A data license in due diligence: the LOI, the disclosure schedules, excluded assets and privacy reps

How a data license shows up in due diligence

A data license is a contract in which your company lets an AI data buyer use a de-identified copy of certain records for a stated purpose and term, in exchange for payment. You keep the originals. For an acquirer, that raises four questions: does the license limit what the company can do with its own records, does it survive the sale, is money still owed in either direction, and was the copy made in a way that fits the company's privacy promises.

Those questions come up in three places in a deal: the letter of intent, the diligence review, and the purchase agreement. The sections below take each in order. The SBA's own summary of a sales agreement says it covers how the business will be run before closing and what information the buyer can access, and warns that leaving out assets or liabilities causes problems after closing (source: SBA, close or sell your business). A data license touches both.

If you are still deciding whether to license at all, start with our guide to licensing your data before selling your business.

LOI exclusivity and a data license: reading the no-shop

Letters of intent often say they are non-binding except for a few named clauses, and exclusivity tends to be one of them. One LOI filed with the SEC states that it is non-binding except for its Closing, No Shop and Applicable Law sections. Its no-shop bars both parties, for 60 days, from soliciting, negotiating or considering any proposal for the acquisition of an ownership interest in the company or of its assets, “in whole or in part” (source: SEC filing, International Gold Corp. letter of intent (Jul 10, 2012)).

Courts take these clauses seriously. A Kirkland & Ellis note on a Delaware Chancery decision says the court called an exclusivity provision a unique right whose breach money cannot adequately fix, and granted injunctive relief on colorable claims of breach. The same note says the parties should be clear about which LOI provisions are binding (source: Harvard Law School Forum on Corporate Governance, Letters of Intent: Ties that Bind? (Jan 24, 2010)).

What that means for a data license:

• Signed before the LOI: the license is an existing contract. Disclose it before you sign the LOI so the price and the exclusivity are agreed with it in view.
• Planned, not signed: say so in the LOI. A sentence permitting the company to finish a named data license on stated terms removes the argument later.
• Not discussed: treat the no-shop as covering it. A license of a copy is not a sale of the records, but “assets, in whole or in part” is broad, and the acquirer can stop the deal or the license over it.

Many AI data programs also have exclusivity of their own. One buyer program's FAQ says the company agrees not to sell or license the same data for external AI training for 24 months, another lists its closed deals as perpetual exclusive licenses, and a third structures licenses as exclusive by default (source: program terms, Regulr buyer directory). That restriction binds the company after you sell it, which is exactly why the acquirer will read it. Our buyer directory lists the programs and links to their published terms.

Between signing and closing: ordinary course and no new licenses

Once a purchase agreement is signed, the seller usually commits to running the business normally until closing, and represents what it has and has not done since a stated date. One asset purchase agreement filed with the SEC has the seller represent that it has conducted the business in the ordinary course, has not entered into any agreement or license outside the ordinary course or above a $50,000 threshold, and “has not granted any license or sublicense” of rights in its intellectual property (source: SEC filing, Benson Hill asset purchase agreement (Oct 31, 2023), 1.2, 2.6 and 4.2).

A data license is rarely ordinary course for an operating business. If one is signed between signing and closing without the buyer's consent, reps like these become untrue. If you want to finish a license in that window, put the consent in writing and add the license to the schedules before closing.

How to disclose a data license when selling a business

Disclosure happens on the purchase agreement's disclosure schedules. One asset purchase agreement filed with the SEC has the seller list each material contract on a schedule and represent that each is a valid and binding obligation in full force and effect (source: SEC filing, Geeknet asset purchase agreement (Aug 1, 2014), 2.1, 3.10 and 3.22). In our view, a data license belongs on that schedule at almost any small or mid-sized company.

Give the acquirer the license itself and a short summary that answers what it will ask anyway:

• Counterparty type, signing date, term and any renewal
• Systems and years in scope, and the exclusions you approved
• Exclusivity: length, which uses it covers, and whether the company's own internal AI use stays free
• Payments received, payments still due, and any refresh or follow-on delivery
• Warranties you gave about the data, indemnities and any clawback
• De-identification method, the sample you reviewed, and the deletion confirmation
• What the license says about a sale, assignment or change of control

One practical note on confidentiality: one buyer program's FAQ says it does not name the company publicly without written consent, but may share the company's name, industry and a general description of the data with its AI customer under confidentiality (source: program terms, Regulr buyer directory). Check whether your license lets you show its terms to a prospective acquirer under an NDA before you open the data room.

Excluded assets in an asset purchase agreement: carving out the license and its proceeds

In an asset sale, records and data are usually purchased assets. One agreement filed with the SEC lists among the purchased assets all customer, user and other data, all lists and records of customer accounts and suppliers, and all books, records, files, correspondence, lists and data, and it treats every contract not listed on the purchased-contracts schedule as an excluded contract (source: SEC filing, Geeknet asset purchase agreement (Aug 1, 2014), 2.1, 3.10 and 3.22). Another excludes all books and records the seller must keep by law and all tax returns and tax work papers, with each side giving the other copies of files on reasonable request (source: SEC filing, Benson Hill asset purchase agreement (Oct 31, 2023), 1.2, 2.6 and 4.2).

That structure gives you three places to put a data license:

1. As a purchased contract. The buyer takes the license, its duties and any future payments. This suits a license with ongoing refreshes the buyer will deliver.
2. As an excluded contract, with the receivable excluded too. You keep the license and the money still due. Make sure the buyer still lets the company deliver anything the license requires, since the buyer will own the records.
3. Finished before closing. Delivered, paid and with nothing left to perform. The license is disclosed, and the only live term is exclusivity, which the buyer accepts as a limit on the records it is buying.

