Private equity and portfolios
Privacy program baseline across a portfolio before any data license
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
A privacy program baseline across a portfolio checks five things at each operating company before a data license is scoped: privacy notices, a data map, vendor data processing terms, retention schedules and a rights-request process. The decision rule: a company with no data map for the candidate records, or notices that rule out new uses, fixes those first.
Key takeaways
- Baseline each operating company separately, because notices, vendors and retention practices differ even inside one group.
- A data map for the specific record families in scope matters more than a group-wide privacy policy.
- Notices and customer terms that limit use to delivering the service are the most common blocking gap.
- Informal rights-request handling and unenforced retention schedules slow a license but rarely stop one on their own.
- The baseline feeds the privacy record that any data license will later have to show.
What does a privacy baseline check at each company?#
A privacy baseline checks whether an operating company knows what personal data it holds, what it told people about that data, and whether daily practice matches those promises. For a sponsor or holdco general counsel, the goal is not a full audit; it is a consistent snapshot showing which companies can support a data license and which need work first.
Run the same five checks at every company so results can be compared side by side. Ask the company's privacy lead, controller or IT manager for documents rather than descriptions, because a policy someone remembers is not the same as a policy that was published and followed.
- Privacy notices: website, customer-facing and employee notices currently in force, with the date each version took effect.
- Data map: which systems hold personal data, which record families sit in each system, and who can access them.
- Vendor terms: data processing agreements and SaaS terms for the help desk, CRM, email, ERP and field service tools.
- Retention: the written schedule, the automated deletion rules actually configured, and any legal holds in place.
- Rights requests: how access, deletion and opt-out requests arrive, who answers them, and where the log lives.
Why run the baseline before scoping a license?#
The baseline comes first because a data license is a new use of records collected to run the business, and every later step depends on knowing what was promised when they were collected. Rights review, privacy preparation and supplier approval all draw on the same facts.
Finding a gap late costs time and goodwill. A company that has already built an inventory and pulled sample exports does not want to learn at approval that its customer terms limit data use to delivering the service. A baseline surfaces that in the first conversation, when the fix is simply a narrower scope.
The baseline also protects the sponsor. When a company is later sold or refinanced, buyers and lenders ask how personal data was handled, and a dated baseline is a cleaner answer than a reconstruction from memory.
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
The baseline checklist, item by item#
The baseline checklist turns the five checks, plus customer contracts and incident history, into evidence a reviewer can verify. Each row names what to collect and the specific gap that would hold up a license.
| Item | Evidence to collect | Gap that holds up a license |
|---|---|---|
| Privacy notices | Current and prior versions with effective dates | Notice says data is used only to provide the service, or is silent on new uses |
| Data map | System list with record families, data subjects and owners | No map for the systems that hold the candidate records |
| Vendor terms | Signed DPAs and current SaaS terms for core tools | Terms restrict bulk export or use of exported data |
| Retention | Written schedule plus configured deletion rules | Candidate records already deleted, or deletion jobs still running on them |
| Rights requests | Intake channel, request log and response templates | Deletions honored in one system but not in its archives |
| Customer contracts | Standard terms and negotiated data clauses | Clauses that make customer records confidential or customer property |
| Incidents | Breach log and any regulator or customer inquiries | Open inquiry touching the same records |
Which gaps block a license and which only slow it?#
Gaps that block a license change what the company may do with the records; gaps that slow a license change how much preparation is needed. Sorting findings this way keeps a portfolio program moving instead of stalling on every imperfection.
| Finding | Usual effect | Typical response |
|---|---|---|
| Notice or contract limits use to delivering the service | Blocks those records | Narrow scope to company-owned internal records, or plan changes with counsel |
| No data map for candidate systems | Blocks until mapped | Map the systems in scope, not the whole company |
| Vendor terms restrict export | Blocks that system | Review the terms, ask the vendor, or scope other systems |
| Retention schedule exists but is not enforced | Slows | Document actual practice and align before preparation |
| Rights requests handled by email with no log | Slows | Start a log and confirm deletions reach archives |
| Records dominated by health, financial or children's data | Often blocks | Exclude from scope rather than prepare |
Which privacy laws may apply across a mixed portfolio?#
The privacy laws that may apply differ by company, depending on where its customers and employees live, what personal data it holds and what industry it works in. A group with a software company, a trades business and a distributor can face very different obligations even though all three are US companies.
