Data and Database Rights Protection

The question

Your data may be the most valuable thing you own, and the least protected. A customer database, a curated price feed, a sensor archive or a training set can represent years of investment. None of them comes with a registration certificate.

The questions we hear are practical. Can we stop a competitor scraping our catalogue? Who owns the data that a supplier enriches for us? Does the new Data Act force us to hand over what our connected products generate? Can an AI developer train on our content?

Clients typically come to us in one of four situations: after a competitor or partner has copied a dataset, before they sign a collaboration or data-sharing agreement, when a product starts generating data that customers want access to, or when an investor or buyer asks what the company really owns in its data.

Our approach

We start by mapping what you hold and where its value lies. Protection for data is a combination of rights, not a single one. We look at each layer in turn.

The sui generis database right under Directive 96/9/EC protects a substantial investment in obtaining, verifying or presenting the contents of a database. Copyright may protect the original selection or arrangement of a database and the software around it. Trade secret law (Directive 2016/943) protects data that is secret, valuable because it is secret, and subject to reasonable steps to keep it secret. We explain the conditions and the gaps in database rights and trade secrets.

Then we test the contracts. Most disputes about data are decided by what the parties wrote down, or failed to write down. We review your customer, supplier, employment and collaboration agreements against a playbook for data clauses with our contract review. The tool flags the issues per clause and proposes redlines. A lawyer checks every suggestion.

Next we look at the regulatory overlay. The EU Data Act gives users of connected products rights of access to the data those products generate, and it limits the database right for such data. If you make connected products or provide related services, this changes your contracts. If you use AI, the questions of training data, opt-outs and AI output matter for what you protect and for what you may use.

In practice the work runs in steps. We first collect the facts from you: what the dataset contains, how it was compiled, what it cost in time and money, who has access, and under which contracts it leaves the company. Our attorney then decides which rights are realistically available, because an exclusive right exists only where its legal conditions are met. The contract review follows, and the attorney decides which redlines to propose and which risks you may accept.

Where a protected asset needs drafting, such as a data access agreement, an addendum for a collaboration or an internal confidentiality policy, we prepare it with our Document Studio in the firm's house style. Your copyright works and registered rights are recorded in our IP portfolio, so that the whole position is visible in one place.

What you get

• A short map of your data assets, the rights that apply to each and the gaps.
• A review of key agreements, with redlines on ownership of derived data, access, use restrictions, confidentiality and return or deletion.
• Drafted or updated terms for collaborations, data access, website and API use, and employee and contractor confidentiality.
• An assessment of how the Data Act affects your products, services and contracts, where it applies.
• A practical protection checklist: access controls, marking of confidential material, records of the investment that supports a database right, and what to do when you suspect extraction.
• If an infringement occurs, advice on the options: a cease-and-desist letter, contractual remedies, interim relief or a claim.

A short scenario shows the result. A European provider of market data has a catalogue that a reseller has been copying into its own product. We document the investment behind the catalogue, check the reseller agreement, find that it grants no restriction on onward use, and prepare a cease-and-desist letter based on the database right and the contract. For the future, we add use restrictions, audit rights and a clear ban on extraction to its standard terms.

We do not promise that every dataset can be protected by an exclusive right. Some cannot. In those cases we say so and show you what contract and technical measures can do instead.

Next step

Tell us which data you rely on and where it travels. A first conversation is usually enough to say which rights you can count on and which contracts need attention.

Schedule a meeting or contact us.