Data licensing agreement

What it is and when it is used

This agreement is used for data partnerships such as the licensing of audience segments, behavioural or contextual data and analytics for advertising and measurement. The parties describe the data categories, the licence fee and (optionally) the term in months. Standard terms cover the licence grant, secure delivery (API, SFTP or another agreed method) with documentation, security measures (encryption, access controls, logging, incident response), confidentiality and the provider's warranties that it may license the data, that the data was lawfully collected and that the necessary consents and legal bases exist.

Who signs it and in which role

The Data Provider (the licensor that owns or controls the data) and the Data Licensee (the buyer of access).

Key clauses

Scope, use and exclusivity

Named datasets listed in a schedule, all data within defined categories (including future data), or full platform access. Permitted use as described in the questions above. An exclusive or non-exclusive licence.

Pricing and quality

A flat annual fee (increases capped at 5% a year), usage-based CPM, or a revenue share. A guaranteed accuracy SLA with service credits, or best-effort quality with no SLA.

Privacy and prohibited uses

Independent controllers, or a controller and processor relationship. Strict prohibitions (re-identification, merging with personal data, cross-device tracking) or standard industry restrictions that allow cross-device tracking with consent and clean rooms.

Retention and audit

Deletion within 30 days of termination, or a 90-day wind-down. Full audit rights up to twice a year, or annual self-certification with audits only on reasonable suspicion.

Liability and territory

Mutual indemnification capped at the annual fees, or a provider-favourable limitation. Use restricted to named territories, or a worldwide licence with transfer safeguards.

What the two sides usually negotiate

The Data Provider prefers named datasets, targeting-only use, non-exclusivity, best-effort quality, strict prohibitions, immediate deletion, full audit rights, limited provider liability and territory restrictions. The Data Licensee prefers full platform access, comprehensive use, exclusivity, a guaranteed SLA, a wind-down period, self-certification and a worldwide licence. The balanced positions are targeting plus analytics and measurement, mutual indemnification with a cap and standard industry restrictions. When the parties disagree, Dealroom proposes these middle-ground options, weighted by how firmly each side holds its position.

Jurisdictions and languages Dealroom supports for it

Dealroom drafts this agreement under the law of California, England and Wales or Spain, in English or Spanish. For California, the template applies the CCPA and CPRA, classifies the parties under them and requires the licensee to honour opt-out and deletion requests. For England and Wales, it applies UK GDPR and the Data Protection Act 2018, treats the terms as a data sharing agreement under ICO guidance and requires UK transfer tools. For Spain, it applies the LOPDGDD and GDPR, names the AEPD as supervisory authority and uses the EU standard contractual clauses (Decision 2021/914) for transfers outside the EEA. According to the catalogue, the current version also covers CCPA sale and share rules, the California Delete Act (DROP), EU Data Act terms for business data and the EU-US Data Privacy Framework.

Common mistakes

• Over-broad scope. It may sweep in protected personal data; audience segments may be personal data under GDPR and the CCPA.
• Wrong privacy roles. Misclassifying controller and processor can lead to significant fines.
• Unclear rights in derived data. What the licensee may keep after termination should be agreed.
• Allowing model training without thought. It raises significant privacy and IP concerns.
• Low liability caps for breaches. GDPR fines can reach 4% of global turnover.
• Unplanned cross-border transfers. Transfers outside the EEA need an adequacy decision or safeguards such as the SCCs.

# 1. Read the clauses, options and the facts it needs
curl https://dealroom.todo.law/api/v1/agent/templates/DATA_LICENSING \
  -H "Authorization: Bearer drk_YOUR_KEY"

# 2. Create the contract (clauses you leave out take the default option)
curl -X POST https://dealroom.todo.law/api/v1/agent/deals \
  -H "Authorization: Bearer drk_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
    "schema": "dealroom.solo-intake/1",
    "contractType": "DATA_LICENSING",
    "governingLaw": "ENGLAND_WALES",
    "language": "en",
    "dealName": "Example DATA_LICENSING",
    "selectionPolicy": "defaults"
  }'