Guide
Questions to Ask Before Selling Company Data
Before selling or licensing company data, ask who receives the copy, what is in it, whether anyone else may use it, how long it lasts, and whether a person can still be identified. Ask any buyer the same things, whether the buyer is a broker, a lab, or us. The answers are not one company's terms, and they are not a legal opinion.
| Fact | Detail |
|---|---|
| Pseudonymization | Pseudonymization means processing personal data so the data can no longer be attributed to a specific person without additional information, kept separately, under technical and organizational measures that keep the data from being attributed to an identified or identifiable person. EUR-Lex |
| Still personal data | Personal data that has undergone pseudonymization, and that could be attributed to a natural person by the use of additional information, should be considered information on an identifiable natural person. EUR-Lex |
| Outside the regulation | The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. A vendor's claim that it has anonymized the copy is not the same as information that no longer identifies a person. EUR-Lex |
| Bankruptcy privacy promise | If the debtor disclosed a policy prohibiting the transfer of personally identifiable information to persons that are not affiliated with the debtor, and that policy is in effect on the date the bankruptcy case begins, the trustee may not sell or lease that information unless the sale or lease is consistent with the policy or the court approves it under section 363(b)(1)(B). U.S. House of Representatives |
| Tax records survive a license | The length of time you should keep a document depends on the action, expense, or event which the document records. A license does not end that duty. Internal Revenue Service |
| Vetrix's license terms | You keep ownership of your data, and full use of it in your business. Vetrix Labs |
Ten questions to ask any buyer
If the answer to any question is "trust us," the question is not answered. When you are ready to pursue a license, follow how to sell company data to AI companies. Ask a broker, a lab, or us. For each question, look for the clause. If the answer stays vague, you do not have an answer yet.
| # | Question | The weak answer | Where the answer should be |
|---|---|---|---|
| 1 | Who is the licensee, and who else can receive a copy? | Our partners will handle it. | The clause that names every recipient |
| 2 | What exactly is copied, and what is excluded by name? | The workspace. | what data is shared when licensing company data |
| 3 | Is the license exclusive, and for how long? | It's a standard exclusive. | selling vs licensing company data |
| 4 | Does the copy still identify a person? | We anonymized it. | Article 4(5) and Recital 26 |
| 5 | What happens to the copy at the end of the term? | We'll keep it safe. | The clause on deletion, return, or a trained model |
| 6 | Can we keep using our systems and sell the company later? | You can always sell later. | The clause on ownership and a later sale |
| 7 | Who is liable if a person is identified later? | That won't happen. | The indemnity and the cap |
| 8 | What does our customer privacy notice already promise? | The old notice does not matter. | The notice you already gave customers |
| 9 | What records must we keep even after a copy leaves? | The buyer stores it, so you can delete yours. | how to wind down a company |
| 10 | What are we paid, when, and what ends the deal? | We'll pay the market. | how much do AI companies pay for company data |
Who is the licensee, and who else can receive a copy?
Ask for the legal name of the licensee. Then ask whether affiliates, subprocessors, or anyone who trains a model can receive the copy. The clause you want names those parties, or it says the licensee may not pass the copy on. A logo on a slide is not the legal name. "Our group" is not the legal name.
Do not accept a sentence like "our partners will handle it." You still do not know who holds the file, who can read it, or who can train on it. Write the names into the agreement before you discuss price. If the buyer will not name the parties, you do not yet have an answer, and you cannot say where the copy goes.
What exactly is copied, and what is excluded by name?
Ask which systems are in the copy, the date range, and which records are excluded by name. The clause should list the systems and the dates, and it should attach a written exclusion list. "The workspace" with no dates and no exclusions is the weak answer. A later argument about whether a mailbox was included is expensive. The list prevents that argument.
Read what data is shared when licensing company data for one public exclusion list. It is not the only list a contract can use. Build the list for your systems. Customer details and staff details are the usual first cuts. If the buyer describes the copy only by a product name, ask again for the systems, the dates, and the exclusions.
