# Data licensing agreement: what to include

> What a data licensing agreement covers, clause by clause: scope, permitted use, AI training and models, personal information, payment, term and deletion.

Canonical: https://origindatapartners.com/guides/data-licensing-agreement
By: Origin Data Partners
Status: Published
Published: 2026-10-09
Updated: 2026-10-09
Sources checked: 2026-10-09

## Quick answer

A data licensing agreement lets another company use a defined set of your records for a stated purpose while your company keeps ownership. It should settle exactly which data is licensed, what the licensee may do with it (including whether AI training is allowed), how personal information is removed or protected, what you are paid, how long the license runs, and what happens to copies and trained models when it ends. Use the clause checklist below to prepare, and have your own counsel draft or review the agreement.

## Key points

- A license grants rights to use data; it does not transfer ownership. Under some privacy laws, disclosing personal information for value can still count as a sale.
- For AI training, say in writing whether the licensee may keep models trained on the data after the license ends.
- Check your own privacy policy and customer contracts before promising anything about records that came from customers.

## Is licensing data the same as selling it?

Not in the ownership sense. A license gives another company permission to use defined data for a defined purpose and period. Your company keeps the records, and the agreement sets the limits.

Privacy law can see it differently. California’s CCPA defines selling personal information broadly, as making it available to another business for money or other valuable consideration ([Cal. Civ. Code 1798.140](https://law.justia.com/codes/california/code-civ/division-3/part-4/title-1-81-5/section-1798-140/)). Calling the deal a license does not change that. Records that contain personal information need de-identification or another legal basis before they move; see [is it legal to sell company data for AI training](https://origindatapartners.com/guides/sell-company-data-ai-training-legal).


## Clause by clause: what the agreement should settle

Use this as a preparation checklist before a term sheet or draft arrives. It is not a template to sign and it is not legal advice. [Download the checklist as a CSV](https://origindatapartners.com/downloads/data-licensing-agreement-checklist.csv) to record your position and open questions for each clause.

| Clause | What it settles | Question to answer first |
| --- | --- | --- |
| Licensed data | Exactly which record categories, date ranges and fields are included, and the delivery format | Can we describe the data without exporting it? |
| Grant and permitted use | What the licensee may do with the data, for what purpose, and whether the license is exclusive | Which uses are we comfortable with, and which are off the table? |
| AI training and models | Whether training is allowed, whether trained models may be kept after the term, and whether the data may train models offered to others | Do we care what happens to a model after the license ends? |
| Personal information | Who removes or de-identifies personal information, to what standard, and before which step | Which records contain customer, employee or contact details? |
| Third-party material | Who is responsible for content the company does not own, such as customer files or licensed documents | Which records include material received under another contract? |
| Access and security | How the data is delivered or accessed, by whom, and the security controls required | Will we deliver a copy, or allow access in a controlled environment? |
| Onward transfer | Whether the licensee may share, sublicense or resell the data, including to affiliates | Who else could end up with the records? |
| Fees and payment | Fixed, recurring, per-delivery or usage-based payment, and when payment is due | What would make the work worthwhile for us? |
| Term and termination | How long the license runs, renewal, and the reasons either side can end it | What happens if the licensee is acquired? |
| Return and deletion | What the licensee must delete or return at the end, and how deletion is confirmed | Which copies, derivatives and backups are covered? |
| Warranties and liability | What your company promises about the data, and the limits on each side’s liability | What can we honestly promise about accuracy and rights? |
| Audit and reporting | How you confirm the data is used as agreed | What evidence would satisfy us? |


## Terms that matter most for AI training

Trained models are the clause most easily missed. Open data licenses are written for sharing, not for controlling models: the Community Data License Agreement Permissive 2.0 places no restriction on Results, which it defines to include machine learning models ([CDLA-Permissive-2.0](https://cdla.dev/permissive-2-0/)). A license for company records should say plainly whether models trained during the term may be kept, used or sold after it ends.

Also settle whether the licensee may use the data to train models offered to your competitors, whether outputs that reproduce your records are permitted, and whether you can ask for your data to be left out of future training runs.


## Check the promises your company already made

Before licensing records that came from customers, read what your privacy policy and customer contracts said when the records were collected. The FTC has warned that quietly changing terms to allow new uses of data, such as AI training, could be unfair or deceptive ([FTC, February 2024](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive)).

If a vendor processes personal data for you under the GDPR, a written contract must set out how ([GDPR Article 28](https://gdpr-info.eu/art-28-gdpr/)). A licensee that uses data for its own purposes is a different relationship and needs its own legal basis.


## How payment is usually structured

Agreements for company records are rarely published, so there is no reliable standard price. The structure matters as much as the amount: a one-time fee for a historical archive, a recurring fee for ongoing deliveries, payment per delivery or per volume, or a fee tied to use. Compare the whole proposal, including deletion terms and liability, not only the headline number. See [how much company data is worth](https://origindatapartners.com/guides/company-data-value).


## The order that keeps you in control

Most problems start when records move before the terms are settled. Keep each decision separate.

- Describe the records at company level with an [inventory](https://origindatapartners.com/blog/company-data-inventory-template), not an export.
- Agree the scope and permitted use in a short term sheet.
- Work through the [due diligence checklist](https://origindatapartners.com/guides/data-licensing-due-diligence) on rights, personal information and security.
- Have counsel draft or review the agreement.
- Deliver de-identified data only after signature, and keep a record of exactly what was delivered.


## Questions and answers

### Is there a free data licensing agreement template?

Model licenses exist for open data, such as the Community Data License Agreement, but they are written for sharing data publicly and do not restrict trained models. A license for company records needs negotiated terms. Use the clause checklist on this page to prepare, then have counsel draft the agreement.

### Who owns a model trained on licensed data?

Whatever the agreement says. If it is silent, the licensee will usually treat the trained model as its own, so decide in advance whether models trained during the license may be kept after it ends.

### Can we license data that contains customer information?

Only with care. Personal information usually has to be removed or de-identified, and your privacy policy and customer contracts may limit new uses. Check those before any records move.

### Does Origin draft licensing agreements?

No. Origin Data Partners is an independent referral business. It helps owners describe their records and prepare for a conversation; your own counsel drafts or reviews any agreement.

## Sources

- [Linux Foundation: Community Data License Agreement, Permissive 2.0](https://cdla.dev/permissive-2-0/)
- [FTC: Quietly changing your terms of service could be unfair or deceptive (February 13, 2024)](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive)
- [California Civil Code section 1798.140 (CCPA definitions)](https://law.justia.com/codes/california/code-civ/division-3/part-4/title-1-81-5/section-1798-140/)
- [GDPR Article 28: Processor](https://gdpr-info.eu/art-28-gdpr/)

## Related reading

- [Company data licensing due diligence checklist](https://origindatapartners.com/guides/data-licensing-due-diligence)
- [Is it legal to sell company data for AI training?](https://origindatapartners.com/guides/sell-company-data-ai-training-legal)
- [How much is your company data worth?](https://origindatapartners.com/guides/company-data-value)