On this page
The five questions to answer first
- What exactly is the collection? Name the systems, repositories, years, formats and linked records. Say what is out. “Our company data” is too broad to review. “Public channels, support tickets and the runbook archive from the stated period” is reviewable.
- Who created or supplied it? List employees, contractors, clients, contributors, customers and vendors whose work or records appear. A collection can contain several rights chains.
- What gives you authority? Point to employment terms, assignments, client permissions, board approvals, purchase documents or another record. If the evidence is missing, mark the item as unresolved.
- Who can approve a license? Record the legal entity, signatory role and any board, trustee, liquidator or client approval needed. An administrator who can export a system is not automatically authorized to grant rights.
- What must be excluded or masked? Mark personal data, secrets, privileged material, customer-confidential records, direct messages, HR material and third-party content before a sample is prepared.
A compact preflight worksheet
Use one row for each collection or meaningful component. Use roles instead of names or email addresses. Keep the underlying archive in its controlled location. This table is an organizing aid, not a determination.
| Review item | Evidence to locate | Decision before review |
|---|---|---|
| Entity and signatory | Formation or authority record, board approval, or appointment document | Who can approve the scope and sign? |
| Contributors and creators | Employment terms, IP assignments, contractor terms, client agreement | Owned, permission needed, or unresolved |
| Customer and third-party material | Contract, NDA, notice, license, or data-sharing restriction | Include, mask, exclude, or escalate |
| System scope | Inventory with admin role, period, format and linked systems | Exact collection boundary |
| Personal data | Data map, notice, lawful-basis analysis where relevant, masking plan | Review required before sharing |
| Technical exposure | Secret scan, public-history check, component or source review | Remediate, exclude, or document limits |
| Prior commitments | Earlier licenses, exclusivity promises and vendor terms | Conflict, carve-out, or counsel review |
The stop and escalate rule
Hold the affected collection or component when a row says “unknown” on title, authority, consent or a prior commitment. Do not turn a missing document into an assumption. Ask the relevant owner for evidence, narrow the collection, or send the question to counsel. Continue independent work whose scope and authority are documented, and escalate the whole package only when the unknown affects shared authority or the proposed license boundary. A technical scan can identify a secret or a public marker. It cannot prove that every contributor assigned rights or that no third party has a claim.
Privacy needs the same discipline. The UK Information Commissioner’s Office says privacy should be considered at the design stage and throughout the lifecycle, with use limited to what is necessary for the stated purpose. Its guidance also recommends mapping personal information, considering anonymization or pseudonymization, and deleting information that is no longer needed. See its data-protection-by-design guidance Information Commissioner’s Office (UK), (opens in a new tab), especially the “What are we required to do?” and “How do we do this in practice?” sections.
General information, not legal advice.
Worked fictional example
Consider a fictional software company with a private repository, a support archive and a set of client-built integrations. Its preflight could look like this:
| Component | Evidence found | Next action |
|---|---|---|
| Internal service repository | Founder and employee assignments, full history | Include after technical scan |
| Client integration | Statement of work says client owns deliverables | Request written client permission or exclude |
| Support archive | Customer messages and staff identifiers | Define a field-level mask and staff notice review |
| Vendor-hosted logs | Terms are not yet reviewed | Hold out until contract review |
The result is not “cleared.” It is a bounded review plan. The owner knows which part can move forward and which part needs evidence.
What to bring to the next step
Bring the completed rows, not the raw archive. Keep a dated evidence reference for each decision, note the person or role responsible for the next action, and record the exclusions in the eventual scope note. Rightmark’s appraisal is designed to start with answers and no files or passwords. If the review advances, the Trust page explains the ownership pack, reports and approval gate. The Repo Check page is the relevant technical path for private code.
Sources
- Office of the Law Revision Counsel, US House of Representatives: 17 U.S.C. 201: Ownership of copyright (opens in a new tab)
- Office of the Law Revision Counsel, US House of Representatives: 17 U.S.C. 204: Execution of transfers of copyright ownership (opens in a new tab)
- Information Commissioner’s Office (UK): Data protection by design and by default (opens in a new tab)