Map the processing, not just the file
Describe how the records were collected, who they concern, why they were originally processed and what the buyer intends to do. Include evaluation samples, human inspection, model development, storage and onward access. Ask counsel to identify the relevant roles and obligations at each stage.
An agreement between organisations does not by itself establish a lawful basis for processing personal data. Likewise, copyright permission does not settle privacy. Keep those questions separate in the rights register.
Do not assume anonymity
The EDPB’s 2024 opinion on AI models addresses anonymity, legitimate interests and the effects of unlawfully processed training data. It does not declare every trained model anonymous or every commercial AI use justified by legitimate interests.
For a proposed licence, document the original data, transformations, remaining identifiers and realistic linking risks. Ask the appropriate specialists how the analysis changes for the sample, full dataset and resulting uses. A browser pattern-replacement demo cannot establish compliance.
Prepare the evidence for reviewers
Provide data categories, source notices, retention rules, contracts, proposed recipients, locations, security controls and any exclusion process. If relying on a legal basis or compatibility assessment, make its reasoning and scope explicit rather than using a checkbox that simply says GDPR compliant.
Ask about transparency, individual rights, special-category information, impact assessments, processors and international transfers where relevant. The answer can depend on the facts, so record both conclusions and conditions.
Carry requirements into delivery
Translate the review into concrete restrictions: which files are excluded, which recipient may receive them, which uses are permitted, how long evaluation copies remain, and who handles incidents or requests. Verify the final transfer against that approved scope.
Keep legal advice and confidential contracts outside the public datasheet, but include a clear statement of unresolved issues for the transaction team. Re-review when the buyer, use, collection route or processing location changes. This guide is a professional-review agenda, not a legal determination.