When purchasing third-party databases, enterprises should confirm with vendors that data collection is compliant and clearly define the boundaries of data usage in the contract, so as to avoid shared legal liability.