Insights
Privacy and preparation
138 guides · page 2 of 3
Do you need SOC 2 to license your company's data?
A SOC 2 report is rarely required to license data. See what buyers check instead, when a report helps, and how SOC 2 compares with ISO 27001.
Do you need to redact the audio, or only the transcript?
Redact audio recordings PII only when a buyer needs audio; otherwise license transcripts. A decision rule, plus what muting spans and voice identity involve.
Does de-identification reduce the value of business data?
De-identification rarely cuts the value of business records, because AI buyers license workflows and outcomes. What does cut value, and how to avoid it.
Does licensing your company's data make you a data broker?
Am I a data broker if I license company data? Broker laws target data on people you have no direct relationship with. Check the edge cases that matter.
Does your employee privacy notice need to mention AI training or data licensing?
If employee personal information will be used for AI training or data licensing, your notice should say so. See what to add, when, and sample wording.
DOJ bulk data rule: licensing data to foreign buyers
The DOJ bulk sensitive data rule can apply when US companies license data abroad. Deal structures to check, bulk thresholds and the licensee terms to add.
Email signatures, disclaimers and quoted replies: hidden PII in email archives
Remove email signatures, quoted replies, forwarded headers and invites before licensing an email archive. A checklist of each artifact and how to strip it.
Encryption safe harbor in state breach laws: why encrypted delivery matters
Encryption safe harbor in breach notification laws, explained for IT leads: when encrypted data is exempt, why key compromise matters and how to ship data.
Excluding customers who opted out of sale or sharing
Opt-outs of sale still apply when you license historical data. Gather opt-outs, including Global Privacy Control logs, match them and exclude in order.
Finding shadow data: old exports, shared drives and personal mailboxes
Shadow data hides in old system exports, shared drives and personal mailboxes. Where to look, how to decide what to keep, and a two-pass discovery plan.
Former employees in archived records: notice, deletion and access requests
Former employee data privacy before licensing an archive: find departed staff, honor access and deletion requests, and pseudonymize each person consistently.
Free-text notes in CRM records: what sales and success notes reveal
CRM notes privacy goes beyond fields. The sensitive patterns in sales and success notes, from health mentions to personal phones, and how to scan for them.
FTC algorithmic disgorgement: what it means for data you license
Algorithmic disgorgement lets the FTC order deletion of models built on improperly obtained data. See why buyers want provenance warranties and what to keep.
Gate codes, alarm codes and lockbox numbers in service notes
Gate codes in service notes, alarm codes and lockbox numbers are a physical security risk. Detection patterns and an always-remove rule for job records.
Git commit author names and emails: personal data in code history
Git commit emails are personal data. Compare mailmap pseudonymization with a history rewrite, and keep authorship patterns intact with consistent IDs.
Hashed emails and IDs: why hashing is not anonymization
Is hashed data anonymous? No. Hashed emails and IDs stay linkable and can be matched back. What to use instead before licensing your company's records.
Health details in HR and leave records: what to exclude before licensing
Employee medical information confidentiality before licensing: which HR and leave records to exclude, and where health details leak into daily work records.
Homeowner names and addresses in field service records
Customer address privacy for home service companies: how to treat homeowner names, addresses, phones and notes while keeping equipment and job details intact.
Honoring past deletion requests before licensing an archive
Honor deletion requests in archived data before licensing: a four-step suppression process for request logs, matching, removal and the privacy record.
How accurate is automated PII redaction on real business text?
How accurate is PII redaction on support tickets, emails and job notes? Which identifiers tools catch, which they miss, and how to measure recall yourself.
How to redact personal data in an M&A data room
How to redact personal data in an M&A data room: what to remove from employee and customer files, clean-team rules, staged disclosure and common mistakes.
How to remove hidden metadata from Office documents and PDFs
Remove metadata from Word documents and PDFs: what hides in author fields, tracked changes and attachments, and how to clean single files and whole archives.
How to scan code repositories for secrets before sharing them
How to scan a repository for secrets before sharing it: cover every branch and the full history, compare gitleaks and TruffleHog, triage, rotate and rescan.
How to test whether a de-identified dataset can be re-identified
A re-identification risk assessment for company datasets: pick a sample, attempt linkage, score the results, fix weak fields and document what you tested.
