Skip to content

Rights and contracts

Data ownership clause examples for service contracts

By SourceX Editorial · Reviewed by Noah Loul ·

Short answer

A data ownership clause in a service contract decides who owns client data, the provider's operating records and anything derived from them. The three common positions are provider-favorable, balanced and client-favorable, and the definitions of Client Data, Provider Records and Aggregated Data usually matter more than the ownership sentence. New clauses should name AI training expressly.

Key takeaways

  • Definitions decide data ownership more often than the ownership sentence itself does.
  • Service providers usually hold their strongest rights in their own operating records, such as schedules, timesheets and internal reviews.
  • Copyright in deliverables does not pass to a client just because the client paid; it usually needs an express assignment.
  • A balanced clause gives the client its data and the provider its records, with a narrow, de-identified reuse right.
  • Clauses drafted now should state whether AI training and third-party licensing are allowed.

What a data ownership clause does in a service contract#

A data ownership clause in a service contract allocates rights in three kinds of information: data the client provides, records the provider creates while doing the work, and deliverables made for the client. Without one, ownership falls back on general law and the rest of the contract, which often leaves the provider's operating records undefined.

Copyright rules show why the clause matters. Under US work made for hire rules, a commissioned work belongs to the commissioning party only if it falls into specific statutory categories and the parties agree in a signed writing. Many consulting and engineering deliverables fall outside those categories, so client ownership usually depends on an express assignment.

Some industries start from provider ownership. Standard owner-engineer agreements such as the EJCDC E-500 treat the engineer's documents as instruments of service, with the engineer keeping ownership and reuse rights and the owner receiving a limited license to use them for the project.

The definitions that decide the outcome#

The definitions in a service provider data rights clause do most of the work. The illustrative clauses below all assume these terms, and each is a drafting example for discussion with counsel, not recommended language.

The definitions that decide the outcome
Defined termWhat it should coverDrafting note
Client DataInformation the client or its users supply to the providerKeep it to what the client supplies; avoid sweeping in provider work product
Provider RecordsSchedules, timesheets, staffing plans, internal reviews, quality checks, methods and internal correspondenceName the record families; this is where licensing value usually sits
DeliverablesReports, drawings, code or other items prepared for and delivered to the clientState whether assigned, licensed, or kept by the provider with a client license
Aggregated DataInformation combined across clients so no client or person is identifiedDefine the de-identification standard, not just the label
Permitted UseWhat each party may do with the other's informationSay expressly whether AI training or third-party licensing is included
  1. 01Your work records
  2. 02Personal details removed
  3. 03You approve the release
  4. 04Licensed to AI developers
How it works with SourceX: Your work records → Personal details removed → You approve the release → Licensed to AI developers.Illustrative

Provider-favorable data ownership clause example#

A provider-favorable data ownership provision keeps everything except the client's own inputs with the provider and gives the provider wide reuse rights.

Illustrative clause: Client retains ownership of Client Data. Provider owns all Provider Records and all methods, know-how, tools and templates used or developed in performing the Services, and retains ownership of Deliverables subject to a non-exclusive license to Client to use them for the Project. Client grants Provider a perpetual license to use Client Data in de-identified or aggregated form for any purpose, including developing, training and licensing analytical and artificial intelligence tools, provided no Client or individual is identified.

Clients who read closely often push back on the perpetual reuse license and on retained deliverables, so this form tends to survive only in standard terms that clients accept without negotiation.

Balanced data ownership clause example#

A balanced clause gives each side what it naturally creates and allows narrow, documented reuse.

Illustrative clause: Client owns Client Data and, upon full payment, the Deliverables, excluding Provider's pre-existing materials and general know-how, which Provider retains and licenses to Client as needed to use the Deliverables. Provider owns Provider Records. Provider may use Client Data only to perform the Services, except that Provider may create and use Aggregated Data that does not identify Client, its personnel or its customers, including to improve Provider's services and to license to third parties under written confidentiality and use restrictions, provided Client's Confidential Information is not disclosed.

The balanced form is often the easiest to sign and the clearest to rely on later, because it names the records the provider keeps and spells out the reuse right in plain terms.

Client-favorable data ownership clause example#

A client-favorable client data clause treats everything that touches the engagement as the client's and bars reuse.

