Guide
Is selling company data GDPR compliant?
Updated October 2026
Company records contain personal data, so privacy has to be handled before anything is shared. Here is how we approach it. This guide is general information, not legal advice.
Anonymise before anything moves
Names, email addresses, phone numbers and other identifiers are removed or replaced with consistent placeholders before data leaves the company. Truly anonymised data falls outside GDPR, so the standard has to be high and the method documented.
Leave out what should never be shared
HR, payroll and health records, private direct messages, legally privileged communications and client-owned data are excluded.
Agree it in writing first
The scope, the anonymisation method, who carries out the work and how it is verified are documented before any transfer. No buyer sees data until those safeguards are in place.
Get your own advice
Rules differ between countries and situations. We recommend that companies and trustees take their own legal advice before licensing data.
FAQ
Who does the anonymisation?
Qualified independent specialists, using a method agreed in advance.
Can employees be identified afterwards?
The goal is that they cannot. Identifiers are replaced consistently and sensitive categories are excluded entirely.
Is the data published?
No. It is licensed for AI training only.
Find out what your company data is worth.
Get my free valuation