A data platform that resells a third-party dataset promises its customers rights it holds from someone else. This post sets out the questions to ask before reselling, in the order a platform meets them, each with what a good answer names and the evidence to request. Published texts are reported with their version or date. None of it is legal advice: every point is a question for the vendor or for your counsel.
What a data licence covers sets the uses of a licence side by side, and the entry on the redistribution licence defines the right.
The questions to ask before reselling a third-party dataset on your data platform
Before reselling a third-party dataset, a data platform should ask eight questions: whether the vendor can grant resale, how the data was collected, whether it holds personal data, what the vendor warrants, what may reach customers, what your terms must pass down, how use is reported and audited, and what happens to customers when the upstream agreement ends.
| Question | A good answer names | Evidence to ask for |
|---|---|---|
| 1. Can the vendor grant resale? | Each source, the vendor's right in it, and whether it can be passed on | A schedule of sources by field, with the terms of each |
| 2. How was the data collected? | The kinds of source, anything behind a login, whose terms applied | The sourcing statement, and twenty records traced to origin |
| 3. Does it hold personal data? | The fields about people, how they were obtained, each party's role | A field-level statement and the notices given at collection |
| 4. What does the vendor warrant? | Authority, non-infringement, an indemnity, what reaches your customers | The warranty, indemnity and liability clauses |
| 5. What may reach customers, and how? | Recipients, fields, volume, format, onward transfer | The grant and the restrictions |
| 6. What must your terms pass down? | The restrictions, credits and notices each customer accepts | The minimum terms, as a list |
| 7. How is use reported and audited? | The unit counted, the report date, an audit's frequency, notice and reach | The reporting and audit clauses |
| 8. What happens to customers when the upstream agreement ends? | A wind-down period, what customers keep, who tells them | The termination and survival clauses |
How to evaluate a company data vendor in ten questions tests the data, and these eight test the right to pass it on. The pages linked above treat question 5, so the sections below go to the other seven.
Due diligence for resale of a third-party dataset: data licensing, provenance, privacy rights and contractual restrictions
Due diligence on a third-party dataset for resale follows the rights upstream. Establish what the vendor owns and what it licenses in, how each source was collected and under whose terms, whether any field is personal data, and which contractual restrictions travel with the data. Then check that the warranty and indemnity cover what you were told.
Question 1: the chain of rights
Published texts show how a right upstream can be narrower than the headline grant.
- The Data Subscription Agreement for AWS Marketplace, AWS's optional standard contract for data products on AWS Data Exchange, in a file dated 14 July 2022, says rights in data the provider obtains from a third party may be more limited than the main grant, and binds the subscriber to that third party's terms (sections 1.4 and 2.1).
- CC BY 4.0 limits the licensed rights to those the licensor has authority to license, and, unless the licensor separately undertakes otherwise, offers the material as-is, with no representations or warranties of any kind (sections 1 and 5).
- ODbL 1.0 says individual items of a database's contents may be covered by other rights, including copyright, data protection and privacy rights, which the licence does not cover (section 2.4).
So ask for the chain field by field: data provenance records where a value came from, and the chain of rights adds the terms each source was taken under.
Questions 2 and 3: collection and personal data
On collection, the guide to alternative data due diligence questionnaires works through the questions funds put to vendors.
Where the data relates to people, the UK Information Commissioner's Office lists the checks in its data sharing code of practice, under sharing personal data in databases and lists. The organisation receiving a database or list of individuals is responsible for compliance with the law for the data it receives, the ICO says, and should confirm the source, identify the lawful basis on which the data was obtained, check what individuals were told and verify how and when it was collected. The ICO marks the guidance as under review after the Data (Use and Access) Act.
The California Privacy Protection Agency's information for data brokers, read on 7 October 2026, describes a data broker as a business that knowingly collects and sells to third parties the personal information of a consumer with whom it has no direct relationship. Ask counsel whether resale would bring you within a definition of this kind.
Question 4: what the vendor warrants
The AWS template shows the parts of a warranty package.
| Part | What the template says | Section |
|---|---|---|
| Personal data | The provider warrants that data identifying a natural person has already lawfully been made available to the general public and includes no sensitive personal data | 4.1 |
| Indemnity | The provider covers third-party claims arising, among other grounds, from a failure to hold sufficient legal right to provide the data, or from infringement by the data | 7.1 |
| Remedy | Where the data is held to infringe, the provider procures the right to continue, or modifies or replaces it. Failing that, either party may terminate, with a refund | 7.3 |
| Reach | No rights for anyone but the parties, apart from the indemnified parties of section 7 | 10.8 |
Act on the last row: wording of that kind confers no rights on your customer, so ask counsel to set what you warrant to customers beside what the vendor warrants to you.
