If company records contain personal information, privacy law applies to licensing them. Under the GDPR you need a lawful basis, transparency and safeguards for transfers; pseudonymised data is still personal data. Under California’s CCPA, sharing personal information for value can be a sale with notice and opt-out obligations. De-identifying records before licensing and keeping the agreement narrow reduce exposure. Get advice for your jurisdictions.
- Check whether records contain personal information before discussing scope.
- Under the GDPR, pseudonymised data remains personal data; anonymous data is outside its scope.
- Under the CCPA, providing personal information to a third party for value can count as a sale.
When privacy law applies
Privacy laws regulate personal information, meaning information about an identifiable person. Support tickets, emails, call notes and HR records usually contain it; machine logs and aggregated operational data may not. The first step is to describe which record types contain personal information.
GDPR basics for data licensing
- Lawful basis: processing, including disclosure to a buyer, needs a basis under Article 6.
- Purpose limitation: data collected for customer support is not automatically usable for a new purpose.
- Transparency: privacy notices should cover the disclosure.
- International transfers: sending personal data outside the EEA needs a transfer mechanism.
- Anonymisation: data that no longer identifies anyone falls outside the GDPR, but the bar is high.
CCPA basics for data licensing
- The CCPA, as amended, gives California consumers rights to know about and opt out of the sale or sharing of their personal information.
- Disclosing personal information to a third party for monetary or other valuable consideration can be a sale.
- Deidentified information, as defined in the law, is treated differently if specific safeguards are in place.
- Businesses must meet notice and opt-out obligations before selling covered personal information.
The EU AI Act
The EU AI Act places obligations mainly on providers and deployers of AI systems, including documentation about training data for some models. Buyers may ask sellers for information to meet those obligations, so be ready to describe where records came from.
Practical steps
- Inventory which record types contain personal information.
- Prefer licensing de-identified or aggregated records. See how to de-identify company data.
- Check customer contracts and privacy notices for restrictions.
- Write the permitted use, deletion and onward-transfer limits into the agreement.
- Have privacy counsel review before any records move.
Next step
This guide is general information, not legal advice. An initial conversation with Origin Data Partners can happen at company level without sharing any personal information.
Common questions
Does the GDPR ban selling data for AI training?
No outright ban, but processing personal data requires a lawful basis, transparency, purpose compatibility and appropriate safeguards. Many companies avoid most of this by licensing properly anonymised records.
Is licensing employee emails covered by privacy law?
Often yes. Employee communications commonly contain personal data. Employment law and works-council rules may also apply in some countries.
Do I need consent?
Not always; consent is one of several lawful bases under the GDPR. Which basis, if any, applies depends on the facts. Take legal advice.
Sources and further reading
Origin Data Partners is independent and not affiliated with any buyer named on this page.