# Stage 6: Will the data join, and does the licence permit the workflow?


**Technical compatibility and contractual permission are separate acceptance tests.** A successful import does not answer whether the club may store, model, share or retain what it imported.

### What should the Player Data Joinability Check test?

Use an authorised sample that contains ordinary records and known edge cases. Agree definitions and expected results before execution.

| Test | Proposed acceptance evidence | Failure to investigate |
|---|---|---|
| Player identity | Reviewed crosswalk between supplier and club IDs | Wrong-person merges or unresolved ambiguous identities |
| Team and transfer history | Dated affiliations reconcile for sample players | Current team incorrectly applied to historic matches |
| Match identity | Competition, season, participants and date reconcile | Duplicate fixtures or mismatched stages |
| Field meaning | Data dictionary and sample calculations agree | Similar names conceal different definitions |
| Minutes and denominators | Reproduced calculations on selected records | Inconsistent exposure or unexplained totals |
| Missing values | Null, unavailable and zero remain distinguishable | Missing observations converted into performance zeros |
| Coordinates and time | Declared units, orientation and periods reproduce correctly | Mirrored pitch, clock offsets or period errors |
| Updates and corrections | Repeat ingestion updates records without duplicating them | Silent overwrites or untraceable revisions |
| API operations | Authorisation, pagination, limits, failure handling and backfill tested | A demo request works but routine ingestion fails |
| Exit/export | A usable authorised export can be reconstructed | Dependence on a disappearing interface |

Do not use player name alone as the canonical key. Maintain a reviewed mapping table with source IDs, club ID, evidence, validity dates, reviewer and mapping version. Use only identifiers the club is authorised to process; quarantine uncertain matches rather than forcing them.

Report both **the share of records successfully mapped** and **the correctness of reviewed mappings**. A high mapping rate achieved through incorrect merges is not a success. Explain the review sample and unresolved population; no errors observed in a small sample is not proof of zero production errors.

Version changes deserve an explicit test. Hudl’s Statsbomb release notes dated June 23, 2026 document changes to Player Match, Player Season and Team Match API versions. Wyscout’s public API documentation also specifies request-rate limits and an HTTP 429 response when exceeded. Build the evaluation against the documented version and operating limits, rather than assuming schemas and access conditions are permanent. ([hudl.com](https://www.hudl.com/releases/statsbomb))

### Can free football data support the DIY route?

Use public samples to test skills, parsers and proposed checks—not as proof of production coverage. Hudl’s StatsBomb open-data repository provides selected competitions in structured JSON, including competition-season, match, event and lineup files. Read its licence before any club use and obtain permission where the intended use is not clearly covered. ([github.com](https://github.com/hudl/open-data))

A successful public-sample prototype does not establish commercial-feed entitlement, delivery reliability, current-season completeness or integration cost. For the purchase decision, repeat the relevant tests on authorised production-representative samples.

### What belongs in the Recruitment Data Licence Stress Test?

Ask counsel to map each intended action to the actual applicable documents. Hudl’s public organisation terms, for example, incorporate orders and other terms, set out precedence rules, and include provisions addressing generative AI. They are useful diligence prompts, but they do not establish the terms governing a particular club’s agreement. ([hudl.com](https://www.hudl.com/eula))

| Intended workflow | Question requiring a documented answer |
|---|---|
| View full matches | Which users, territories and competition-seasons are authorised? |
| Export data or clips | Which formats, volumes, recipients and purposes are permitted? |
| Store a recruitment warehouse | What raw data, history, backups and retention periods are allowed? |
| Build internal models | Are derived metrics, model fitting and continued use of outputs permitted? |
| Use AI for inference | May this named external processor receive the inputs, and under what conditions? |
| Train or fine-tune AI | Is this separately permitted, including any third-party material? |
| Share across a group | Which legal entities, employees, contractors and clubs are included? |
| Commission a scout or developer | Is third-party access permitted, and must accounts be separately licensed? |
| Retain club-created reports | What happens to notes, embedded clips, derived outputs and identifiers on exit? |
| End the agreement | What must be exported, deleted or certified, and by when? |

Record **document, version, clause, interpretation, open question, owner and resolution**. Treat silence as unresolved for procurement purposes. Obtain necessary contractual changes through the agreed amendment process rather than relying on a sales assurance or the club’s purchase-order wording.

### What privacy and security checks are proportionate?

Keep the trial focused on the minimum information needed. The FTC’s business guidance recommends understanding data flows, limiting retained information, restricting access and considering service-provider security. Apply those principles to shortlist files, scouting notes, exports and credentials. ([ftc.gov](https://www.ftc.gov/business-guidance/resources/protecting-personal-information-guide-business))

Ask for named subprocessors, access controls, incident procedures, retention/deletion arrangements and restrictions on supplier reuse. Keep API credentials out of shared workbooks and ensure contractors receive only their authorised access.

Escalate health information, minors’ data and biometric-identification uses to counsel before inclusion. California’s Attorney General identifies health information and biometric information processed to identify a consumer among sensitive personal-information categories; whether a particular law applies requires analysis of the organisation and processing involved. Do not assume every physical-performance metric has the same legal classification. ([oag.ca.gov](https://oag.ca.gov/privacy/ccpa))

For overseas sourcing or group sharing, ask counsel to assess the relevant jurisdictions and transfers. This checklist is procurement triage, not a legal compliance determination.