What you will be able to do
- Explain why every data source feeding a GenAI application carries license terms that the builder must honour
- Read a data product's terms for the license grant, restrictions and personal-data disclosures before using it for retrieval or fine-tuning
- Recognise that privacy laws such as GDPR and CCPA are legal requirements that stay with a source wherever its data goes
- Use Unity Catalog lineage, descriptions and certification tags to record where data came from, so you can show it was used legally
Key concept
Rights to use a data source — Before a document set, table or dataset goes into a GenAI application, someone must hold the legal right to use it in that way. The license terms set what you may do with the data (for example, commercial use, redistribution or training), and the team building the application is responsible for staying inside them.
1.Every source comes with terms
A GenAI application is only as legally sound as the data behind it. A RAG chatbot can quote a vector index built from scraped web pages, licensed news archives, a vendor's PDF manuals or a third-party dataset. A fine-tuned model can absorb its training corpus. If any of that content was used outside its license, for example in a commercial product when the license allowed only non-commercial research, the application now carries the legal risk. Copyright claims, breach of contract and privacy violations all start with a source that was used without the right to use it.
Databricks applies the same principle to the models it serves. Its page on model terms says compliance stays with the customer, and the (now end-of-life) Foundation Model Fine-tuning page says the same for model licenses. The exam objective is about data sources, but the reasoning carries over directly: a platform gives you access to an asset, and you remain responsible for using that asset within its terms. A 'Grant SELECT' in Unity Catalog does not mean anyone checked the license.
2.What to look for in a data product's terms
The Databricks Marketplace provider policies show what 'terms' means for a data source in practice. Every listing must state its terms of use, including the license grant and any restrictions. It must also describe any personal data in the product and how often the data is updated. Providers must have the rights to share what they list, and their products must not infringe third-party intellectual property. As a consumer, you read the same information from the other side: the policy lists the questions to answer before a source enters your pipeline.
| Listing must provide | Question it answers before you use the data |
|---|---|
| Provider/Consumer Terms of use: license grant, terms and conditions, restrictions | Am I allowed to use this data for my purpose (retrieval, fine-tuning, commercial use)? |
| A description of Personal Data contained in the Product, if applicable | Do privacy obligations come with this data? |
| Update frequency | How current is the data, and will my index need refreshing? |
| Accurate documentation | What exactly is in the data, and how was it produced? |
Licenses also have time limits. A provider can stop supplying a product after giving notice, but must keep honouring the term already granted to current consumers. The reverse also holds: your right lasts for that term, not forever. A vector index built from licensed content may need rebuilding or retiring when the license term ends.
Checkpoint 1 of 5· Match them up
Match each part of a data product's terms to what it tells you
Tap a term, then the definition that fits it.
The terms of use set out the license grant and its restrictions, the listing discloses any personal data, and access lasts for the term that was granted.
“such as those describing the license grant, any other pertinent terms and conditions, and restrictions (if any) applicable to the Product being offered”Source: docs.databricks.com
Checkpoint 2 of 5· Exam question
A team wants to fine-tune a customer support model using a dataset discovered through Databricks Marketplace. What should they verify before using this dataset for fine-tuning?
Correct answer: A — The license terms and permitted use cases stated in the listing's metadata, including whether commercial use and model training are allowed
- A. Marketplace listings specify their own license terms and permitted use cases, and these can restrict or exclude uses like model training or commercial redistribution. Checking the listing metadata is the correct step to confirm the dataset can legally be used for fine-tuning.
- B. A verification badge indicates the provider's identity has been confirmed, not that every downstream use, including model training, is automatically licensed. Usage rights still depend on the specific license terms attached to that listing.
- C. Lineage tracking records how data moves and transforms within the workspace; it documents provenance but does not itself confer or expand legal usage rights over the data. Licensing must still be confirmed independently of lineage configuration.
- D. A dataset's price has no bearing on its licensing terms; free listings can still carry restrictions such as non-commercial-use-only or attribution requirements. Cost and license scope are independent attributes of a Marketplace listing.
Sources3
3.Privacy law is a license term you cannot negotiate
Some legal requirements come from regulation, not from a contract. If a source contains personal data, laws such as GDPR and CCPA apply wherever that data goes, including the chunks in your vector index and the examples in your fine-tuning set. The Databricks GDPR guidance describes the 'right to be forgotten': an organisation must delete a person's PII when that person asks. For a GenAI application, that means knowing which indexes and training sets a person's data reached, so that a deletion request can actually be carried out.
The guidance also says this obligation is not limited to tables in the lakehouse. Data in upstream sources such as queues and cloud storage is covered too. Techniques for masking or removing PII belong to a neighbouring lesson. The point here is legal: personal data in a source is a constraint you must identify before you use the source, not something to clean up after the application ships.
Checkpoint 3 of 5· Check yourself
A team argues that GDPR deletion only matters for their Delta tables, because the raw files in cloud storage are 'just staging'. What is correct?
The regulations cover the data wherever it is stored, so upstream copies have to be deleted too.
“GDPR and CCPA apply to all data, including data in sources outside of Delta Lake, such as Kafka, files, and databases.”Source: docs.databricks.com
Sources4
4.Recording provenance so you can prove compliance
Knowing the terms is only half the job. You also need to show, later, that you followed them. Unity Catalog lineage traces tables and columns back to their sources and shows which downstream assets use them. When a model is trained on a Unity Catalog table, its lineage reaches back to the training data. External lineage extends this to systems outside Databricks, so a source like Salesforce or MySQL appears in the graph from before ingestion. Table and column descriptions can record compliance information, such as the source and license, next to the data itself.
