Insights
Privacy and preparation
138 guides · page 1 of 3
Argentina data protection law: Law 25.326 rules for licensing records
Argentina data protection law (Law 25.326) for licensing records: consent or dissociation, transfer routes abroad, EU adequacy and the reform status.
Chile data protection law: licensing records under Ley 21.719
Chile data protection law for dataset licensing: which text applies before and after Ley 21.719 starts, consent, cesión and transfer routes, and the fines.
Protección de datos personales Colombia: Ley 1581 for dataset licensing
Protección de datos personales in Colombia for dataset licensing: Ley 1581 authorization, SIC accountability, RNBD and the transfer route to a U.S. buyer.
Costa Rica data protection law: Law 8968 rules for licensing records
Costa Rica data protection law (Law 8968) for licensing records about people there: transfer consent, de-identification, PRODHAB registration and a checklist.
Cross-border data transfer: which mechanism applies by origin country
Cross-border data transfer for licensed datasets: which mechanism applies from the EU, UK, Canada, Brazil, India, Singapore and the U.S., and what to hold.
Data preparation tools for inventorying business records before an AI licensing review
Data preparation tools compared by class for building a business record inventory before AI licensing: what each gives a reviewer and what it leaves undone.
Data quality tools vs a data licensing review: what each checks
What data quality tools check automatically, what a buyer's licensing review tests that they cannot, and a 10-step pre-submission runbook for your dataset.
English-only subset of multilingual data: how to scope and document it
How to carve an English-only subset of multilingual data from a mixed archive: boundary rules, translated records, provenance, rights and an exclusion log.
How to measure language share of a dataset: an English-share worksheet
How to measure language share of a dataset before offering it: pick a unit, set a rule for mixed records, sample with LID tools, and report estimate vs verified
Missing values in a dataset: classify them, then accept, fix or reject
Missing values in a dataset, classified: six operational causes beyond MCAR, MAR and MNAR, how to detect each, and when to accept, fix or reject the data.
Training data poisoning: acceptance tests for licensed datasets
Training data poisoning in licensed datasets: a risk checklist by data origin, acceptance tests to run before delivery, and contract wording for buyers.
A customer asks to delete their data after delivery: what happens next?
A deletion request after data was shared with a licensee: why de-identified deliveries are out of reach, how flow-down works and the steps to follow.
A secure staging environment for data preparation
A secure data staging environment keeps raw exports contained while records are cleaned. The reference setup: isolation, MFA, encryption, no egress, logs.
AI meeting notetakers and consent: transcripts you may not be able to license
AI notetaker consent laws can stop you licensing meeting transcripts. Check who consented, external participants, state recording rules and vendor terms first.
An encrypted drive was lost in transit: what now?
A lost encrypted hard drive is not automatically a breach. Confirm the key was never exposed, document custody, assess notice with counsel, then re-ship.
Are employee names in work documents personal information?
Employee names in work documents are personal information in most privacy frameworks. See which identifiers count, which laws may apply and how to treat them.
Background checks and drug test results in staffing records
Background check records and drug test results belong outside any licensed staffing dataset. Where they hide in your ATS and which rules may restrict them.
Best PII detection tools for business records compared (2026)
Best PII detection tools compared for support tickets, CRM notes, email and code: where each runs, what it detects, and how to test it on your own records.
Biometric timeclock data: keep it out of every export
Biometric timeclock data privacy before an export: where fingerprint and face templates hide in HR and payroll records, and the exclusion rule to apply.
Building an exclusion list: HR, legal and executive channels and mailboxes
A data export exclusion list template: the HR, legal and executive channels and mailboxes to exclude, who owns each, and how to verify nothing slipped out.
California AB 2013 training data disclosures: what buyers will ask suppliers to document
California AB 2013 makes AI developers publish training data summaries. See what buyers will ask suppliers to document and which records to prepare now.
Can DLP tools find personal data before an export?
DLP tools find PII with fixed formats, like card and ID numbers, but miss names and context in free text. See when to add a redaction tool before an export.
Can you license records that are under a litigation hold?
Litigation hold data licensing: a hold requires preservation, not secrecy, but copying held records needs counsel sign-off. What to exclude, plus a checklist.
Can you use an LLM API to redact PII without exposing the data?
