The 12-point checklist
| Term | What to check |
|---|---|
| 1. Scope | Exact systems, date ranges, volumes and exclusions |
| 2. Permitted uses | Training, evaluation, fine-tuning, benchmarks; whether outputs may reproduce content |
| 3. Exclusivity | Exclusive or non-exclusive, by field and duration |
| 4. Term | How long the licence lasts and whether it renews |
| 5. Onward sharing | Whether the buyer can pass the data to labs, affiliates or resell it |
| 6. Retention and deletion | When raw data is deleted and how deletion is certified |
| 7. De-identification | Who does it, to what standard, before or after transfer |
| 8. Security | Storage, access controls, breach notice |
| 9. Warranties | What you promise about ownership and rights — keep it accurate |
| 10. Liability and indemnity | Caps, and who covers privacy or IP claims |
| 11. Price and payment | Amount, milestones, acceptance criteria, payment timing |
| 12. Confidentiality and publicity | Whether the buyer may name you or the deal |
Be precise about permitted uses
“AI purposes” is too broad. Name the uses — for example, training and evaluating models — and say whether the buyer may create derived datasets, share them, or keep using models trained on your data after the licence ends. Models generally can’t “unlearn” data, so assume trained models survive the term.
Understand acceptance and payment
Many programs pay after the buyer accepts the delivered copy. Define acceptance criteria in writing so payment doesn’t depend on an open-ended review.
Sample clauses to start from
Use these as a starting point with your lawyer, not as final wording.
- Grant. “Licensor grants Licensee a non-exclusive, non-transferable licence to use the Licensed Data solely to train and evaluate machine-learning models.”
- Restrictions. “Licensee will not attempt to re-identify any person or customer, or disclose the Licensed Data to any third party.”
- Retention. “Licensee will delete the Licensed Data within 30 days after the Term ends and certify deletion in writing.”
- Security. “Licensee will store the Licensed Data only in the agreed regions, with access limited to named personnel.”
- Payment. “Licensee will pay the Fee within 30 days of accepting delivery.”
- Liability. “Each party’s total liability is capped at the Fee, except for breaches of confidentiality or data protection.”
If an introducer is involved
Ask how the introducer is paid and by whom. Calto Data may receive referral compensation from a buyer, and we disclose it before you agree to any introduction. You sign the licence directly with the buyer.
Frequently asked questions
Should we agree to exclusivity?
Only if the price reflects it and the scope is narrow. Limit exclusivity by field, data subset and time.
Can we get our data back or have it deleted?
Raw copies can be deleted on an agreed schedule, with written certification. Models already trained on the data usually can’t be reversed.
Who should review the contract?
A lawyer familiar with data protection and IP in your jurisdiction. This guide is general information, not legal advice.
Can the buyer name our company publicly?
Only if the contract allows it. Many licences keep the data partner confidential by default.