WHERE IT PHYSICALLY GOES
The question your data protection officer will ask first
Firms outside the US, and plenty inside it, have obligations about where data may be held and transferred. Those are real constraints, and they are handled the same way every other constraint is — through scope, settled before anything moves.
THE ORDER OF OPERATIONS
Nothing crosses a border before the terms say it may
-
01
Establish what exists
Six questions about the systems in use. No access, no transfer, no obligation at this stage.
-
02
Constraints define scope
What you cannot lawfully license or transfer stays outside the licence, settled before signature.
-
03
Preparation and anonymization
Identifying fields are stripped as part of preparing the data, before any onward sharing.
-
04
Your approval, then payment
Typically $100K to $2M, Net 30 to 60 from approval of the prepared data.
THE RESIDENCY QUESTIONS
What data protection functions ask
Can you guarantee the data stays in our jurisdiction?
That is a terms question rather than a slogan, and it should be answered specifically in the licence. Put it to us on the first call before anything else.
Who is the controller and who is the processor?
A determination for your own counsel against your framework. The licence defines what may be done with defined material; how that maps to your regime is yours to assess.
What if only some material can be transferred?
Then the rest is out of scope. A narrower licence still produces a real number, priced on what is in it.
Should we involve counsel before the call?
Not necessarily. The first call establishes whether a deal exists at all, and costs nothing either way.
SPEAK WITH A MANAGING PARTNER
Put the jurisdiction question first, not last
Six questions, about two minutes, and specific answers rather than reassurance.
Check your data