What is second-party data?

Digiday's explainer puts it simply: second-party data is essentially first-party data owned by another company. The defining feature is the direct relationship between the holder and the recipient. One named organisation agrees to share records it collected itself, and the other knows exactly where they came from. There is no pool of unknown suppliers behind the file.

Common pairings

Common pairings include a publisher and an advertiser, an airline and a hotel group, a retailer and a brand it stocks, or a software platform and a consultancy that serves its users. Each pair has overlapping customers or complementary knowledge, which is why the exchange is worth negotiating rather than buying something generic off the shelf.

1. 1

   Find the overlap

   Each side explains what it holds and what question the other wants answered. Many proposals stop here because the overlap is too small to matter.

2. 2

   Agree scope and purpose

   The contract names the fields, the period covered, the permitted uses, whether the recipient may combine it with other sources and when it must be deleted.

3. 3

   Choose the mechanism

   Options run from a file transfer of de-identified records, to an API, to a clean room where the recipient runs approved queries and never receives raw rows.

4. 4

   Settle the money

   Payment can be a licence fee, a revenue share or a swap in which each side gets access to the other's records.

The following case is invented for illustration. A regional grocery chain with a loyalty scheme knows which products appear together in shoppers' baskets across its stores. A snack manufacturer wants to understand which of its lines are bought alongside fresh produce, so it can plan promotions with retailers. Neither firm has met the other's data team.

A broker brings them together and helps shape the terms. Shopper identities never cross over. The chain produces basket-level statistics by store region and week, with loyalty numbers removed and small cells suppressed.

The snack maker may use the output for its own planning, may not resell it, and must delete it at the end of the term. The broker checks that the loyalty programme's terms allow this kind of sharing before anyone signs.

To the grocery chain, these are its own first-party records. To the snack maker, they are second-party data, because they came directly from the collector under a contract both sides can read. If the same statistics had been bought from a syndicated retail panel that pools many chains, the snack maker would be holding third-party data instead.

• That the sharing partner really collected the records and isn't passing on something it bought.
• What its customers were told, and whether that covers disclosure to this particular recipient for this purpose.
• Whether the recipient wants to combine the records with others; joining files can re-identify people who were safe on their own.
• Who carries liability if the recipient misuses the data, and how deletion will be confirmed.
• Whether a competitor of the sharing partner could end up benefiting; many deals die on that question alone.

People sometimes describe any purchased data as second-party simply because the seller is named. The test is whether the seller gathered it in its own business.

A company that resells files it bought elsewhere is acting as a third-party source even if the deal is one-to-one. Another misunderstanding is that a direct deal removes privacy obligations. It doesn't; it just makes them easier to trace.