Often yes, but it brings conditions code teams forget. The Open Database License asks you to attribute, to offer an adapted database under the same license if you publicly use it, and to keep a version without technical restrictions. Track datasets in your inventory next to your libraries.
Why datasets need their own line in the inventory
Most license workflows are built around packages. Product teams also ship maps, geocoding tables, word lists, taxonomies, lookup files and training data. These arrive as a CSV or a database file in a repository, and no package manager reports them. Nothing in a dependency scan flags them.
The Open Data Commons summary of the ODbL 1.0 describes a database license, separate from the licenses used for software. It says you are free to share, create and adapt, as long as you meet three conditions. The summary is explicitly not the license itself and has no legal value, so read the full text before you decide. This is a workflow guide, not legal advice.
The three conditions, in engineering terms
| Condition | What the summary says | What it means for a product team |
|---|---|---|
| Attribute | Attribute any public use of the database or works produced from it, in the manner the license specifies, and keep notices intact | Add the dataset to your notices page and keep headers and metadata files |
| Share-alike | If you publicly use an adapted version, offer that adapted database under the ODbL | Decide early whether you modify the data, merge it, or only read it |
| Keep open | If you redistribute it, you may use technical restrictions such as DRM only if you also redistribute a version without them | Do not ship the data only inside an encrypted or locked container |
The share-alike line is the one that drives most review. Whether a merged or derived dataset counts as an adapted database is a legal judgment. Teams that have a clear policy decide it once, not per release.
A five step intake for datasets
- Register every dataset. Record name, source URL, version or download date, and license identifier. The SPDX license list includes ODbL identifiers, so use the standard identifier in your record.
- Record how you use it. Options are read only lookup, bundled in the product, transformed into a new table, or merged with your own data.
- Mark where it ships. In the app binary, in a server side service, in an exported customer file, or only in an internal tool.
- Route anything bundled or merged to review before release.
- Store the attribution text and license copy with the dataset, not in someone's inbox.
Keep data and code on one policy
It helps to put datasets under the same tier model as code: allow, review, deny. A dataset under a permissive terms file can go through. A share-alike database license goes to review. Our post on a three tier license policy shows the structure.
Watch for the assumption that a dataset with a free download is free to use. A missing license is not permission. Our post on using a repository that has no license covers the same reasoning for code, and it applies to data too.
Also check where the data goes at runtime. If your service exposes query results to customers, ask whether that counts as public use of a produced work under the license text. That question belongs with counsel, and your inventory entry should say who is asked and when.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how one evidence record maps to several control requirements, then picture a dataset register entry playing the same role for a customer review.
Safeguard's compliance and evidence automation helps keep records like these organized, and its SBOM and dependency scanning covers the package inventory. You can try a free scan at gold.safeguard.sh.
Quick check
Does ODbL cover my own product code?
The Open Data Commons summary describes a database license. Whether and how it reaches software that reads or merges a database is a legal question, so ask counsel before you rely on a reading.
Is a free dataset with no license safe to ship?
No. Without a license you generally have no permission beyond what the law gives you. Ask the publisher for terms or pick another source.
Sources
Last reviewed: 19 October 2026.
