

SellData.ai is not a party to any license and never touches your data. We compare programs, help you decide what stays out, and introduce you to the ones that fit; the buyer pays us a referral fee and you pay nothing. Start with the value check, or compare published terms on the tracker.