What is a technology and data licence agreement?
Is a technology and data licence agreement legally binding in South Africa?
“No assignment of copyright and no exclusive licence to do an act which is subject to copyright shall have effect unless it is in writing signed by or on behalf of the assignor, the licenser or, in the case of an exclusive sublicence, the exclusive sublicenser, as the case may be.”
“A licence granted in respect of any copyright by the person who, in relation to the matters to which the licence relates, is the owner of the copyright, shall be binding upon every successor in title to his interest in the copyright, except a purchaser in good faith and without notice, actual or constructive, of the licence or a person deriving title from such a purchaser”
“tables and compilations, including tables and compilations of data stored or embodied in a computer or a medium used in conjunction with a computer”
“They were in possession of Coetzee and were used by him to create tree.txt, answers and weightings databases in respect of the AMPS2000b data. In doing so neither he nor any of the other respondents did, or caused any other person to do, any act as contemplated in s 11B which Haupt as owner of the copyright had the exclusive right to do.”
“Primary infringement consists in the performance of an act, in the Republic, which the owner has the exclusive rights to do or to authorize without the latter's consent (s 23(1)).”
“This Act does not apply to the processing of personal information— … (b) that has been de-identified to the extent that it cannot be re-identified again”
“There must be levied for the benefit of the National Revenue Fund a tax, to be known as the withholding tax on royalties, calculated— (i) at the rate of 15 per cent … of the amount of any royalty that is paid by any person to or for the benefit of any foreign person to the extent that the amount is regarded as having been received by or accrued to that foreign person from a source within the Republic”
When you need a Technology & Data Licence Agreement
- When you license your platform, model, algorithm or API to another business that will build it into its own product or service — for example, a fintech licensing its affordability-scoring engine to a micro-lender.
- When you sell access to a dataset or live data feed — market prices, footfall counts, vehicle-tracking records, weather or crop data — and need to control what the buyer may do with it and what it may build from it.
- When you are the licensee taking in someone else’s technology or data, and need certainty about scope, quality, support, price and what you may keep when the licence ends.
- When the licensee wants to train, test or improve machine-learning models with the data or technology, and the parties must agree whether that is allowed and who owns the result.
- When the dataset contains, or was built from, personal information about customers, employees or businesses, so POPIA roles, de-identification and security have to be allocated in writing.
- When either party is outside South Africa, so royalties, withholding tax and exchange control must be dealt with before the first payment rather than after it.
What a Technology & Data Licence Agreement should contain
The licensed technology or dataset, defined precisely
Schedule exactly what is licensed. For technology: the platform, model or component, its version, the API endpoints and documentation, and whether the licensee gets source code, compiled code or only hosted access. For data: the fields, coverage period, record counts, format, delivery method and refresh cadence — a once-off snapshot or a live feed. Most licence disputes start here, because nobody can later prove what was promised or what was used.
Grant: scope, field of use, territory, exclusivity and sublicensing
State what the licensee may do (use internally, embed in its product, sell outputs to its customers), in which field (for example, short-term insurance underwriting only), where, and for how long. Say whether the licence is exclusive, sole or non-exclusive: under the Copyright Act an exclusive licence shuts out everyone, the licensor included, and has no effect unless in writing and signed by the licensor (ss 1 and 22(3)), while a sole licence keeps the licensor in the market. Say whether the licensee may sublicense to group companies or customers, and on what conditions. If the parties compete, have territory and field splits checked against section 4(1)(b) of the Competition Act 89 of 1998, which prohibits competitors from dividing markets by allocating customers, suppliers, territories or specific types of goods or services.
Permitted uses, derived data and outputs
The clause that decides who owns what the licensee creates. List permitted and prohibited uses — no resale of raw data, no reverse engineering, no combining datasets to re-identify people. Then allocate derived data, reports, insights, model outputs and improvements: who owns them, who may use them after the licence ends, and whether aggregated results may be published. Do not rely on copyright to fill the gap. In Haupt v Brewers Marketing Intelligence the SCA held that using programs to generate new databases was not an act reserved to the programs’ owner, and where output is computer-generated with no human author, the Act treats as author whoever made the arrangements necessary for its creation (s 1; Haupt, para 31) — rarely a clear answer in a two-party deal.
AI and model-training rights
Say expressly whether the licensee may use the data or technology to train, fine-tune, test or benchmark machine-learning models — its own or anyone else’s — and whether a model trained during the licence may keep running after it ends, because a trained model cannot practically give the data back. Silence invites one side to argue that training was always allowed and the other that it never was. Licensors of models and algorithms should also prohibit using their outputs to build a competing model. Where training is the whole point of the deal, use a dedicated training-data licence.
