A data buyer contacted us. What should we do now?

Ask for the proposed scope, price and payment terms. Describe the records you hold, check who would sign the agreement, and compare another offer before agreeing to a license. Read any terms you have already signed before approaching other buyers.

What do we do this week, in order?

Start with a description and a written proposal. You can move the conversation forward before preparing an export.

1. Identify the counterparty. Find the sender in the buyers directory and ask which legal entity would sign and pay. Use Is it a scam? for identity checks. For a Delaware entity, the free state search provides its formation date and registered agent; an entry alone does not establish its current status.
2. Ask for the proposal in writing. Which records, which rights, what price or payment model, and what has to happen before payment. The reply below gives you a starting point.
3. Make a one-page inventory. List systems, retained years and rough volumes (how to make one). Keep the same description for each provider so their figures are easier to compare. Bring in whoever holds the admin accounts or must approve the deal (outsourced IT, approvals).
4. Agree the next stage. Ask whether a description is enough for an initial valuation or whether they need a sample. Corpus, for example, says it returns a written range within three business days from a manifest of systems and volumes. If they need a sample, settle its scope and handling first. The sample tool reads Slack exports, mailboxes and CSV files in your browser; what a sample is explains what to include.
5. Ask how long the offer stands. Get its expiry in writing and leave time for another provider to review the same inventory. A calculator estimate and a reviewed offer are different stages.
6. Compare the terms. Put payment triggers, deductions, permitted uses, exclusivity and duration beside the amount. Use the offer benchmark to lay them out and the glossary to read the terms.

Can someone on our staff connect our systems without us knowing?

They may be able to authorize an app for their own account, depending on your admin settings and the permissions it requests. A connection is a separate decision from describing your records. As of October 2026:

• Microsoft 365. Microsoft’s documentation says users can, by default, consent to permissions that do not require administrator consent, including access to their own mailbox. Admins can restrict user consent under Enterprise apps > Consent and permissions > User consent settings.
• Google Workspace. Google’s documentation says the default for unconfigured third-party apps lets users sign in and lets apps request unrestricted Google data for that user. Access also depends on service restrictions and any configuration applied to that app. Admins review this under Security > Access and data control > API controls.

Ask your administrator what a proposed connection would expose before authorizing it. For connections already approved, see outsourced IT.

What should our reply ask for?

The scope, the commercial terms and what they need next. This is a reply you can adapt, written by Data Licensing Report:

Thank you for getting in touch. Please send us the proposed terms:

1. Which systems, years and record types you want.
2. Whether your figure is an estimate or an offer, and what could change it.
3. The amount or payment model, payment trigger, and any fees or deductions.
4. Any exclusivity during discussions or in the license, and its scope and duration.
5. The recipients and permitted uses, and how the records would be prepared and reviewed.
6. What you need from us next, under what handling and confidentiality terms.
7. The legal entity that would sign and pay, and any paid introducer involved.

These points carry through to the agreement. Avelence’s published process has the owner and selected partner agree included and excluded records, permitted uses, preparation, price and payment milestones before transfer.

Use how offers work to distinguish an estimate from an offer, payment timing for the payment trigger, and ownership for the rights being licensed.

How long should we give the first sender?

Ask for enough time to obtain another reviewed figure. The following provider pages publish a first-stage timeframe, checked October 6, 2026. Each row states what that timeframe actually covers:

Provider	Published timeframe	What arrives
Appen	Two business days	A reply from the partnerships team
Corpus	Three business days	A written valuation range
DataVendor (HUD)	Five business days	Review of an intake; the guide concerns closing startups and code assets
FileYield	Some buyers contact sellers within days	Marketplace contact; it gives no fixed deadline
Handshake AI	One to two days	First contact with a company referred through its referral route
Nyne	Thirty seconds	An automated estimate
Polyshares	One to two weeks from intake	An offer after reviewing the record
Troveo	Minutes	An estimate

These are provider statements about different stages. They do not establish a common deadline. For a reviewed price, ask what review is required and when it will finish. Telegraph Lab, commercially affiliated with Data Licensing Report, describes its steps and payment milestones without giving them a duration.

Ask the first sender whether it will keep its offer open until those reviews finish. Is this a good offer? covers the comparison once you have the terms.