Four separate permission checks
Ownership: who created the material and who owns the relevant rights? Privacy: what does the collection reveal about people, and what rules apply to reuse? Contracts: what did you promise customers, staff and suppliers? Platform terms: what restrictions apply to the way the data was obtained?
A positive answer in one column does not clear the others. Keep evidence and unresolved questions for each collection, not just a single yes/no answer for the company.
Prepare a rights register
For every data source, record its owner, collection route, applicable contract version, intended recipient and use, rights evidence, exclusions and reviewer. Attach references to documents rather than copying sensitive clauses into a public datasheet.
Make exclusions an operational step
Remove restricted data before generating samples. Preserve a manifest of exclusions and test that links or attachments have not reintroduced the same material. Sensitive content can appear in filenames, comments, embedded images, revision history and logs.
Get advice where uncertainty matters
Use qualified counsel for jurisdiction-specific legal questions, employee monitoring, regulated data, insolvency, international transfers and broad warranties. This site provides preparation guidance, not a legal clearance or a decision that any dataset is lawful to sell.