Which of the following best describes data rights in information technology acquisitions?

• A. Ownership, licenses, data access, privacy and security controls, including open data rights where applicable
• B. Ownership alone
• C. Data access alone
• D. Privacy and security controls only

Answer: (B)

Data rights in IT acquisitions are about more than just who owns the data. The strongest description includes ownership, the licenses that govern how data can be used, who has access to the data, and the privacy and security controls that must be in place. It also covers open data rights where applicable, meaning if data is to be released or shared publicly, the terms and conditions for doing so are defined. This holistic view is needed because owning data doesn’t automatically grant usable rights or protect privacy and security, and simply granting access or focusing only on protection doesn’t specify who can use the data or under what terms. Ownership alone leaves use, sharing, and safeguards unclear; data access alone ignores licensing and protection; privacy and security controls alone ignore who owns the data and how it can be used.