Buyer Checklist: What to Ask Before Licensing a Dataset

Buying data is a procurement decision as much as a technical one. The right dataset at the wrong terms can waste a quarter. The wrong dataset at the right price is still the wrong dataset. This checklist is what we recommend to every buyer before they fund an escrow and sign a license.

Provenance

• Where did the data come from, and can the seller point to specific sources?
• Was the data collected under a license or terms that permit redistribution?
• Were any data subjects whose data appears informed and given appropriate rights?
• Does the seller have signed statements that the collection was lawful?

A good seller answers these in under a day with a short document. A seller who stalls or asks you to sign an NDA to see provenance is a warning sign.

Licensing

• What is the scope: company-wide, project-only, affiliates included?
• What is the duration: perpetual, time-boxed, subscription?
• What territories are covered?
• What are the permitted uses: internal analytics, model training, publication, resale?
• Can derivatives be commercialised?
• What attribution is required?
• What are the termination conditions?

Push for a plain-language summary at the top of the license. If the seller cannot summarise it in a paragraph, your legal team is in for a long week.

Delivery

• What is the delivery mode: file transfer, hosted link, or API credentials?
• What is the expected delivery time after payment?
• What formats are supplied: CSV, Parquet, JSON, or vendor-specific?
• What is the data dictionary, and is it included in the delivery?
• If API, what are the rate limits and authentication method?
• Can we test the delivery in a sandbox before full purchase?

Quality and documentation

• Is there a data card describing collection, cleaning, and known biases?
• What is the known noise level and how is it measured?
• Can we see the schema and example rows before purchase?
• What is the change log for the last three releases?
• If labelled, who labelled it and what is the inter-annotator agreement?

Compliance

• Is the dataset anonymised, pseudonymised, or identifiable?
• What transfer mechanism applies if we are in a GDPR jurisdiction?
• Does the seller have a point of contact for data protection questions?
• Are there any security controls or incident response commitments?
• What retention and deletion terms apply after the license ends?

Support and continuity

• What support channels does the seller offer post-purchase?
• What is the expected response time?
• What happens if the seller is acquired or ceases operations?
• Is there a refresh cadence, and is it enforceable?
• How are breaking schema changes communicated?

Due diligence is cheaper than a dispute. Spend an hour asking the right questions and you save weeks fighting the wrong answers.

The order of the conversation

Not every question fits the first email. Open with provenance and licensing. If those answers are satisfactory, go deeper on delivery and quality. Save support and compliance for the final round, when you are serious about buying. Sellers appreciate buyers who signal seriousness; buyers who open with twenty questions on day one often never buy.

Sample before you commit

Always request a sample unless the dataset is tiny. A good sample is a few hundred to a few thousand rows that represent the full schema. If the seller refuses to share a sample, be cautious. There are legitimate reasons (very small datasets, regulated data), but 'because our data is sensitive' is a weak excuse for a sample of a few hundred anonymised rows.

Walk away conditions

Decide your walk-away conditions before you negotiate. Common ones include: refusal to share provenance, refusal to agree a transfer mechanism, no delivery mode compatible with your stack, no change log for the last three releases. When one of these triggers, stop. There are other datasets, and the cost of signing a bad deal is higher than the cost of waiting.

After purchase

• Store the license in your contracts system, not just in email.
• Record the delivery mode and credentials in your secret manager.
• Set a calendar reminder for renewal and for license expiry.
• Capture dataset lineage in your data catalogue, pointing back to the listing URL.
• Review quality against the data card after your first integration test.