Updated October 2026
How a prior data license shows up in due diligence
Your company licensed a copy of its email and files to an AI buyer, or is thinking about it, and now you are selling the business. The acquirer will ask. Frankfurt Kurnit Klein & Selz writes that a prior data sale will come up in diligence, and that buyers will expect documentation of the review, the exclusions and the business reason for it, so the work is mostly keeping a good file.1
The trend
Data rights have become a diligence line of their own
Foley and Lardner describes training-data rights as a freestanding diligence category in AI deals, and says buyers may seek indemnities, holdbacks, escrow and, increasingly, third-party insurance. Mayer Brown treats who owns data, and where it came from, as deal issues in AI acquisitions. Those firms write about larger deals, but the same questions reach smaller ones.2,3
| Fact | Value and source |
|---|---|
| A data sale in later M&A diligence (one law firm's view) | If a company is later acquired, a prior data sale will come up in diligence, and buyers will expect documentation of the review, the exclusions and the business justification |
| AI deals and diligence | Training-data rights have emerged as a freestanding diligence category in AI deals; Foley recommends tailored representations and warranties, and says buyers may seek indemnities, holdbacks, escrow and, increasingly, third-party insurance |
| Data provenance in acquisitions | Mayer Brown treats ownership, provenance and diligence of data as deal issues in AI acquisitions |
What gets asked
The questions a diligence list tends to contain
The likely questions are plain: what was licensed, to whom, on what date, for how long, whether exclusively, what was left out and who removed personal data. Each buyer's own terms give you some of the answers, since buyers commonly say the company keeps ownership, reviews a sample before release, keeps client-held data out and agrees systems and date ranges before export, with a partner stripping names and personal details.4,5,6,7
Exclusivity is the term most likely to matter to an acquirer, and it varies, from exclusive by default to time-limited, with some contracts nonexclusive but perpetual. Some buyers set it only in the written agreement and some never mention it, so record exactly what yours says and for how long.8,9,10,11,12
Keep a file
What to keep from the first call onward
Keep the data buyer's written scope, the list of systems and date ranges included, the sample you approved, the removal method for personal data, the signed agreement and the payment record. If a broker introduced you, keep its fee terms too, including any fee a licensing partner pays it at close. A file built as you go is far easier than one rebuilt under deadline, and the buyers we work with will help you assemble it.13
FAQ
Questions, answered with sources
One law firm, Frankfurt Kurnit Klein & Selz, writes that a prior data sale will come up in diligence, with documentation of the review, exclusions and business justification expected.1
In AI deals, Foley describes them as a freestanding diligence category, with tailored representations and warranties.2
Every business is different, so this one is best talked through with the buyer you're working with. Their team goes over it with you before anything is signed.
Before you sign
Questions to talk through with your buyer
Every business is different, so these are best talked through with the buyer you're working with. Their team goes over them with you before anything is signed.
Questions for this kind of business
- What should the disclosure schedule say about a data license, and does it need the data buyer's approval to share its terms?
- How does a license affect a sale of the business: reps and warranties, change of control, earnouts, exclusivity?
Questions for any buyer
- Is the license exclusive, and for how long?
- Can you sublicense the data, and to whom?
- Which AI labs will receive it, and will you tell us?
- How long do you keep it, and how is it deleted?
- What is your liability cap, and who indemnifies whom?
- Will the contract ban re-identification of people in the data?
- Who removes personal data, by what method, and do we approve it first?