Using an LLM to redact PII sends raw records to the model first. When a hosted API is acceptable, a six-point checklist, and options that keep data in-house.
Candidate data in ATS exports: what staffing firms must remove
ATS data privacy for staffing firms: which candidate fields to remove, which to generalize, and which role, skill and stage outcome data can stay.
Capture less personal data going forward: ticket and CRM hygiene
Reduce PII in support tickets and CRM records at the source: a checklist for form fields, warning text, auto-masking, agent macros and retention.
Card numbers in tickets and chats: PCI DSS scope before an export
Credit card numbers in support tickets can pull a helpdesk into PCI scope. How to find them with a Luhn check, remove them and record it before any export.
CCPA deidentified data requirements: safeguards, public commitment and contract terms
CCPA deidentified data requirements in three parts: reasonable measures, a public no-reidentification commitment and recipient contracts, with sample text.
CCPA risk assessment rules (2026): does licensing personal information trigger one?
Does licensing personal information trigger a CCPA risk assessment? Four deciding questions, what the assessment covers and what deidentified data changes.
Certificate of data destruction: what it should include (template)
A certificate of data destruction template for licensed datasets: the fields to require, wording to adapt, and how to handle backups and trained models.
Client names in consulting engagement files: anonymizing case histories
How to anonymize client names in consulting engagement files: check contracts first, then treat identity, industry, size, dates and people consistently.
Compute-to-data: can a buyer train on your data without receiving it?
Can a buyer train AI without sharing data? Compare enclaves, federated learning and seller-hosted training by effort, cost and what still leaves your network.
Consistent pseudonyms: keeping one person one placeholder across a dataset
Consistent pseudonymization keeps one person one placeholder across tickets, chats and email, so threads stay readable. A five-step method with a keyed hash.
Consolidated legacy archives across portfolio companies: access and security controls
Legacy data archive security for holding groups: name an owner per entity, segregate each company's records, review access and track every retention clock.
Contractors and freelancers in work records: same rules as employees?
Contractor personal data under the CCPA is generally treated like employee data in California. Ownership differs: check contracts before licensing their work.
Cross-account bucket delivery (S3, GCS, Azure): a security checklist
Share an S3 bucket with another account securely: dedicated buckets, scoped roles, key policies, logging, expiry and revocation, mapped to GCS and Azure.
Customer data in bankruptcy: when a consumer privacy ombudsman is appointed
A consumer privacy ombudsman in bankruptcy reviews customer data sales the privacy policy did not allow. When one is appointed and how to prepare the estate.
Customers asking whether you train AI on their data: answering security questionnaires
Security questionnaires now ask if you use customer data to train AI. Use an answer template that separates customer content from your own records.
Data dictionary template for an exported dataset
A data dictionary template for exported datasets: the columns to include, a filled support ticket example, and the export quirks reviewers always ask about.
Data protection assessments before selling data: which states require them
Data protection assessment requirements under US state privacy laws: what triggers one, when de-identified licensing avoids it, and what to write down.
Data Provenance Standards explained for data suppliers
The Data Provenance Standards group dataset metadata into Source, Provenance and Use. What each group asks a data supplier, and which records answer it.
Dataset watermarking and canary records: tracing a leak to its source
Canary records and dataset watermarking give each licensee a uniquely marked copy, so a leaked file points to its source. How they work, limits and records.
Date shifting in de-identification: when it helps and when it breaks timelines
Date shifting de-identification hides real calendar dates but keeps intervals. Which fields to shift, which to keep exact, and where shifting breaks analysis.
Detecting PII in structured exports: CSV, JSON and database tables
Detect PII in database tables, CSV and JSON exports: classify columns first, scan free-text cells second and record each decision in a column register.
Do AI summaries of tickets remove personal data?
AI summarization does not reliably remove PII from support tickets. See what summaries keep, how to test a pipeline and why redacting first is safer.
Do California employees' CCPA rights reach Slack and email archives?
CCPA employee data requests can reach Slack and email archives. Which rights apply, which exceptions to check, and what to settle before licensing records.
Do privacy obligations survive when a company closes?
Privacy obligations after company dissolution stay with the records. See the three lawful paths for closed-company data and what to check before acting.
Do state privacy laws apply to my company? Thresholds explained
State privacy law thresholds explained: revenue, consumer-count and data-sale tests, who counts as a consumer, and a three-question self-check for companies.