Check data rights before sharing
Map who created the records, who can authorize their use and which promises or restrictions apply. Keep unresolved material out of samples until the right adviser has reviewed it.
On this page
Start with a rights map
Check data rights for each group of records you might offer. Privately record who created the material, how your company received it and which document supports the proposed use. Separate company-created work, client material, licensed content and records supplied by individuals.
Put a named internal reviewer beside each unresolved item. Someone who can export a file may not be the person authorized to approve a license. If a company has closed or changed ownership, ask the responsible adviser who can act for the rights holder now.
This is a preparation checklist. It does not determine ownership, permission or the law that applies to your records.
Check employment, contractor and client documents
Gather the relevant employment agreements, contractor assignments, client contracts and content licenses. Ask your adviser to check the actual rights and restrictions for the proposed AI use. Record missing documents as unresolved, and separate that material from any proposed sample.
For U.S. copyright, the Copyright Office describes two work-made-for-hire routes: work created by an employee within employment duties, and certain commissioned work meeting written-agreement requirements. Do not assume every paid contractor's work falls into those categories. Copyright Office Circular 30, Works Made for Hire, revised August 2024, checked November 8, 2026.
For media, inspect the rights to footage, music, images and other included material separately. For code, ask the reviewer to consider client contributions and third-party licenses as well as the company's own work. For a mixed archive, list what can be included and what must stay out.
Review privacy promises separately
Collect privacy notices, consent records, confidentiality terms and customer agreements that relate to the records. Ask whether the proposed recipient, purpose and sharing process fit those commitments. Ask which jurisdictions and sector rules need review.
Defined.ai's partnership page asks for consent, documentation and rights to commercialize data for AI training. Protege's Provider Terms place rights, consents and approval representations on the provider. A program's willingness to discuss a dataset does not answer these questions for you. Defined.ai partnership programs and Protege Provider Terms, checked November 8, 2026.
Keep passwords, access tokens and account credentials out of samples. Ask a qualified reviewer how to handle personal or confidential material before sharing it, including material inside attachments and free-text fields.
Ask what de-identification covers
Ask who performs de-identification, what method they use and who reviews the result. Ask about remaining identification risk and controls on later use. Removing obvious names is only one part of the question.
For health information covered by the U.S. HIPAA Privacy Rule, HHS describes two de-identification methods: Expert Determination and Safe Harbor. HHS also says properly de-identified data retains some identification risk. These methods have specific conditions; a general claim that data is anonymous does not establish that either method was followed. HHS de-identification guidance, checked November 8, 2026.
If health, children's, financial or other sensitive records are involved, pause the sharing step and ask the relevant adviser to assess them. This guide does not extend HIPAA's methods to every type of data or jurisdiction.
Keep a decision record
| Record group | Documents to find | Decision to record |
|---|---|---|
| Company work | Creation history and employment or assignment documents | Who can authorize the proposed use? |
| Client or licensed material | Contract, license and permitted-use terms | Include, exclude or seek permission? |
| Personal information | Notices, consents and privacy review | What processing and sharing are allowed? |
| Proposed sample | Written evaluation and access terms | Who receives it, for what purpose and until when? |
Store the decision, reviewer and date with your data summary. Share a description first while unresolved records stay excluded. Use the licensing terms checklist when a proposal arrives. The qualification tool can help organize program fit; it cannot clear your rights.
Check source-code components separately from media rights. Then read the exclusivity and onward-licensing questions against the actual proposed agreement.
Sources and limitations
Circular 30: Works Made for Hire Checked 2026-11-08
U.S. Copyright Office · Primary source
When it is created by an employee as part of the employee’s regular duties
U.S. copyright guidance only; work-for-hire status depends on the actual facts and applicable requirements. This does not determine rights in a visitor’s records.
Guidance Regarding Methods for De-identification of Protected Health Information Checked 2026-11-08
U.S. Department of Health and Human Services · Primary source
Both methods, even when properly applied, yield de-identified data that retains some risk of identification.
Applies to the HIPAA Privacy Rule, not every dataset or jurisdiction. Publication date not established.
Partnership Programs | Defined.ai Checked 2026-11-08
Defined.ai · Primary source
proper consent, documentation, and the right to commercialize the data for AI training
The program states these requirements; they do not establish permission for a particular dataset. Publication date not established.
Provider Terms - Protege Checked 2026-11-08
Protege · Primary source
all necessary licenses, registrations, rights, consents and approvals
These are Provider representations under the applicable agreement, not a finding about a visitor’s rights. Publication date not established.