The answer is yes, there would be limitations on how that data can be used. It would vary, I think, from contract to contract, but there are provisions.
Often the information we see from another country or another entity would be anonymized data. It would not have a company name or a country name. These are usually anonymized datasets that protect the identity of the organization in question.