Guide
Is it safe to sell company data? The risks, and how to avoid them
Updated November 2026
Company data is now an asset that AI companies pay for. But a careless deal can cost the seller far more than it earns. At Runeshares, data privacy is the starting point of every deal, not an afterthought. Here are the main risks, and how we handle each one.
1. Personal data that isn't properly removed
Slack, email and CRM records are full of names, email addresses, phone numbers and personal details. If these are not removed properly, the seller is still handling personal data and GDPR applies. Fines can reach €20 million or 4% of global annual turnover. Deleting names is not enough, because people can often be identified from context.
How we handle it: identifiers are removed or replaced before anything leaves the company, following EDPB guidance on anonymisation. The method is documented for every dataset.
2. Selling data the company doesn't own
Agencies, consultancies and outsourcing firms often hold material that belongs to their clients. Licensing it without permission can breach contracts and NDAs and lead to claims.
How we handle it: we check what belongs to the company and what belongs to clients before pricing. Client-owned and legally privileged material stays out unless the client agrees.
3. Sensitive information that should never leave
HR files, payroll, health information and private messages carry the highest risk, for staff and for the seller.
How we handle it: these are always excluded. No exceptions.
4. No clear authority to sign
If the wrong person signs, the deal can be challenged later. In an insolvency, only the trustee, administrator or liquidator can decide.
How we handle it: we confirm who has authority before any data is shared, and work directly with trustees and administrators.
5. Losing control after the sale
Without a strong contract, a buyer could resell the data, combine it with other sources or try to identify people.
How we handle it: buyers receive a licensed copy for AI training only. Contracts ban re-identification and resale. The company keeps its own data.
6. Trade secrets and reputation
Pricing, strategy and product plans can still be commercially sensitive, even for a closed company. A leak can damage founders, staff and investors.
How we handle it: the seller decides what is excluded, and sensitive material is removed before transfer.
Why work with Runeshares
- Data privacy built into every step
- Every deal reviewed by a lawyer
- Exclusions agreed in writing
- Documented anonymisation
- Contracts that protect the seller after the sale
- Free, no-obligation initial assessment
We still recommend that each company or estate takes its own legal advice.
FAQ
Is it legal to sell company data for AI training?
Yes, if the seller has the right to license it and personal data is properly anonymised. Effectively anonymised data falls outside GDPR.
Can employees or customers be identified afterwards?
Identifiers are removed before transfer, and buyers are contractually banned from trying to identify anyone.
Who is responsible if something goes wrong?
The seller remains responsible for its own data, which is why the process matters. We document every step, so the seller can show what was done and why.
Does the company lose its data?
No. The company keeps everything. Only a licensed, anonymised copy is shared.
Find out what your company data is worth.
Get my free valuation