When a source's license lapses or turns out to be unsuitable, the system.certification_status tag can mark the asset as deprecated. That warns builders not to use it in new pipelines, and lineage shows which existing indexes and models need attention. Together, these tools turn 'we believe we had the right to use this' into a record you can show an auditor.
Checkpoint 4 of 5· Check yourself
Which Unity Catalog capability lets you show, during a compliance audit, where regulated data came from and which downstream assets consume it?
Lineage records where data comes from, how it is transformed and what consumes it. That is the evidence a licensing or privacy audit needs.
“Track sensitive data flow: For compliance audits, see where regulated data originates, how it is transformed, and which downstream assets consume it.”Source: docs.databricks.com
Checkpoint 5 of 5· Exam question
An engineer finds a third-party dataset whose license explicitly restricts use to "non-commercial research purposes only." The engineer wants to use it to fine-tune a model that will power a paid product feature. What is the appropriate course of action?
Correct answer: A — Do not use the dataset for the paid feature; instead source a dataset under a commercial-compatible license or obtain a separate commercial license from the provider
- A. A license limited to non-commercial research purposes prohibits use in a revenue-generating product, so the compliant path is to find a dataset with a commercial-compatible license or negotiate a commercial license with the provider. This directly avoids the legal risk the restriction is meant to prevent.
- B. Fine-tuning does not erase or reset the licensing obligations attached to the training data; courts and license terms generally treat derived model behavior as still encumbered by the source license. Assuming transformation clears the restriction is a common but incorrect assumption.
- C. Adding attribution addresses licenses that require citation, but it does not override an explicit non-commercial-use restriction, which is a separate and stricter condition. Citing the source does not make a prohibited commercial use permissible.
- D. Feeding restricted data into a paid product's retrieval pipeline is still a commercial use of that data, regardless of whether it is applied through fine-tuning or retrieval. Swapping the technique does not change the underlying license violation.
Exam traps
Each one states something that sounds right. Open it to see what is actually true.
1.If Databricks hosts or lists a model or dataset, Databricks has already handled license compliance for my use.Why is that wrong?
The platform provides access, but the customer remains responsible for complying with the applicable terms and use policies.
Covered in Every source comes with terms
2.Once a dataset is shared with you, you can use it for anything, including any GenAI purpose.Why is that wrong?
Every data product comes with terms of use that state the license grant and any restrictions, and those terms limit how you may use it.
Covered in What to look for in a data product's terms
3.Privacy obligations apply only to the curated Delta tables, not to raw files or other copies feeding the application.Why is that wrong?
GDPR and CCPA apply to all data, including sources outside Delta Lake such as Kafka, files and databases.
Covered in Privacy law is a license term you cannot negotiate
Sources
Every claim above is drawn from one of these pages, quoted as it was written on the date shown.
- 1.https://docs.databricks.com/aws/en/machine-learning/model-serving/acceptable-use-modelsOfficial docs
“You are responsible for ensuring compliance with applicable model terms and any applicable use policies.”
↩︎ Every source comes with terms“You are responsible for ensuring compliance with applicable model terms and any applicable use policies.”
↩︎ Exam trap 1 - 2.
“Customers are responsible for ensuring compliance with applicable model licenses.”
↩︎ Every source comes with terms - 3.
“Products and Listings may not: Infringe any third party intellectual property rights”
↩︎ What to look for in a data product's terms“Allow any current Consumer(s) continued access to the Product for the remainder of the current term you granted under your Provider/Consumer Terms”
↩︎ What to look for in a data product's terms“You must have all necessary rights to sell or share the Product(s) you intend to offer.”
↩︎ Key concept“such as those describing the license grant, any other pertinent terms and conditions, and restrictions (if any) applicable to the Product being offered”
↩︎ Exam trap 2“such as those describing the license grant, any other pertinent terms and conditions, and restrictions (if any) applicable to the Product being offered”
↩︎ Checkpoint - 4.https://docs.databricks.com/aws/en/ldp/gdprOfficial docs
“require companies to permanently and completely delete all personally identifiable information (PII) collected about a customer upon their explicit request.”
↩︎ Privacy law is a license term you cannot negotiate“GDPR and CCPA apply to all data, including data in sources outside of Delta Lake, such as Kafka, files, and databases.”
↩︎ Exam trap 3“GDPR and CCPA apply to all data, including data in sources outside of Delta Lake, such as Kafka, files, and databases.”
↩︎ Checkpoint - 5.https://docs.databricks.com/aws/en/lakehouse-architecture/data-governance/best-practicesOfficial docs
“Data lineage helps organizations trace the source of tables and fields.”
↩︎ Recording provenance so you can prove compliance“Descriptions can include data sensitivity and compliance information.”
↩︎ Recording provenance so you can prove compliance - 6.https://docs.databricks.com/aws/en/data-governance/unity-catalog/certify-deprecate-dataOfficial docs
“Warns that a data asset is outdated, no longer reliable, or should not be used in new workflows.”
↩︎ Recording provenance so you can prove compliance
Also cited
- https://docs.databricks.com/aws/en/marketplaceOfficial docs
“some data products are available instantly, as soon as you request them and agree to the terms”
↩︎ Prediction “Track sensitive data flow: For compliance audits, see where regulated data originates, how it is transformed, and which downstream assets consume it.”
↩︎ Checkpoint