Whichever you choose, list it by name. Do not rely on general definitions such as “all contracts” or “all accounts receivable” to sort it out. The IRS treats business books, records and other information bases as section 197 intangibles in the asset classes both sides report on Form 8594 (source: IRS, Instructions for Form 8594), so the records are a real line item in the deal either way.

Assignment of a data license on sale: asset deal versus stock deal

Whether the license moves to a new owner depends on how the sale is structured and how the license is written. A Clark Wilson LLP article explains the general pattern: in an asset purchase, an anti-assignment clause requires the other party's consent before the contract can move to the buyer; in a share purchase that consent does not arise, but a change of control clause can, and some contracts deem a change of control to be an assignment. It adds that consents can take several weeks and that contracts should be reviewed early (source: Clark Wilson LLP, Acquiring contracts in the purchase of a business (May 14, 2013)).

• Stock sale. The company that signed the license is still the company, so the license stays in place unless it has a change of control clause. The exclusivity comes with it.
• Asset sale. If the buyer is taking the license, you may need the AI buyer's consent to assign it. If you are keeping it, the license stays with the selling entity.

Before you sign any license, ask the AI buyer to state what happens on a sale of the company or its assets: whether the license continues automatically, whether either side can assign it, and whether a change of control triggers notice, consent or termination. Agreeing this at signing costs nothing. Negotiating it during a sale, when you need a quick answer, gives the other side leverage.

Reps and warranties on data privacy in an acquisition

Privacy reps are where a data license gets the closest look. One asset purchase agreement filed with the SEC has the seller represent that it complies in all material respects with applicable privacy laws and that it has the right to transfer to the buyer all personal information it owns or holds (source: SEC filing, Geeknet asset purchase agreement (Aug 1, 2014), 2.1, 3.10 and 3.22). A June 2026 Morgan Lewis article lists the reps buyers typically seek: compliance, breaches, pending claims, security measures and the transaction's own compliance, including the absence of undisclosed data breaches or security incidents. It notes that regulators treat deviations from a company's stated privacy practices as potential unfair or deceptive conduct (source: Morgan Lewis, privacy and data security in M&A transactions (Jun 3, 2026)).

The FTC's position on acquisitions points the same way. Its staff told two merging companies that consumers have a right to rely on earlier privacy promises remaining in full effect, and that data cannot be used in a way materially inconsistent with those promises without affirmative express consent (source: FTC Business Blog, Privacy promises prevail (Apr 10, 2014)).

For a seller with a data license, three things make these reps easy to give:

• The license matched your privacy policy. Personal information was removed or replaced with tokens before delivery, and nothing went out that your policy or customer contracts barred.
• You reviewed a sample. You saw the de-identified output before it was sent and kept a record of the review.
• The raw upload is gone. One buyer program says raw data is deleted within 30 days of delivery, and another within 120 days (source: program terms, Regulr buyer directory). Keep the written confirmation for the data room.

What the acquirer's due diligence list asks for about a data license

Diligence request lists differ, but the Morgan Lewis article describes a risk-based privacy review that starts with regulated sectors and sensitive data, then privacy policies and contracts, security controls, breach history and cross-border data flows (source: Morgan Lewis, privacy and data security in M&A transactions (Jun 3, 2026)). Mapped onto a data license, expect requests like these:

• All data licenses, data sale or data sharing agreements, with amendments
• Scope: systems, record types, years, and the exclusion list
• Exclusivity, term, renewal, termination and change of control provisions
• Amounts received and receivable, and any refund, clawback or indemnity
• De-identification method, who performed it, and the sample review
• The privacy policy and customer contract terms in force when the copy was made
• Deletion confirmations from the licensee
• Any complaints, inquiries or incidents connected to the license

If you prepare this packet before you market the business, the license becomes a short conversation in diligence instead of a long one. Our guide to selling a freight brokerage shows how the same questions play out in one industry, and the selling a business hub links a guide for each of the others.

Deal stage by deal stage: what to do about the data license

For a sense of what your records might qualify for before you start, our data value checker shows which programs a company your size likely fits.

Frequently asked questions

Sources

SEC filings, the Harvard Law School Forum, Clark Wilson, Morgan Lewis, the FTC, the SBA and the IRS read on their own pages on November 8, 2026. The SEC filings are examples of how real agreements word these clauses. Program terms re-checked November 8, 2026; our buyer directory lists the programs and links to their published terms.

1. SEC filing, International Gold Corp. letter of intent (Jul 10, 2012)
2. Harvard Law School Forum on Corporate Governance, Letters of Intent: Ties that Bind? (Jan 24, 2010)
3. SEC filing, Geeknet asset purchase agreement (Aug 1, 2014), 2.1, 3.10 and 3.22
4. SEC filing, Benson Hill asset purchase agreement (Oct 31, 2023), 1.2, 2.6 and 4.2
5. Clark Wilson LLP, Acquiring contracts in the purchase of a business (May 14, 2013)
6. Morgan Lewis, privacy and data security in M&A transactions (Jun 3, 2026)
7. FTC Business Blog, Privacy promises prevail (Apr 10, 2014)
8. SBA, close or sell your business
9. IRS, Instructions for Form 8594
10. program terms, Regulr buyer directory