Can you license data your customers created? A rights checklist

A licence of data your customers created is a terms question inside a larger plan. Frontier Desk is the company's advisor for a sale or license of its data: the right buyer, the right exchange, the right terms, and the right plan. The buyer is where the data goes. Customer contracts, employee privacy, the systems the data sits in, and any earlier licence decide whether the terms are available. Those same obligations are what diligence reads if the company later raises capital, borrows, or sells. Where they allow a licence, the proceeds can go back into the business. Where they stand in the way, that limit is part of the data deal and part of any later raise, loan or sale.

The question every deal turns on

A buyer will ask what you are allowed to license before it will price what you are selling. Four groups of rules decide it: your customer contracts, your employee and privacy obligations, the terms of the systems your data lives in, and any licence you have already granted. The Spirit Airlines example at the end shows how one of these can hold up a sale.

1. Customer contracts

• Does the master services agreement allow use of the customer's data beyond providing the service? Standard language limits use to performance of the contract. A derivative-use or model-training right is usually explicit when it exists.
• Confidentiality clauses: customer confidential information often cannot be licensed to a third party at all.
• Data processing addenda (DPAs): if you process personal data on the customer's behalf, you are the processor and the customer is the controller. The customer's instructions govern what you may do with the data.
• Statements of work (SOWs): some SOWs grant the customer ownership of deliverables, including intermediate work product that would otherwise be yours.

2. Employees and privacy

• US workplace privacy: several states regulate electronic monitoring and the disclosure of employee communications. The FTC has brought actions over unfair data practices in employment contexts (FTC consumer privacy enforcement).
• State privacy laws: California, Colorado, Connecticut, Virginia and others cover personal information with specific rules for sensitive data and employee data. The California Privacy Protection Agency publishes its regulations and enforcement actions (CPPA).
• Sector rules: HIPAA for health data (HHS), GLBA for consumer financial data at financial institutions (FTC Safeguards Rule), FERPA for student records (ED), COPPA for data about children (FTC).
• Non-US employees: GDPR treats most employee data as personal data and sets the lawful bases on which it can be processed (European Commission GDPR hub).

3. Terms of the systems you export from

• Microsoft 365, Google Workspace, Slack, Salesforce, HubSpot, ServiceNow and similar: read the data use terms in the current customer agreement for each system. Export rights do not automatically carry a right to license content to a third party.
• AI buyers often use a specific data use agreement. Microsoft publishes a DUA template for AI training data (Microsoft research licensing); the terms in a buyer's DUA override your defaults for the dataset being licensed.
• Open-source and third-party content embedded in your records. Code, images, templates and documents inside your systems may carry their own licences.

4. Earlier licences you have already granted

• Exclusive licences block a second buyer from receiving the same data under the same scope. An earlier non-exclusive licence does not block another, but a buyer will ask.
• Perpetual or irrevocable licences mean a sale of the business does not clean the slate.
• "All improvements" or "derivative works" language in an existing licence can reach work you have not done yet.

The Spirit Airlines example

The bankruptcy sale of Spirit Airlines' business data drew objections over employee privacy, and the court hearing to approve the sale was moved to 6 November 2026 (reported by Reuters and Travel Weekly). The objection was not that the records did not exist, or that no buyer wanted them. It was that the records included employee communications that staff had not consented to see licensed, and that the privacy groundwork was not in place when the sale was being approved. Check rights before you apply, so a 6 November-style objection does not meet your deal.

A short checklist, in the order a buyer's lawyers read it

1. Customer contracts: use rights beyond the service, confidentiality, DPAs, SOW ownership.
2. Employees and privacy: state and federal law, sector rules, GDPR for non-US staff.
3. Systems' own terms: current customer agreements for the platforms the data sits in.
4. Earlier licences: exclusivity, perpetuity, derivatives, improvements.
5. Document the chain of consent: who agreed to what, when, where it is written down.

This page is not legal advice. Rights questions in a specific deal belong with a lawyer.

Where Frontier Desk fits

Frontier Desk advises that sale or license for the company, and these rights are part of the terms and the plan. They decide what can be licensed, and they decide what a later investor, lender or buyer of the company will find, including exclusivity and the intellectual-property and customer-data obligations that remain. The data advisory works through whether the records are ready and which route fits before the company approaches a buyer. The data room guide sets out what the room needs under each heading above. Start with a free first look.

Questions

Do I need a lawyer for this? Yes for rights, privacy and the agreement itself. A buyer will insist on it, and so should you.

Can a buyer indemnify me? Buyers do often indemnify for their own uses, but not for your having had the right to license in the first place. The rights have to be yours before anyone can indemnify anything.

What if I sell the company later? Tell any buyer of the company early. An existing data licence changes what they are buying, and an exclusive one changes it a lot.

Why does the Spirit Airlines sale matter here? Because it shows a court can delay a data sale over the employee-privacy question, even when a buyer and seller agree. The groundwork belongs in place before approval, not after.