Can you relicense data you licensed from someone else?
Quick answer, Nov 5, 2026As of 5 November 2026, holding a licence to data is not the same as holding the right to license it onward. An inbound grant carries only the rights it names, CC BY 4.0 is expressly non-sublicensable, and privacy law adds its own flow-down terms. A buyer traces every field back to the agreement that let it move.
Some of the most saleable records in a company did not start there. A feed bought from an industry association, an export a partner handed over, a public dataset: it sits in your systems, and none of it is yours the way your tickets and approvals are.
Two different questions
Records your business produced raise a terms question your customer contracts answer, and the rights checklist works through that side. Records that arrived under someone else's licence raise a second question, answered by the grant you accepted rather than by anything you signed since. Law travels with the records too: a clean inbound contract does not help if the people in the rows carry rights of their own.
Where the chain breaks
| What you licensed in | What it does to an onward licence | Source |
|---|---|---|
| A dataset under a public licence such as CC BY 4.0 | The grant is "non-sublicensable", so you have nothing to sublicense. Each recipient instead "automatically receives an offer from the Licensor", and you "may not offer or impose any additional or different terms or conditions" | CC BY 4.0, Section 2(a)(1) (the licence grant) and Section 2(a)(5) "Downstream recipients", subparagraphs (A) "Offer from the Licensor — Licensed Material" and (B) "No downstream restrictions" |
| Personal information another business made available to you as a third party | Without a compliant contract you "shall not collect, use, process, retain, sell, or share" it at all | CCPA Regulations § 7052(a), "Third Parties" (effective 1 January 2026) |
| That contract itself | It must name "the limited and specified purpose(s)", which "shall not be described in generic terms", and require the same privacy protection the CCPA requires of businesses | CCPA Regulations § 7053(a)(1)–(a)(3), "Contract Requirements for Third Parties" |
| Data you hold as someone's service provider or contractor | Any subcontract you sign must itself comply with the CCPA and the same requirements | CCPA Regulations § 7051(b), "Contract Requirements for Service Providers and Contractors" |
| Protected health information | Subcontractors must "agree to the same restrictions and conditions that apply to the business associate" | 45 CFR 164.504(e)(2)(ii)(D) and 164.504(e)(5), "Business associate contracts with subcontractors" |
| Consumer personal information where you have no direct relationship with the consumer | Selling it on makes you a "data broker" unless one of the exclusions in § 1798.99.80(c)(1)–(4) applies, and you must register with the California Privacy Protection Agency by 31 January after each year you meet that definition | Cal. Civ. Code §§ 1798.99.80(c), 1798.99.82(a) (Delete Act, effective 1 January 2026) |
| Deletion, which reaches data already sold | Since 1 August 2026 a data broker checks the state deletion mechanism "at least once every 45 days", processes requests within 45 days, directs its service providers and contractors to delete, and afterwards "shall not sell or share new personal information of the consumer" | Cal. Civ. Code § 1798.99.86(c)(1), (c)(1)(A), (c)(1)(C), (d)(2) |
What diligence actually traces
A buyer picks fields and walks them backwards.
- The original grant. Who gave you the rights in writing, and whether that document uses the words sublicense, assign or transfer at all.
- Scope. Purpose, territory, term, and whether model training is named. Where a grant does not name it, that silence is a gap rather than a permission.
- Exclusivity you inherited. A supplier who promised exclusivity to someone else constrains you without naming you.
- The people in the rows. Whether consent reached this use, and who holds the record of it.
- Mixed tables. One licensed-in column inside an otherwise clean table makes the whole table a chain-of-rights question.
This page is not legal advice. Whether a specific grant permits an onward licence is a question for your counsel.
Buyers set their own onward limits too
The limits run both ways. micro1's data partnerships page states that "companies retain ownership of their underlying data" and describes its contracting step as setting terms "including a commitment not to resell or distribute your data until personal and identifying information has been anonymized" (micro1, read 5 November 2026). A later buyer reads that restriction the way you are reading your supplier's grant now.
Where Frontier Desk fits
Rights decide what can be licensed before anyone discusses terms, and diligence reads the same answer again if the company later raises money, borrows or sells. In the Cybernetic Age a company's records are priced as an asset, and an asset with a broken chain prices badly. The data advisory works through whether the records qualify and which route fits your plans; the buyer index shows what each published program states; the data room guide sets out where the inbound grants belong. Start with a free first look.
Questions
Our supplier agreement is silent on resale. Is silence permission? No. Treat a silent grant as covering the uses it names and nothing further. A buyer's counsel reads it the same way, and the cheapest fix is an amendment from the supplier before the dataset is offered.
Can we strip the personal information and sell the rest? De-identification changes the privacy analysis, not the contract. The supplier's limits on purpose and onward transfer still bind the records.
What if the data is public? Public does not mean unlicensed. Read the terms the dataset is published under: a licence such as CC BY 4.0 is expressly non-sublicensable (Section 2(a)(1)), so what you hand on is attribution-bearing material, not a licence of your own making.