Is the license exclusive, and for how long?
Ask whether the license is exclusive, what the term is, what the territory is, and whether an exclusive grant blocks a later sale of the company. The clause should answer all four. "It's standard" leaves all four answers open. A buyer who wants the sole right to the records, for a term you did not read, can collide with a company sale you still hope to make. Ask for the end date in the same clause as the word exclusive, so the two answers cannot drift apart.
Read selling vs licensing company data for the difference between a sale and a license. Find the words exclusive or non-exclusive, the end date, and the sentence about a later sale of the business. If those words are missing, the question is still open.
Does the copy still identify a person?
Ask whether a person can still be singled out, including with extra information the buyer or you still hold. Pseudonymization is the Article 4(5) word for processing that leaves the data unattributable to a specific person only when that extra information is kept separate. Recital 26 says data that can be tied to a person with additional information is information on an identifiable person. A label on a slide is not that test.
"We anonymized it," with no clause, leaves the question open. De-identification is a process step. It is not, by itself, a finding that no person could be recognized. Read employee privacy when companies sell data to AI before you decide what staff can be in the copy. Ask for the clause that says what was removed and what extra information still exists. If the answer is only a feeling, the question is not answered.
What happens to the copy at the end of the term?
Ask what happens when the term ends. The usual answers are deletion, return, or a model that still embodies the records. The clause should pick one, and it should say what evidence you get: a certificate, a confirmation, or a surviving sentence that the model may remain. "We'll keep it safe" does not name an end date.
Read that clause next to the exclusivity clause. A short term that leaves a trained model in place is a different deal from a short term that requires deletion. Ask which one the agreement chooses. If the agreement is silent, ask for the sentence in the agreement. A meeting note is not the clause. You should leave with the clause, or with the certificate the clause promises.
Can we keep using our systems and sell the company later?
Ask whether you keep ownership, whether you can keep using the systems in the business, and whether an exclusive license collides with a later buyer of the company. Ownership stays with you unless the contract assigns it. The question is whether this contract assigns it. "You will be able to sell" is a prediction. Get that promise into the agreement.
Look for a sentence that says the company retains ownership and may go on using the records, and a sentence about what a future buyer of the company must be told. If the license is exclusive, a buyer in diligence will read that promise. Ask, and get the answer in the agreement, before you sign. Signing the license leaves the company sale for a later agreement.
Who is liable if a person is identified later?
Ask for the indemnity and the cap. The clause should say who pays if a person is later identified from the copy, what that payment covers, and the limit on it. "That won't happen" is a prediction. The clause has to name who pays.
Ask your lawyer what the indemnity and the cap do once they are in the agreement. The question for the buyer is whether those clauses exist, who gives them, and what number or formula caps them. An agreement with no indemnity, and a conversation that says you are protected, has not answered the question. Write the answer into the contract or treat it as missing.
What does our customer privacy notice already promise?
Read the notice you already gave customers. The clause to look for is any sentence that says you do not sell personal information, or that you do not transfer it to unaffiliated persons. If the notice forbids that transfer, a sale or lease of that information has to be consistent with the policy, or it needs court approval under 11 U.S.C. § 363(b)(1)(B).
"The old notice does not matter" ignores the notice you already gave customers. If a bankruptcy case is the setting, ask your lawyer about a consumer privacy ombudsman. Ask your lawyer how the notice you actually gave customers lines up with the license in front of you. Do not replace the notice with a summary someone remembers.
What records must we keep even after a copy leaves?
Ask which records you must keep even after a copy is licensed. "The buyer stores the archive, so we can delete ours" would throw away your tax file.
Match the document to the IRS page on how long to keep records, and keep the original you are required to keep. The order of a close around those files is in how to wind down a company. Put the retention answer in the same folder as the exclusion list, so the person who deletes a system can see what must survive the deletion.