Fees, royalties, reporting and audit — including cross-border payments
Fix the price model: a once-off fee, a subscription, a per-call or per-record charge, or a royalty on the licensee’s revenue, with minimum payments where exclusivity is granted. Define the royalty base (gross or net revenue, which products), require usage reports, and give the licensor an audit right limited by notice, frequency and confidentiality. If either party is offshore, add who bears withholding tax, whether payments are grossed up, the foreign licensor’s duty to deliver its tax-treaty declaration before the first payment (Income Tax Act s 49E(3)), and how payment dates move if the bank’s exchange-control processing is delayed.
Technology and data-quality warranties, and the IP indemnity
The licensor warrants that it owns or controls what it licenses — including code written by contractors and data it bought in — and that the licence infringes nobody else’s rights. For data, agree measurable quality commitments: accuracy, completeness and freshness, how errors are reported and corrected, and the remedy (re-delivery, a service credit or a fee reduction). Licensors should resist open-ended promises that data they cannot fully audit is fit for any purpose; licensees should insist on warranties that match how the data was sourced. Cap liability, but keep the IP indemnity meaningful.
Personal information and security
If the dataset contains personal information, record each party’s POPIA role. A licensee that uses the data for its own purposes is a responsible party in its own right; the licensor’s disclosure then needs a lawful basis (s 11) and must be compatible with the purpose for which the data was collected (s 15). A licensee that processes the data only on the licensor’s behalf is an operator, and section 21 requires a written contract under which it maintains the section 19 security measures and tells the licensor immediately if it suspects unauthorised access. Add a ban on re-identifying de-identified data, and the section 72 conditions if the data will go to a recipient outside South Africa.
Term, termination, return and deletion
Set the term, renewal, and the triggers for early exit: breach, insolvency, change of control, or a regulator’s finding against either party. Then spell out the exit. The licensee stops using the technology, returns or deletes the data and every copy, and certifies deletion in writing — with clear carve-outs for derived data, outputs and trained models it may keep, and for records it must retain by law. Confidentiality, audit and accrued payment obligations should survive termination.
Technology & data licence vs the agreements it is often confused with
| Feature | Technology & data licence | Software licence | Know-how transfer | Data sharing agreement |
|---|---|---|---|---|
| What the other party gets | Rights to use, embed or analyse a technology or dataset | Permission to run a finished program | Secret technical knowledge, often with training | Personal information to use for its own purposes |
| Who owns it afterwards | The licensor | The licensor | Either — the deal may be a licence or an outright transfer | Each party answers for its own copy |
| Main legal protection | Copyright where it applies, plus contract and confidentiality | Copyright in the program, plus contract | Confidentiality and contract | POPIA, plus contract |
| Clause that causes most disputes | Derived data, outputs and AI training | Licence metric and audit | Definition and survival of confidentiality | Lawful basis and purpose limits |
Common South African pitfalls
- Assuming copyright will protect the data. The Copyright Act protects a dataset only if it is an original table or compilation, and even then merely using a work is not infringement (King v South African Weather Service, para 10). If the contract does not list permitted and prohibited uses, a licensee that analyses, combines or builds on the data may be doing nothing the Act forbids.
- Saying nothing about derived data and outputs. Licensees assume they own the reports, insights and models they create; licensors assume everything built on their data is theirs. When the agreement is silent, the disagreement surfaces at renewal or termination, when it is hardest to resolve.
- Granting exclusivity informally. An exclusive copyright licence has no effect unless it is in writing and signed by the licensor (s 22(3)), and the Act’s “exclusive” excludes the licensor too. Promising a partner exclusivity by email, or calling a licence exclusive while still selling to others, sets up a dispute. Between competitors, carving up territories or customer groups can also breach section 4(1)(b) of the Competition Act.
- Treating data as anonymised when it is not. POPIA stops applying only where data has been de-identified to the extent that it cannot be re-identified (s 6(1)(b)). Removing names is not enough if the remaining fields can be linked back to people or businesses, and POPIA protects identifiable, existing juristic persons as well as individuals. Licensing such data to an offshore recipient adds the section 72 transfer conditions.
- Licensing what you do not fully own. Code written by an independent contractor, data bought in from a third party, or a program an employee wrote outside the course of employment may not belong to the licensor. In Haupt v Brewers Marketing Intelligence a party had used databases he had not created under a tacit licence and was held not to own the copyright in them (para 39). Check the chain of title before you warrant it.
- Getting the cross-border money wrong. A South African business paying royalties to a foreign licensor must withhold 15% (s 49E(1) of the Income Tax Act) and pay it to SARS by the last day of the following month (s 49F(2)), unless a valid treaty declaration arrived before payment. If it fails to withhold, it is personally liable for the tax (Tax Administration Act s 157(1)(b)). A fee for data can be a royalty even where no copyright is involved, because the definition also covers imparting commercial or technical information (s 49A). Selling the technology outright to a non-resident is a separate problem: assigning intellectual property offshore needs exchange-control approval first.
