Seven checks: who owns it, whose work is inside it, what personal data it holds, what the privacy policy promised, what open source it carries, what is privileged or held, and what is regulated. The licence is scoped to what survives all seven.
1. Chain of title
Work made for hire under 17 U.S.C. 201(b) belongs to the employer. Possession is not ownership: 17 U.S.C. 202 separates the copy from the copyright, so an estate that bought servers holds files, not rights.
2. Third-party work
Contractor and agency work follows the contract. Licensed software, fonts, stock imagery and data feeds follow their licences. Customer-owned files are excluded.
3. Personal data
Staff, customer and supplier names are in every record. Decide the lawful basis, the exclusions and any redaction before export. HR files and health information are out by default.
4. Promises already made
Read the privacy policy, customer contracts and NDAs the company signed. A confidentiality clause binding the company binds the licence.
5. Open source
Open-source code is disclosed and stays under its own licence. It is never re-licensed as proprietary.
6. Privilege and holds
Privileged client files are excluded. Anything under a litigation hold stays where it is until the hold lifts.
7. Regulated categories
Substance use and behavioral health treatment records under 42 CFR Part 2, HIV records, medical and clinical records, classified and export-controlled material. These are refusals, not redactions.