What are we paid, when, and what ends the deal?
Ask the price, the currency, who pays whom, the conditions that have to be true before payment, and what ends the deal. The clause should contain those pieces. "We'll pay the market" names neither a currency nor a date. If a condition can cancel the payment, the clause should say so in the same section as the price.
Name your own price in the contract. Public figures, where they exist, are on how much do AI companies pay for company data. Ask what happens if you terminate, what happens if they terminate, and whether money already paid stays paid. A term sheet that leaves those blanks is not an answer to the question.
Written answers from one vendor
Answers written for a single buyer describe that buyer's offer.
Our terms are on company data license agreement terms. Use them as one set of written answers, then ask whoever is across the table, including us. Read the clause in any other buyer's agreement even after you have read our terms. If a sentence in our terms is unclear, ask again. You can ask these questions even if you never contact Vetrix.
If you never license anything
Several of these questions are worth asking even when no data buyer is involved.
The privacy notice, the tax records you must keep, and any exclusive promise you might make in an asset sale still matter in a shutdown. A notice that forbids transfers is still the notice you gave customers. A copy that never leaves does not end the duty to keep the records the IRS describes. Other ways value can leave a closing company are in how to recover value from a closing company. For customer records in a close, read how to handle customer data when closing a business. More closing tasks are in the guides to closing, selling or licensing a company.
General information only. This is not legal, tax or financial advice.
Related
- Guides
How-tos and lists for closing a company, selling one, or licensing its records.
- License terms
The four license terms: what you give, keep, agree, and sign.
- Selling vs licensing data
What changes if a company sells records instead of licensing a de-identified copy.
- What's shared
Which records can be licensed, which details never leave, and what you approve.
- How to sell company data
How to sell or license company data to AI companies, and which route fits.
- Employee privacy when companies sell data to AI
Critics, re-identification research, and what a careful program tells staff before any license.
Questions about questions before a data license
Why is "trust us" a failed answer on a data license?
A vague answer is not an answer. Ask for the clause that names who else can receive the copy: affiliates, subprocessors, or anyone who trains a model. If the reply is a promise with no clause, you still do not know the legal name of the licensee or whether the copy can move. Ask for that clause before you talk about price.
How do we ask whether the licensed copy is still personal data?
Ask whether a person can be singled out if the buyer, or you, still hold extra information. Article 4(5) uses pseudonymization for the step that keeps that extra information separate, and the data can still be personal. Recital 26 treats data that extra information can tie to a person as information on an identifiable person. Ask with those two definitions, and do not accept a label in their place.
What should we ask about how long the buyer keeps the copy?
Ask what happens when the term ends: the copy is deleted, the copy is returned, or a model still embodies the records. Ask which of those three the contract chooses, and what evidence you receive, such as a certificate or a surviving clause. A term measured in years, with no end-of-term sentence, has not answered the question.
Does a data license replace our duty to keep tax records?
No. The IRS says the length of time you keep a document depends on the action, expense, or event the document records. A license of a copy does not end that duty. Match each document to that IRS page. Keep the originals you must keep, and treat the licensed copy as a separate file.
Which of these questions matter if we never talk to a data buyer?
The privacy notice you already gave customers, the tax records you must keep, and any exclusive promise you might make in an asset sale. A notice that forbids transfers still matters if the company later files for bankruptcy. Vetrix's written terms are optional. You should still ask who would receive a copy, what it would contain, and what your privacy notice already promised.
Sources
- EUR-Lex. Regulation (EU) 2016/679, Article 4. Checked 2026-11-04
- EUR-Lex. Regulation (EU) 2016/679, Recital 26. Checked 2026-11-04
- U.S. House of Representatives. 11 U.S.C. § 363, Use, sale, or lease of property. Checked 2026-11-04
- Internal Revenue Service. How long should I keep records?. Checked 2026-11-04
- Vetrix Labs. Company data license agreement terms. Checked 2026-11-04