When a data set is bought without provenance: what to do first
Stop using the data set until the seller can show where it came from and who had the right to sell it. Freeze copying, merging and onward licensing straight away, across every team that touched the file. A missing chain of rights does not disappear because the invoice is paid; it travels with the data into your systems, your products and, eventually, your contracts with your own customers.
Basis
A database attracts its own protection under Directive 96/9/EC, separate from any copyright in its individual contents. That right belongs to the maker of the database — the party that invested in obtaining, verifying or presenting the data — not automatically to whoever resells copies of it further down the chain. Extracting or reusing a substantial part of a protected database without the maker's consent is an infringement, and a purchase agreement signed between two other parties does not repair that gap for you.
A purchase contract that says nothing about the source, or says only that the seller "warrants clean title", does not by itself prove that the chain is clean. A warranty allocates risk between buyer and seller; it does not extinguish a claim from a third party who was never a party to that contract.
If the data set is destined to train or feed a system in scope of Regulation (EU) 2024/1689 (AI Act), the missing provenance becomes a second, separate problem: a data-governance gap in the file you must be able to show a regulator. The Act enters into force on 2 August 2026, and providers preparing systems for that date need traceable training data well before the deadline, not on it.
Practical consequence
Two exposures run in parallel from the moment the data set enters your systems. The first is a possible infringement claim from whoever actually made the source database, brought however long after the purchase they discover the extraction. The second is a governance gap inside your own compliance file, visible the moment a regulator, an auditor or a counterparty's due-diligence team asks where the training data came from.
| Signal found | What it usually means | Immediate action |
|---|---|---|
| Seller cannot name the original maker | Chain of rights is broken, or was never documented in the first place | Freeze use; request written provenance in full |
| Data set was described as "scraped" or "aggregated" | Extraction from another protected database may have occurred without consent | Assess exposure under Directive 96/9/EC before continuing |
| Set contains identifiable individuals | Personal data protection obligations attach regardless of the seller's assurances | Route to the data protection lead before any reuse |
| Set feeds a live or planned AI system | A governance record is expected under the AI Act | Log the gap in the system's documentation file now |
| Seller refuses to name upstream suppliers | Chain has more than one undisclosed link | Treat the entire set as unverified, not partly verified |
What to do
- Legal counsel: freeze all copying, merging and onward licensing of the data set with immediate effect, and confirm the freeze in writing to every internal user.
- Data team: record every claim the seller made about the source of the data, in writing, with dates and the name of the person who made each claim.
- Legal counsel: send the seller a written request for chain-of-rights evidence, with a fixed response deadline and a clear consequence if it is missed.
- Data protection lead: check whether the set contains personal data and, if so, whether any lawful basis for its transfer was actually passed on with it.
- Compliance: confirm whether the set will train or feed a system under the AI Act, and log that finding in the system's own file, not a separate one.
- Legal counsel: where extraction from another database is suspected, assess exposure under Directive 96/9/EC before any further use, and before any further payment to the seller.
Who decides
Internally, legal and compliance decide whether use continues while provenance is checked; that decision belongs on a written record, not to an assumption made under deadline pressure. Externally, a dispute over the database right is decided by the national court where the claim is brought, on the evidence of who actually made the original database and what was extracted from it. A data protection authority decides a personal-data question separately, on the evidence of what was processed, on what legal basis, and by whom the transfer was authorised. The two forums do not merge, and a finding in one does not settle the other.
Branches
If the seller's licence names a territory that does not match where you actually operate, the gap resembles other agreements where the territory was never properly settled between the parties; see When the parties never agreed the territory explained.
If the original maker later demands compensation without producing any evidence of actual extraction, the position resembles disputes where a claim arrives well before proof does; see When damages are demanded without evidence and its limits.
If the seller offers to "resolve" the provenance gap through a paid renewal of the licence, treat that offer with the same scrutiny you would apply to any steep renewal increase; see When the renewal price doubles in practice.
If the purchase itself was funded through a token sale, the financing clock and the provenance clock run on separate tracks, and neither one waits for the other to finish; see When the token funds development and the deadline.
Limit
This page does not clear any specific data set of infringement, and it does not substitute for a line-by-line review of the licence you actually hold. It does not cover cybersecurity supply-chain duties under Directive (EU) 2022/2555 (NIS2) for entities already within scope of that directive; that assessment belongs on its own file, run against its own criteria. Nor does it set a fee for a provenance review — that depends on how many jurisdictions and registries are involved, how many upstream links the chain has, and whether a claim has already arrived before the review starts.
Related publications
A related situation involves automated decisions rather than purchased data, and follows a similar first-response logic: When a regulator asks about automated decisions: what to.
Verified
Verified: 5 June 2025. Sources referenced: Directive 96/9/EC; Regulation (EU) 2024/1689 (AI Act); Directive (EU) 2022/2555 (NIS2).
FAQ
What is the first step when a data set is bought without provenance?
Freeze every use of the set — no copying, no merging, no onward licensing — and put a written request to the seller for chain-of-rights evidence before anything else happens with the file.
Which deadline is already running?
If the set will train or feed a system under the AI Act, the practical deadline is 2 August 2026, when that Act's obligations take effect; documentation gaps should close well before that date, not on it.
Who decides, and on what evidence?
A national court decides a database-right dispute on evidence of who made the original database and what was extracted from it. A data protection authority decides a personal-data question separately, on evidence of the processing itself and its legal basis.