Can you sell company data to AI under GDPR?
Yes, but only data that is no longer personal is simple. Truly anonymous data falls outside GDPR; pseudonymised data, with names swapped for codes, does not. Licensing personal data needs a lawful basis, a purpose compatible with why you collected it, and notice to the people concerned. French regulators have fined firms for passing data to partners without one.
Does GDPR apply to the data you want to license?
It depends on whether anyone can still be identified. GDPR's Recital 26 says "the principles of data protection should therefore not apply to anonymous information", but pseudonymised data, where names are replaced by codes that could be linked back, still counts as "information on an identifiable natural person".
| Kind of data | Under GDPR | What it means for a sale |
|---|---|---|
| Anonymous: nobody can be identified, even by linking | Outside GDPR | The simplest to license, but true anonymity is hard to reach for emails and chats |
| Pseudonymised: names replaced by codes | Still personal data | All of GDPR applies, including a lawful basis and notice |
| Personal: names, emails, details intact | Personal data | Rarely worth the risk; leave it out |
Getting to real anonymity is a specialist job; see how to de-identify company data.
What do you need to license personal data?
Treat the sale as a new use of the data. "Selling personal data is a separate processing activity" with "a separate purpose about which the data subject must be transparently informed," Belgian law firm Timelex explains. That gives you three things to settle.
- A lawful basis. For businesses this is usually legitimate interests: processing "necessary for the purposes of the legitimate interests pursued by the controller or by a third party", unless those interests are "overridden by the interests or fundamental rights and freedoms of the data subject" (Article 6(1)(f)).
- A compatible purpose. Article 6(4) asks you to weigh the link between the original purpose and the new one, how the data was collected, its nature, the consequences for the people in it, and safeguards such as pseudonymisation.
- Transparency. People must be told about the new purpose and who receives their data, which usually means updating notices before any transfer.
Buyers carry their own duty: a seller's assurance "does not relieve the buyer of his own responsibility under the GDPR," Timelex adds, so a serious buyer will check your basis and notices closely.
What do EU and UK regulators say about AI training?
Both apply the standard legitimate-interest test, and both expect clear purposes. In its December 2024 opinion on AI models, the European Data Protection Board said claims that a model is anonymous "should be assessed by competent SAs on a case-by-case basis", because "AI models trained with personal data cannot, in all cases, be considered anonymous." It recalled the "three-step test" for legitimate interest: a legitimate interest, necessity, and balancing against people's rights.
The UK's ICO reached the same place in its generative AI consultation. As law firm Skadden summarised it, "the long-standing three-prong test for legitimate interest applies to AI development", and "poorly defined purposes such as 'training AI models' are unlikely to pass muster." Developers relying on web scraping must also show that "other methods of data collection, such as licensing data from third parties, were not a feasible way."
That last point helps sellers: UK regulators expect AI developers to consider licensing data. But it also means buyers will want proof that your data was collected and shared lawfully.
Can you license employees' emails and chats?
Only with extra care. GDPR lets each country add its own rules for employment: "Member States may, by law or by collective agreements, provide for more specific rules" (Article 88). In some countries, works councils and collective agreements shape how employee data can be used.
We found no regulator guidance on selling employee messages as training data specifically, so treat it as unsettled: take advice from an employment lawyer in each country where your staff work, and consider leaving staff communications out. The general rights picture is in who owns your company's data.
Have regulators fined companies for selling data?
Yes, and the closest cases are data brokers passing data to partners. France's CNIL fined Solocal Marketing Services €900,000 in May 2025 for "commercial prospecting without prospects' consent and transferring their data to partners without a valid legal basis." The same month it fined Caloga €80,000 for sharing prospect databases with partners on the basis of legitimate interest, ruling that "this processing must be based on the consent of the data subjects, which CALOGA did not obtain."
The lesson for an owner: the legal basis you rely on will be tested, and "legitimate interests" is not a default that always works.
How do you license company data safely under GDPR?
- Decide what you can make truly anonymous, and plan to license only that where you can.
- For anything still personal, document your lawful basis and run the Article 6(4) compatibility check.
- Update privacy notices before any transfer, naming the new purpose and recipients.
- Leave out special category data, children's data and, unless advised otherwise, staff communications.
- Put the buyer's use limits, security and deletion duties in the contract.
- Have a data protection lawyer in your country review the plan before a sample leaves your systems.
Country-by-country rules are in data licensing laws by country, the contract side in how to negotiate a data licensing deal, and for a quick read on your data, see if your data can sell.
Questions
Can I sell company data to AI companies under GDPR?
Yes, if it is truly anonymous, or if you have a lawful basis, a compatible purpose and have told the people concerned. Pseudonymised data still counts as personal data.
Is pseudonymised data covered by GDPR?
Yes. GDPR treats pseudonymised data as information on an identifiable person, so all its rules apply. Only anonymous data falls outside it.
Can legitimate interest cover selling data for AI training?
Sometimes. It must pass the three-step test of a legitimate interest, necessity and balancing. French regulators fined a company in 2025 for relying on it where consent was needed.
Is an AI model trained on personal data anonymous?
Not automatically. The European Data Protection Board said in December 2024 that such models cannot in all cases be considered anonymous and must be assessed case by case.
Can I license employees' emails under GDPR?
Only with care: countries can set their own employment rules, including through collective agreements. Get local employment law advice, or leave staff communications out.
Sources
- GDPR Recital 26, not applicable to anonymous data gdpr-info.eu (text of Regulation (EU) 2016/679)
- GDPR Article 6, lawfulness of processing gdpr-info.eu (text of Regulation (EU) 2016/679)
- GDPR Article 88, processing in the context of employment gdpr-info.eu (text of Regulation (EU) 2016/679)
- What should one keep in mind when selling, purchasing or licensing personal data? (18 February 2020) Timelex, law firm
- Opinion 28/2024 on certain data protection aspects related to AI models (18 December 2024) European Data Protection Board
- ICO publishes outcomes of GenAI consultation (7 January 2025) Skadden, law firm
- Data brokers: Solocal Marketing Services fined €900,000 (21 May 2025) CNIL
- Data brokers: Caloga fined €80,000 (27 May 2025) CNIL