Terms for a data or analytics product

A data product is sold on a licence rather than a sale, because data is not property and the supplier's protection lies in copyright, database right, confidentiality and the contract. The terms have to define what the customer may do with the data and for how long, be truthful about where the data comes from and what rights the supplier has to license it, deal with any personal data inside it, say what is and is not warranted about accuracy, and settle what the customer keeps when the subscription ends. I draft those terms for a fixed fee of £995, delivered in five working days.

Who this is for

Businesses in England and Wales selling datasets, data feeds, market intelligence, benchmarking, enrichment or analytics products to business customers by subscription or one-off licence, whether the data is collected, aggregated, licensed in or generated by the supplier.

What matters in data product terms

The licence to the data and its limits

The terms should grant the customer a non-exclusive, non-transferable licence to use the data for its internal business purposes, for stated use cases, for the number of users and the period stated, and should prohibit resale, redistribution, publication, use to build a competing product, and use in ways the supplier's own sources forbid. The licence should say whether the customer may combine the data with its own and share results with its clients, because that is what analytics customers do, and a licence that is silent is read in the customer's favour.

Sources, rights and what the supplier can license

The supplier's data is protected as a compilation by copyright under the Copyright, Designs and Patents Act 1988 where selection and arrangement involve the author's intellectual creation, and by database right under the Copyright and Rights in Databases Regulations 1997 where substantial investment went into obtaining, verifying or presenting it; data licensed in from third parties is subject to their terms. The terms should warrant that the supplier has the right to grant the licence, flow down third-party restrictions, and reserve the supplier's rights, with an IP indemnity limited to the supplier's own data and excluding the customer's combinations.

Personal data within the dataset

Where the data includes information about individuals, the supplier is a controller for its own processing and the customer becomes a controller when it receives the data, each responsible for its own compliance under the UK GDPR, and the supplier must have provided the transparency information to individuals that Article 14 requires for data not obtained from them, which for large third-party datasets is the compliance question regulators ask. The terms should allocate the controller roles, warrant the supplier's lawful basis, require the customer to use the data only for purposes compatible with it, and address marketing use under the Privacy and Electronic Communications (EC Directive) Regulations 2003.

Accuracy and what is not warranted

Data is collected, estimated and modelled, and the terms should say that the supplier will use reasonable care and skill under section 13 of the Supply of Goods and Services Act 1982 in compiling it and correct errors notified, but does not warrant that the data is complete, accurate or fit for any particular decision, that the customer is responsible for decisions taken on it, and that the data is not advice. Against a business those exclusions are tested for reasonableness under section 3 of the Unfair Contract Terms Act 1977, and a defined methodology statement does more to make them reasonable than a longer disclaimer.

Derived data, outputs and redistribution

The terms should define derived data (analyses, models, reports the customer creates using the data), say that the customer owns its derived data provided it does not substantially reproduce the licensed data or allow it to be reconstructed, and set the rules for sharing outputs with the customer's own clients: aggregated, not extractable, with attribution where the supplier wants it. A customer that can hand its clients the dataset under the name of a report has been given a distribution licence, and the terms should say whether that was intended.

Fees, termination and what the customer keeps

The terms should state the fees, renewal and interest under the Late Payment of Commercial Debts (Interest) Act 1998, the supplier's right to suspend for breach of the licence, and what happens on termination: access ends, the customer deletes the data except derived data and copies retained by law, and the licence to outputs already delivered to the customer's clients survives. The supplier's liability should be capped at the fees paid, with consequential loss excluded, and the supplier's audit right over the customer's use stated, because licence breaches in data products are discovered by looking.

What it costs

SaaS terms of service, £995. Your standard customer-facing terms. Five working days.

Buying online forms the engagement on payment. The scope is what the saas and technology contracts page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A bespoke contract drafted for how your product is sold, delivered and supported
• Service levels you can meet, with remedies that are proportionate rather than aspirational
• A liability position that is defensible and will survive enterprise procurement
• IP and data provisions that fit together rather than contradicting each other
• A commercial note on where you will get pushback and what is worth conceding
• One round of amendments

What is not included

• Negotiating individual enterprise deals, which I quote separately
• Advice on the law of jurisdictions outside England and Wales
• Technical security certification or audit
• Regulatory advice for regulated sectors such as financial services or health

Questions I am often asked

A customer built a model on our data and wants to sell it. Can they?

If the terms say the customer owns derived data that does not reproduce the licensed data, yes, as long as the model does not allow the data to be reconstructed. The terms draw that line rather than leaving it to the customer's view of it.

Our dataset includes business contact details. Do the data protection rules apply?

Yes: business contacts are individuals. The supplier needs a lawful basis and the transparency the rules require, the customer becomes a controller on receipt, and marketing use has its own rules. The terms allocate all of that.

Can we exclude liability for errors in the data?

You can limit it: reasonable care in compilation, correction of notified errors, and no warranty of completeness or fitness for a decision. A stated methodology makes the limitation reasonable; a blanket 'no liability' does not.

Related guidance and services

• SaaS and technology contracts, £995, the service this page describes
• Data protection agreements and privacy terms, £795
• Contract review, £495
• Reviewing a data licence agreement
• API terms of use

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: September 2026. Email geoffrey@caesar.co.uk.