Illustrative clause: All Client Data, Deliverables and other information created, collected or derived by Provider in performing the Services, including Provider Records to the extent they contain or are derived from Client Data, are owned by Client. Provider shall not use such information for any purpose other than performing the Services, and shall not use it to develop, train or improve any artificial intelligence or machine learning model, whether or not de-identified or aggregated. On termination Provider shall return or destroy all such information.

Under this form, a provider's schedules and internal reviews for the engagement may be off-limits for licensing, which is why the derived from language deserves careful review before signing.

How the three positions compare#

The comparison below shows where the positions differ. Most negotiations end somewhere between the balanced and client-favorable columns, so the drafting checklist that follows focuses on the points that survive negotiation.

  • Name the provider's record families instead of relying on a general reference to work product.
  • Define de-identified and aggregated by a standard, not just a label.
  • State in those words whether AI training and third-party licensing are allowed.
  • Say whether reuse rights survive termination and how they interact with return-or-destroy duties.
  • Align the clause with the confidentiality section and any data processing agreement.
  • Keep dated copies of every signed form, because old contracts govern old records.
How the three positions compare
QuestionProvider-favorableBalancedClient-favorable
Who owns client inputs?ClientClientClient
Who owns provider operating records?ProviderProviderClient, where derived from client data
Who owns deliverables?Provider, with a client licenseClient after payment, minus pre-existing materialsClient
Reuse of de-identified data?Broad and perpetualAggregated only, with restrictionsProhibited
AI training or licensing?Expressly allowedAllowed for aggregated data under restrictionsExpressly prohibited

Illustrative: an engineering firm sorts projects by contract form#

Illustrative: a fictional civil engineering firm wants to license years of internal design review notes, RFI logs and project schedules kept in Deltek and Bluebeam. Its projects ran under its own standard agreement, a professional association form and a stack of client-drafted contracts.

The firm sorts projects by contract form. Projects under its own agreement and the association form, both of which keep instruments of service with the engineer, move into scope with client names and project addresses removed. Projects under client paper with derived-from ownership language are excluded. For new work, the firm adopts a balanced clause that names Provider Records and states whether aggregated data may be licensed.

How SourceX uses data ownership clauses#

SourceX reads data ownership clauses during the Rights step of the SourceX five-step transaction, sorting records by the contract form that governed them. The initial fit check asks only which forms exist and which years they cover.

The forms relied on and the projects excluded are recorded in the SourceX Evidence Packet under licensing rights, so the supplier's approval rests on a written map of its contracts rather than on assumptions about ownership.

Frequently asked questions

Does owning data mean we can license it for AI?

Not automatically. Ownership is necessary but not sufficient: confidentiality clauses, privacy laws, notices and other contract terms can still limit use. A provider can own its schedules and still need to remove client names and confidential details before licensing them.

Can a new clause apply to records from old projects?

Generally the contract in force when records were created governs them, unless the client agrees to an amendment. A new clause helps with future records. For older ones, sort by contract form and consider asking specific clients for written consent where the records are especially valuable.

Who owns timesheets, staffing plans and internal reviews?

Usually the provider, because they record how it ran its own business. A client-favorable clause can change that if it claims anything derived from client data. Read the derived-from wording carefully, since internal reviews often quote client information.

Should AI be named expressly in the clause?

Yes. Silence leaves room for both sides to argue about whether training or licensing was within the parties' expectations. Saying expressly whether AI training and third-party licensing are allowed, and under what de-identification standard, removes the argument.

What about records created by subcontractors?

Subcontractor records may belong to the subcontractor under its own agreement, and flow-down clauses decide whether the prime provider receives rights in them. Check subcontracts before including subcontractor-created records in any license.

Sources

  • 17 U.S.C. 101 treats a specially ordered or commissioned work as a work made for hire only if it falls within listed categories and the parties expressly agree in a signed written instrument. Source
  • EJCDC E-500 Owner-Engineer agreement language states that all Documents are instruments of service and the Engineer retains an ownership and property interest in them, including copyright and the right of reuse. Source
  • EJCDC E-500 excerpts grant the Owner a limited license to use the Documents on the Project and related uses, subject to the Engineer's receipt of full payment. Source

Related resources

See if your company qualifies

A short company assessment. No data uploads are needed.

See if your company qualifies