A data licensing checklist for redistribution rights to third-party data on a marketplace
On a marketplace, check redistribution rights in the terms of the listing before you subscribe. Read the grant, the restrictions, the third-party terms the offer references and the rule on which document prevails. A standard subscription contract can bar passing the data on, in which case a resale right has to be written in.
In the AWS template, section 2.3 says that, except as the agreement specifically provides, the subscriber may not distribute or provide access of any kind to the data, or any material subset of it, to a third party, may not sell or sublicense it, and may not use it to act as a service bureau or application service provider. Section 1.3 ranks an amendment agreed by the parties above the agreement itself.
For any listing, ask:
- Which contract governs: the marketplace's template, the provider's own terms or a negotiated offer?
- Does the grant name redistribution, or only receipt and use?
- Which third-party terms does the offer reference, and has counsel read each?
- Which document prevails in a conflict, and does your resale right sit in it?
- If you list the resold data yourself, what must a provider state about its rights?
On the fifth, Snowflake's provider and consumer policies, read on 7 October 2026, say a provider must have all the necessary rights to share or sell its products, and must not provide materials in violation of third-party rights, including third-party terms of service. Data marketplace vs direct licensing compares the two routes to a contract.
Serving licensed data to customers via an API without breaching the licence
Serving licensed data through an API of your own usually counts as redistribution, because records reach a customer's system, so the licence has to grant it in words. Staying inside the grant then depends on the API enforcing each term: who may call it, which fields return, how much one customer can take, and what is logged.
| Term in the licence | What the API does | What you keep |
|---|---|---|
| Eligible recipients | Issues one key per customer, once the customer accepts your terms | Key, customer and version of terms |
| Permitted fields | Builds each response from an allow-list | The allow-list, dated |
| Volume | Applies a rate limit per key and a ceiling on distinct records per contract period | Counts per key, per day |
A daily rate limit does not by itself stop a customer rebuilding the dataset: divide the records in the dataset by the records one key may pull in a day, as the example below does.
Data redistribution licence terms for an API and its downstream customers
When an API redistributes licensed data, the terms your downstream customers accept should carry everything the upstream licence asks you to pass on: the permitted use, the bar on onward transfer, the credits, protection of the vendor's rights, audit co-operation and the end-of-term duties. Record which customer accepted which version.
FISD, whose member firms include exchanges, vendors, consultants and consumers of market data, recommends to that industry, in its voluntary best practice recommendation on subscriber agreements, version 1.1 of 14 March 2005 with terms updated in November 2015, that an information provider let a vendor's own subscriber agreement stand in for a direct agreement with each subscriber, provided it protects the provider and its intellectual property to the same degree as the vendor's. Where an information provider still requires a subscriber agreement, it recommends permitting electronic execution, and says the vendor must be able to keep a record of which subscriber executed which version, and when.
Open licences travel differently. Under CC BY 4.0 every recipient automatically receives an offer from the licensor, and you may not impose terms that restrict a recipient's exercise of the licensed rights (section 2(a)(5)). Under ODbL 1.0 you may not sublicense the database: the licensor offers each recipient a licence on the same terms (section 4.8). Ask counsel how your customer terms treat a field held under such a licence.
How a reseller's use is reported and audited
Reporting and audit clauses decide which records you must produce years later. FISD's Best Practice Recommendations on the Market Data Audit Process, version 1.0, from its Audit Working Group, give a published baseline from the market data industry. FISD calls its recommendations entirely voluntary.
| Point | What the recommendation says |
|---|---|
| Frequency | No more than once a year, unless the content provider finds cause under the contract |
| Period | Typically three years, depending on the contract |
| Notice | Typically 30 days |
| A vendor's customers | Where the contract gives the right, the content provider may audit a vendor's redistribution to downstream customers |
Its sample letter of engagement asks for every user supplied with the data over the whole audit period, with external customers, internal users and free trials included, a list of re-vendors, the latest usage reports and a demonstration of the entitlement system. We found no audit or usage reporting clause in the AWS template, so ask whether the offer or an amendment adds one.
Ask which unit you report, whether your logs outlast the audit period, and whether your customer terms let the vendor's auditor reach a customer.
What happens to your customers when the upstream agreement ends
Published texts take opposite courses. Under the AWS template the subscriber's authorisation ends on termination or expiry, and within 90 calendar days it removes the data from its AWS infrastructure and any other computer systems operated by or for it (section 8.5.1). We found no sentence in it on a subscriber's customers. ODbL 1.0 ends your licence automatically on a breach and says those who received the database from you keep their licences while they comply (section 9.1).