State consumer privacy laws such as the CCPA may apply to some companies and not others, depending on thresholds and the residents involved. GDPR may apply where a company holds personal data of people in the EU, for example a software business with European customers. Employee records, call recordings and sector rules raise their own questions, and all of this is assessed deal by deal with counsel rather than settled once for the group.
Some buyers of licensed data ask for these facts in structured form. The Data & Trust Alliance's Data Provenance Standards, for example, include Use elements for confidentiality classification, consent documentation location, privacy-enhancing technologies applied and license to use, so a baseline that records these facts per company carries straight into a license file.
Illustrative: baselining a four-company services group#
Illustrative: a fictional holding group owns a vertical software company running Zendesk and Jira, an HVAC contractor on ServiceTitan, a civil engineering firm on Deltek, and a staffing agency on Bullhorn. The holdco general counsel sends the same baseline request to all four presidents.
The software company has current notices, signed DPAs and a data map, but its customer agreement treats customer content as confidential, so only internal engineering and support workflow records stay in scope. The HVAC contractor has a short website notice and no data map; mapping ServiceTitan and the shared office inbox is a contained task for its office manager.
The engineering firm's project records are largely client deliverables, so its baseline raises a rights question rather than a privacy one. The staffing agency's records center on candidate personal data and are parked. The group fixes the HVAC data map and starts with the software company's internal records.
How SourceX uses a privacy baseline#
SourceX uses a portfolio privacy baseline as the starting point for the Rights and Preparation steps of the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery. The fit check itself collects metadata only, so no personal data is shared while a company is being assessed.
For each package that proceeds, baseline findings feed the privacy record in the SourceX Evidence Packet, alongside provenance, licensing rights, permitted use and release authorization. Personal and confidential details are removed during preparation, and the supplier approves every step before anything is delivered.
Frequently asked questions
Who should own the baseline, the holdco or each company?
The holdco general counsel should own the template and the comparison, while each operating company owns its answers and fixes. Companies know their own systems and vendors; the holdco sees patterns across the group, such as a shared vendor whose terms affect several companies at once. Keep the evidence with the entity that would sign any license.
Do we need outside counsel to run the baseline?
Not always for collection. An in-house lawyer or compliance lead can gather notices, contracts and logs. Outside counsel is usually brought in to interpret what those documents allow, particularly notices that are silent on new uses, cross-border personal data, and any company holding sensitive categories of personal data.
Does de-identification make the baseline unnecessary?
No. Removing personal details reduces privacy burden, but the baseline answers a different question: what the company promised and what it is permitted to do. A contract that makes records confidential still applies after names are removed, and the de-identification itself has to be documented in the privacy record.
How often should the baseline be refreshed?
Refresh it whenever something material changes: a new privacy notice, a system migration, an acquisition, a new vendor for a core system, or a regulator or customer inquiry. Before any license is signed, confirm that the company's baseline still reflects its current notices, contracts and retention settings.
What about companies acquired with outdated notices?
Record which notice was in force when the candidate records were collected, not only the current one. Records gathered under an older notice may carry different permissions than recent ones, which can mean scoping a license to a date range or holding back older history until counsel has reviewed it.
Sources
- The Use group of the Data & Trust Alliance Data Provenance Standards includes elements for confidentiality classification, consent documentation location, privacy-enhancing technologies applied, allowed and excluded processing and storage geographies, license to use, intended data use, and copyright, patent and trademark status. Source
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.