Can you license records that involve clients or employees?
Why access to a business system is not permission to license everything inside it, and how to prepare a focused rights review.
Just because you can export a record does not mean you can license it. First establish whose information it contains, why it was collected and which agreements govern its use.
Start with one system, not your whole company
Focus on one proposed source, such as a system that manages support tickets. Record the types of records, time periods and parties involved. Identify folders and sensitive categories to exclude. A focused review gives your adviser something concrete to assess.
Which agreements should we gather?
Collect the relevant customer contracts, confidentiality agreements, employee notices and supplier terms. Ask your adviser which other documents matter. Note who created the records and whether your company holds them on behalf of someone else. Do not assume a software subscription gives you licensing rights over customer content.
Does removing names solve the rights question?
No. UK ICO guidance explains that anonymising personal data is itself processing and needs to meet data-protection requirements. An eventual anonymous output does not automatically justify every earlier step. Confidentiality and other rights also need their own review. Requirements differ by jurisdiction and by the records involved.
Do we need consent from everyone?
There is no reliable yes-or-no answer for every dataset. Ask your legal or privacy adviser to identify the applicable requirements and permitted basis for each proposed use. Do not assume existing consent covers AI licensing, or that consent is always the only possible basis. Explain the proposed recipients and use, rather than asking for blanket approval to share data.
What should the decision record contain?
The decision record should show the scope reviewed, restrictions documented, unanswered questions and the person authorised to approve the next step. If one customer's material must stay out, make the exclusion detailed enough for the export team to follow. Review the decision again if the scope or intended use changes.
Can an adviser introduce a client first?
Yes, an introduction can happen without transferring the client's records. Obtain permission for the introduction and agree what information may be shared. Maryah starts with counts and carefully redacted screenshots. Raw data moves only after a buyer deal is agreed. Do not attach client files to an enquiry. This is general information, not legal advice or confirmation that a particular dataset may be licensed.
Privacy reference: ICO: introduction to anonymisation and the processing involved. Requirements depend on the relevant jurisdiction.