A resale agreement has to say where it stands between the two. Ask for four things in writing:
- a wind-down period during which you may go on serving customers
- whether a customer may keep and use what it has received
- who tells customers, and how long before access stops
- whether the vendor will license a customer directly if you part
An illustrative example: one dataset served through an API
This example is illustrative. Acme Robotics is an invented company, and the terms, counts and dates are invented: they come from no agreement and are not a recommended form.
Assumptions:
- Acme Robotics licenses one technographic dataset of 50,000 companies for redistribution to its direct customers through its own API. The agreement expires on 30 September 2028.
- Illustrative terms: no customer may receive more than 10,000 companies in a contract year; a quarterly report counts every recipient served in the quarter, trials included; an audit may reach back three years; after expiry Acme may serve customers for 90 more days.
- Each customer key may pull 2,500 companies a day.
- In one quarter Acme starts with 40 paying customers, adds 6, loses 2 and runs 3 trials. Of the paying customers served, 31 have accepted terms that carry the pass-through.
- Acme keeps API logs for 13 months and signs customers for 12 months at a time.
Working:
- Recipients. Paying customers served: 40 + 6 = 46, since the 2 that left were served first. With trials: 46 + 3 = 49. The report says 49, not the 46 − 2 = 44 paying at quarter end.
- Pass-through. 46 − 31 = 15 customers receive the data on terms that lack it.
- Volume. 10,000 ÷ 2,500 = 4 days for one key to reach the ceiling, and 50,000 ÷ 2,500 = 20 days to pull the whole dataset. The daily limit cannot hold the ceiling.
- Records. Three years is 36 months, and 36 − 13 = 23 months of a full audit period have no logs.
- Wind-down. A 12-month contract signed on 30 September 2028 runs 365 days, to 29 September 2029. Acme may supply the first 1 + 90 = 91 of them, to 29 December 2028, which leaves 365 − 91 = 274 days promised with no right to supply.
Result: four gaps, found by working the terms through. Acme amends the 15 contracts, counts distinct companies per key per contract year, keeps logs for 36 months, and asks for a 12-month wind-down or ends its customer contracts with the upstream agreement.
Where Fokals stands on these questions
We license Fokals data by written agreement, for internal use, for embedding in a product or for redistribution, so the right to pass data on is a use the agreement names. The data is collected from first-party company sources and public records and processed in-house, and it is company-level throughout. The sourcing statement and the compliance page are public for your reviewer.
Labels and scores carry a named version on every row, and a breaking change ships as a new version with at least 90 days' notice, which is the notice you hold when you write customer terms. A bulk export can come as a package of files with a manifest naming its period, its versions and its licence. Redistributing company data under licence is the working list for the Fokals side.
Frequently asked questions
What should a data platform check before reselling third-party data?
Check eight things: that the vendor holds a right it can pass on for every field, how the data was collected, whether any of it is personal data, what the vendor warrants and indemnifies, what may reach customers and in what form, which terms your customers must accept, how use is reported and audited, and what happens to customers when the upstream agreement ends. For each, ask for the clause or the document, not an assurance.
Can I resell data I subscribed to on a data marketplace?
Only if the terms of the listing grant it. As one published example, the Data Subscription Agreement for AWS Marketplace, in a file dated 14 July 2022, says that except as the agreement specifically provides, a subscriber may not distribute or provide access to the data to a third party, sell it or sublicense it. A resale right under terms like these has to be written in, so read the offer and any amendment before you build.
Does serving licensed data through an API count as redistribution?
Usually, because the records reach a customer's system, but the agreement's own definitions decide. Ask that the grant names delivery by an API of yours, the recipients, the fields and any ceiling on volume. Then make the API enforce each term, with one key per customer, a response built from an allow-list and a log you can report from.
Can a data vendor audit my customers?
Where the contract gives the right. FISD's voluntary Best Practice Recommendations on the Market Data Audit Process, version 1.0, say a content provider may audit a vendor's redistribution to downstream customers where the right exists contractually, and that the vendor should assist with communication where the provider has no direct contract with the customer. If your upstream agreement holds such a right, your customer terms have to allow for it.
What happens to my customers if my upstream data licence ends?
The upstream agreement decides, so settle it before you sign. Ask for a wind-down period in which you may keep serving, a statement of what customers may keep, and the notice customers receive. Then compare the longest term you sell with that period. Open licences differ: ODbL 1.0 states that recipients keep their licences while they comply, even when yours ends for a breach.
Who is responsible for personal data in a dataset I resell?
The UK Information Commissioner's Office says, in guidance it marks as under review, that an organisation receiving a database or list of individuals is responsible for compliance with the law for the data it receives, and should make enquiries such as confirming the source and identifying the lawful basis on which the data was obtained. Which law applies to you, and in what role, is a question for your counsel.
What this page says about the products it names was checked against their public documentation on 7 October 2026. Product and company names are trademarks of their owners. Fokals is not affiliated with them or endorsed by them.