Separate the rights questions
Copyright, confidentiality, trade secrets, contractual restrictions, privacy, privilege and regulated-data duties can overlap. Owning a business does not automatically resolve each question for every record it holds. Review the data categories, territories, participants and proposed uses.
De-identification is a process
Removing obvious identifiers can reduce risk but does not automatically make data anonymous or freely licensable. Context and combinations of attributes can identify a person. Agree a method, testing, responsibilities and residual-risk review before disclosure.
Consider people and obligations
Employee notices, customer promises, client agreements and retention policies may constrain use. Discuss whether notices, permissions or other lawful grounds are needed with counsel. Avoid making blanket claims that consent is always required or never required.
Build the controls into the agreement
Ask about purpose limits, security, onward recipients, geographic transfers, retention, incident notification and deletion. Model training can complicate later removal; do not equate deleting a source file with removing its influence from a trained model.
Sources & further reading
- FTC: Protecting personal information
- ICO: Anonymisation guidance
- U.S. Copyright Office: Copyright basics
Provider statements are attributed claims, not audited outcomes. Reviewed 19 October 2026.