Is it legal to sell company data to AI companies?
Updated
Short answer: Generally yes, if your company owns the data, the copy is properly anonymised, and nothing in your client contracts or confidentiality terms forbids it. You license the anonymised copy under an agreement that limits how the buyer may use it. The main risks are personal data and contractual restrictions, and both are checked before anything is shared. This is general information, not legal advice.
What makes it permissible?
- You own the data. Work product created by your company is usually the company's to license.
- It is anonymised. Properly anonymised data, where individuals can no longer be identified, falls outside most personal-data rules such as GDPR.
- The licence limits use. The buyer agreement sets out what the data may be used for.
What can stop you selling some data?
- Client contracts that restrict use of client materials or require confidentiality.
- NDAs with partners or suppliers.
- Sector rules, for example on health or financial records.
- Data that can't be anonymised well, which is dropped rather than shipped.
Before anything is shared we flag client contracts or confidentiality terms that restrict it. Restricted data is simply left out.
What about employees and clients?
Nothing that identifies them leaves your environment. Names, contact details, client names and account IDs are replaced before delivery, and a re-identification test drops any record that could still be traced back. See how anonymisation works.
Frequently asked questions
Does GDPR stop me selling company data?
GDPR governs personal data. Data that has been properly anonymised so people can no longer be identified is generally outside its scope, which is why anonymisation happens before anything is shared.
Do I need my clients' permission?
Only where a contract or confidentiality term requires it. Those terms are flagged first and restricted data is left out.
Who signs the deal?
Someone with authority to license the company's data, such as a director, or for a closed company, the person handling its affairs.