Database rights audit: what the decision maker looks at
A database rights audit tells a decision maker whether a data set is safe to buy, licence, or fund. The reviewer checks who paid for collecting and verifying the records, how the data was extracted, and whether any part came from a third party under separate terms. A second, quieter question runs alongside it: does the structure built around the data — the categories, the tagging, the search logic — carry its own protection. The output is a short opinion, not a certificate. It lists the gaps that remain open rather than closing them by assumption.
What the review actually establishes
Protection over a data set normally attaches to whoever made the substantial investment in obtaining, verifying, or presenting its contents. Investment of time, money, or staff effort matters more than the size of the file or the number of rows. A party that copied records from someone else's work, without adding its own verification or organisation, holds nothing worth selling or licensing on that basis alone.
A separate question is the arrangement of the data — the structure, the categories, and the retrieval logic built around it. Where that structure shows genuine creative choice, it can carry its own layer of protection on top of any right in the raw contents. A reviewer treats the two questions independently and never assumes one answer settles both.
Geography adds a third layer. The investment-based right typically applies across the single market for data sets that meet the investment test, while any protection over the arrangement follows ordinary authorship rules that can differ slightly by jurisdiction. A decision maker operating across several countries should expect the reviewer to flag that split rather than collapse it into one line.
Practical consequence for the deal
The audit result shapes three things: the warranties the seller is asked to give, the price adjustment mechanism, and the closing timeline. A clean file with full extraction records shortens the review. A file with mixed sources, undocumented scraping, or unverified third-party feeds extends it and usually adds a specific indemnity clause tied to the unresolved item.
Where the review shows that data collection work has quietly expanded beyond the original brief, treat it the same way a buyer would treat Professional services drift out of scope technology contract the — flag the drift in writing before the next delivery compounds it.
Findings also feed directly into contract drafting. A gap in the extraction log becomes a specific warranty carve-out rather than a general disclaimer. A confirmed third-party licence becomes a scheduled document, not a footnote. Vague findings produce vague contract language, and vague contract language is what later disputes are built on.
What to do
- The target company or counterparty assembles the extraction log: dates, sources, and the method used to pull each record.
- In-house legal maps every third-party feed against its licence or contract terms, noting what use each licence actually permits.
- External reviewing counsel checks whether investment evidence — invoices, timesheets, verification records, quality-control logs — supports a claim over the contents.
- The reviewer interviews the person who built or maintains the data pipeline, not only the person who commissioned it; operational detail rarely survives in written policy alone.
- Findings go into a short memo: what is confirmed, what is assumed, and what remains unverifiable before signing.
- The commercial sponsor reviews the memo and decides whether to proceed, adjust price, or walk away.
The attestation logic behind How reserve evidence and attestation token issuance runs in practice follows the same order: paper trail first, assertion second. A database audit that skips the paper trail produces an opinion nobody should rely on.
Who decides, and on what timing
| Stage | Who is responsible | Typical output |
|---|---|---|
| Document request | Target or counterparty | Extraction log, source list, contracts with data providers |
| Technical review | Reviewing counsel with a technical adviser | Gap list, risk flags by source |
| Investment evidence check | Reviewing counsel | Confirmation or rejection of a substantial-investment claim |
| Findings memo | Reviewing counsel | Short written opinion with open items ranked by risk |
| Go/no-go decision | Commercial sponsor or board | Approval, price adjustment, or withdrawal |
The review itself usually runs between one and three weeks, depending on how many separate sources feed into the data set and how quickly the other side produces records. A single well-documented source can close in days. A data set stitched together from a dozen scraped feeds rarely does, because each feed needs its own paper trail before the memo can be written.
Where the answer forks
If the extraction log is missing entirely, the reviewer cannot confirm who invested in the collection, and the file stays marked unverified until records surface.
If part of the data set came from a third-party licence, the reviewer checks whether that licence covers the intended use — resale, model training, or redistribution — separately from the ownership question itself.
If the data set mixes internally generated records with publicly scraped content, the memo splits the two and prices the risk differently for each part rather than averaging them into one figure.
If the other side has already litigated a similar claim over the same data, the audit notes the outcome but does not repeat the litigation; that sits outside this procedure entirely.
What this review does not decide
The audit does not certify that the data set is free of infringement claims from parties outside the transaction. It does not resolve a dispute that is already active between named parties. It does not replace a formal registration step where one applies in a specific jurisdiction. It produces a working opinion for the decision in front of the sponsor, not a guarantee that survives every future challenge to the same data.
Sources and limit
This page describes audit practice and decision points. It does not cite specific statutory provisions, because verifying a national implementing text for every reader's jurisdiction sits outside what a procedural guide can confirm on its own. Where the underlying dispute already involves enforcement against a specific counterparty, a decision maker often needs a parallel check outside database law — for instance Asset in Czechia: what can be established before deciding whether litigation is worth starting at all.
The same logic applies to counterparties based in Ireland, where Debtor in Ireland explained sets out what a status report can confirm before proceedings begin.
Last reviewed by the author. No article or regulation numbers appear on this page; substantive references belong to the underlying pages elsewhere in this section, where national implementation is tracked directly.
Related publications
See also: Provenance review of a training data set: what the decision maker looks at when the data set was assembled for model training rather than for resale.
FAQ
How long does a database rights audit take in practice?
Most reviews close in one to three weeks. The main variable is how many separate sources feed the data set and how fast the other side produces extraction records.
Which documents are needed to start?
An extraction log, the list of data sources, any contracts with third-party providers, and evidence of the investment made in collecting or verifying the records — invoices, timesheets, or internal project records.
What happens if the other side does not respond?
The reviewer treats the missing records as unverified and states that plainly in the memo. The deal can still proceed, but usually with a wider indemnity or a price adjustment tied to the unresolved item.