Do customer contracts allow licensing data?
The short answer
The contract decides. Scan five clause types: confidentiality, processor terms, service-generated data ownership, AI-training clauses and deletion duties. A processor under GDPR Article 28 works only on documented instructions. CCPA service-provider contracts must bar selling. Counsel reads the clauses.
A scan gathers facts and doesn't judge a contract. The goal is a short list of agreements and clauses to put in front of counsel, so the lawyer's time goes where it counts.
Which clauses should you look for?
Confidentiality and permitted use. Find the definition of confidential information, the permitted-use clause and how long the duty lasts. Our NDA page covers how a use limit meets a license.
Processor or service-provider terms. A data processing addendum shows whether you hold the customer's data on its behalf. Under CCPA section 1798.140(ag), a service provider's written contract must prohibit selling or sharing the personal information.
Data generated by a service. In the Spirit Airlines sale, the software vendor Springshot argued that data generated by its service belongs to it under its contract (The Next Web, 18 Sep 2026). Look for the same wording in your vendor agreements.
AI-training clauses. Common Paper's 2026 report on 16,140 signed agreements found language prohibiting AI training in 14% of cloud service agreements, up from under 1% in 2024. Its default clause lets the vendor train on aggregated, de-identified data.
Return and deletion. GDPR Article 28(3)(g) has a processor delete or return personal data when the service ends. An old agreement may already require that the data be gone.
Does the vendor-side carve-out let a customer license?
The aggregated-data clause covers the vendor's own use. My reading is that it gives a customer no right to license a vendor's or a client's records. Counsel confirms that reading against your actual wording.
How do you sort the data first?
Daniel Goldberg, a partner at Frankfurt Kurnit, lists the inventory work as a first step: identify data held as a service provider or processor, and review platform terms for the systems the data comes from.
Sort each system into data you collected yourself, data you hold for a customer and data that belongs to a third party. The SaaS page covers the middle group, and the rights check asks whose records these are and what your customer contracts say.
What about buyers' own terms?
Buyers ask the owner to warrant that it holds the rights. Our reps and warranties page lists the public examples, and the risks page shows where deals drew objections.
Talk to a privacy or commercial lawyer in your state before you sign.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
