# What should the Recruitment Data Licence Stress Test cover?


**Map each intended workflow to its governing wording, not to a salesperson’s general assurance.** Legal review should resolve applicability, precedence and any required amendments; this scorecard is procurement diligence, not a legal opinion.

| Intended workflow | Written clarification to obtain |
|---|---|
| Internal comparative trial | Permitted evaluation, benchmarking and result-sharing scope |
| Independent adviser access | Named people, approved access route and permitted evidence handling |
| Downloads and API ingestion | Entitled datasets, limits, storage locations and permitted transformations |
| Internal recruitment modelling | Permitted analytical use, derived outputs and applicable restrictions |
| External AI processing | Approved providers, inputs, retention and onward-use conditions |
| Supplier AI features | Treatment of prompts, outputs, club information and model-improvement uses |
| Multi-club sharing | Included legal entities, users, territories and permitted outputs |
| Clips and presentations | Internal sharing, exports and third-party distribution limits |
| Contract end | Separate treatment of licensed content, club-authored reports, derived outputs, backups and deletion |

Do not assume a PDF export solves portability if its supporting evidence becomes inaccessible. Test an authorised exit sample and document what remains usable after termination.

For confidentiality, adopt collection minimisation, role-based access, credential revocation, approved processors and a stated retention/deletion process. FTC business guidance supports limiting unnecessary personal information, restricting access, putting security expectations into provider contracts and checking that providers implement them. It is not a soccer-specific compliance certification. ([ftc.gov](https://www.ftc.gov/business-guidance/resources/start-security-guide-business?utm_source=openai))

Avoid unnecessary medical, biometric or minors’ information in the procurement trial. Use redacted contracts and pseudonymous case labels where they preserve the test’s validity, and obtain the required upload and processing permissions.