Frequently asked questions
Can I license data that is not protected by copyright?
Yes. A data licence is a contract, and it binds the licensee whether or not copyright protects the dataset. Copyright protects a dataset only if it is an original table or compilation, so for much commercial data the licence terms — permitted uses, confidentiality, no onward disclosure and deletion on exit — are the main protection. The limit is that a contract binds only the parties to it, which is why access controls and confidentiality matter as much as the licence itself.
Who owns the insights, reports and models a licensee builds from my data?
Whoever the agreement says. Copyright gives no ready answer: in Haupt v Brewers Marketing Intelligence [2006] ZASCA 40 the SCA held that using programs to create new databases was not an act reserved to the programs’ owner, and the author of computer-generated work is whoever made the arrangements necessary for its creation. State expressly who owns derived data, outputs and improvements, and what each party may do with them after termination.
Can the licensee use my data or technology to train an AI model?
Only if the licence allows it, so say so expressly either way. Permit or prohibit training, fine-tuning, testing and benchmarking, say whose models are covered, and decide whether a model trained during the licence may keep running after it ends — a trained model cannot practically give the data back. Where AI training is the whole purpose of the deal, a dedicated training-data licence is the better tool.
Does a technology or data licence have to be in writing?
An exclusive copyright licence must be: section 22(3) of the Copyright Act 98 of 1978 gives it no effect unless it is in writing and signed by or on behalf of the licensor. A non-exclusive licence may be written, oral or inferred from conduct (s 22(4)), and if the licensee will process personal information on your behalf, POPIA section 21 requires a written contract. In practice every technology or data licence should be written, because its value lies in precise scope and use limits.
What happens to my licence if the licensor sells the technology?
Under section 22(7) of the Copyright Act, a licence granted by the copyright owner binds every later owner of that copyright, except a purchaser who bought in good faith without notice, actual or constructive, of the licence. Licensees should keep proof of the licence and, for business-critical technology, require the licensor to disclose it to any buyer. For data that is not protected by copyright, the licensee depends on the contract alone, so ask for a clause obliging the licensor to make any buyer honour the licence.
Is there withholding tax when we pay a foreign company for technology or data?
Often, yes. A royalty paid to a foreign person from a South African source attracts withholding tax at 15% (Income Tax Act s 49B), and “royalty” covers both the use of intellectual property and imparting scientific, technical, industrial or commercial knowledge or information (s 49A), so a data fee can qualify. SARS’s practice in Interpretation Note 116 distinguishes paying to use the copyright itself from paying to use a finished product. A lower treaty rate applies only if the foreign party delivers its declaration before payment (s 49E(3)).
Do I need Reserve Bank approval to license my technology or data to a foreign company?
Not usually for an ordinary licence that leaves ownership in South Africa, with the royalties processed by your bank — though that rests on Reserve Bank practice rather than the wording of the Regulations, so confirm with your bank before signing. Regulation 10 of the Exchange Control Regulations treats any intellectual property right, registered or unregistered, as capital, and its assignment, cession or use as security in favour of a non-resident as an export that needs approval. A licence so wide that nothing of value stays in South Africa risks the same treatment.
How is this different from a data sharing agreement?
A data sharing agreement governs one business passing personal information to another that will use it for its own purposes, and it is driven by POPIA. A technology and data licence is a commercial licence: the owner grants defined rights to use a technology or dataset, usually for a fee or royalty, and the data may contain no personal information at all. Where a licensed dataset does contain personal information, the licence must carry the POPIA terms a data sharing or operator agreement would.
Sources & authority
- Copyright Act 98 of 1978, ss 1, 2, 11B, 21, 22, 23 and 25 (protected works, ownership, licences, infringement, exclusive licensee’s remedies)
- Haupt t/a Softcopy v Brewers Marketing Intelligence (Pty) Ltd [2006] ZASCA 40; 2006 (4) SA 458 (SCA)
- King v South African Weather Service [2008] ZASCA 143; 2009 (3) SA 13 (SCA)
- Protection of Personal Information Act 4 of 2013, ss 1, 6, 11, 15, 19, 21 and 72
- Income Tax Act 58 of 1962, ss 49A, 49B, 49E and 49F (withholding tax on royalties)
- Tax Administration Act 28 of 2011, s 157 (personal liability of a withholding agent)
- Exchange Control Regulations, 1961 (GN R1111, made under the Currency and Exchanges Act 9 of 1933), regs 10 and 22
- Competition Act 89 of 1998, s 4(1)(b) (restrictive horizontal practices)
This guide is general information, not legal advice. It reflects the law as at October 2026.