How to transfer terabytes of data securely
Four ways to transfer large data securely to a buyer: network push, seller-hosted storage, cloud copy and encrypted drives, and the controls each one needs.
How to verify that a buyer deleted your data
How to verify data deletion by a third party: attestations, certificates of destruction, audit rights and key destruction, and when each is enough.
HubSpot sensitive data settings and exports: what to scrub
HubSpot sensitive data turns up in contacts, notes, logged emails and custom properties. What exports carry, which CRM records suit licensing, what to scrub.
Human review vs automated redaction: how to split the work
A human review redaction workflow for business records: what to automate, which records go to reviewers, how to sample-check output, and who signs off.
Injury reports, OSHA logs and workers' comp notes in operations records
OSHA 300 log privacy for manufacturers: which injury, incident and workers' comp records to exclude, which to transform, and what safety signal to keep.
Internal hostnames, IP ranges and log files in engineering records
How to sanitize log files and tickets before licensing: patterns to find, from hostnames to connection strings, and placeholders that keep incidents readable.
Is a business email address personal information?
Is a business email address personal data? Named work emails usually are; role inboxes usually aren't. A table by address type and how to treat each one.
Is driver telematics and GPS data sensitive personal information?
Is GPS data sensitive personal information? For fleets, often yes. See which telematics fields identify drivers and how to coarsen, aggregate or drop them.
Is HIPAA Safe Harbor a useful benchmark for non-health business records?
Safe Harbor de-identification is not required outside healthcare, but its 18 identifiers make a practical floor. See where each one hides in business records.
Is leaked de-identified data a reportable breach?
Is de-identified data subject to breach notification? How state breach laws define personal information, where pseudonymized records fall, and what to check.
Is licensing de-identified data a sale under state privacy laws?
Is licensing data a sale under CCPA and other state laws? Licensing personal information usually is; properly de-identified data usually is not. Edge cases.
Is Microsoft Presidio enough to redact PII before sharing data?
Presidio is a solid first layer for PII redaction, not a release gate. Its limits, false positives, five add-ons and how it compares with cloud PII tools.
Is pseudonymized data still personal information under the CCPA?
Pseudonymized data under the CCPA usually stays personal information. See why tokens and hashes fall short of deidentified, and what that means for licensing.
Passwords and API keys customers paste into support tickets
Customers paste passwords, API keys and connection strings into support tickets. Learn how to find them, get them rotated and redact them before release.
Personal data hiding in ERP master records
ERP data privacy for distributors: where personal data hides in NetSuite, Epicor and Acumatica customer, vendor, employee and ship-to records, field by field.
PII vs personal information vs personal data: which definition applies to your records?
PII vs personal information vs personal data: where each term comes from, how broad it is, and which one applies to customer, employee and B2B records.
Portfolio privacy screen: checking several companies' records before a data program
A portfolio data privacy assessment for operating partners: score systems, personal data load, notices, incidents and capacity, then tier each company.
Privacy due diligence questions for data assets in an acquisition
A privacy due diligence checklist for acquirers who see data as an asset: provenance, notices, contracts, prior licenses, deletion logs and future licensing.
Privacy enforcement and AI training data, 2025-2026: what matters for data suppliers
What recent privacy enforcement means for companies licensing records for AI training: opt-outs, notices, recipient contracts and new uses of old data.
Privacy promises made by an acquired company: do they still bind legacy data?
An acquired company's privacy policy promises usually follow its legacy data. Find old notices, map them to archives and license only what they allow.
Production data in test fixtures and seed files: personal data in your codebase
Production data in test fixtures, seed files, snapshots and SQL dumps survives in git history. Where it hides and a scan-and-replace plan before code leaves.
Pseudonymization vs anonymization: which does a data license need?
Pseudonymization vs anonymization explained for data licensing: which one is still personal data, what buyers lose, and why keys should stay out of the deal.
Questions to ask a de-identification vendor before handing over records
De-identification vendor questions to ask before sharing records: processing location, retention, subprocessors, accuracy evidence, audit logs and deletion.
Redaction QA sampling: how many records should you review?
Redaction QA sample size made practical: use the rule of three to set how many records to review, sample each record type, and know what to do after a miss.