Legal
Is it legal to sell company data to AI companies?
A company that licenses its own records gives a US-based AI data company a right to use a copy with personal details removed. The company keeps ownership and full use. Whether that arrangement is allowed depends on the records, the contracts, and the law where the company operates. Each section below quotes the rule from its source. This is general information, not legal advice.
Up to $150K · $0 cost · 3 days
What is removed before anything leaves
Personal details are removed before anything leaves your company. What is shared, and what is never shared, sits in one place.
Is selling company data to AI safe? See the system-by-system answer.
We call the licensed copy de-identified: personal details are removed. We don't call it anonymous. Anonymous, under the GDPR, is a legal test quoted below, not a label.
GDPR
Whether your license meets each test below is a question for your lawyer.
What Recital 26 says
GDPR Recital 26 says the principles of data protection do not apply to anonymous information, and that personal data which has undergone pseudonymization and could be attributed to a person by additional information is information on an identifiable natural person. Identifiability takes account of all the means reasonably likely to be used.
The recital's words are: "Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information."
That is a legal test, not a label for a file that has had names deleted.
Pseudonymization is still personal data
Article 4(5) defines pseudonymization as processing so that personal data can no longer be attributed to a specific person without additional information, kept separately and subject to technical and organizational measures.
The ICO says pseudonymized personal data is in scope of data protection law, and that pseudonymization is not a way of taking personal data outside the law. Pseudonymized data is personal data for a party that holds the additional information. A recipient that does not hold that information may be holding anonymous information.
EDPB Guidelines 01/2025, headed as adopted on 16 January 2025, say pseudonymized data that could be attributed to a person by additional information remains personal data, including when that additional information is held by someone else.
Removing names, by itself, is not the recital's idea of anonymous information.
UK GDPR
The UK GDPR text draws the same line in recital 26: anonymous information falls outside the regulation, and pseudonymized data that can still be tied to a person does not. Whether it applies depends on where the company operates and whose data is in the records.
Vetrix's privacy notice follows the Nigeria Data Protection Act 2023 and, where they apply, the UK and EU GDPR. That line covers the enquiry form, not the licensed records.
Read the Vetrix Labs privacy notice for how the form is handled.
Nigeria Data Protection Act 2023
The Nigeria Data Protection Act, 2023 is the Act published in the Federal Republic of Nigeria Official Gazette No. 119 of 1 July 2023.
Section 2 applies the Act where the controller or processor is domiciled, resident, or operating in Nigeria, where processing takes place in Nigeria, or where a controller or processor outside Nigeria processes personal data of a data subject in Nigeria.
Vetrix's privacy notice cites the Nigeria Data Protection Act 2023 for the enquiry form. That citation covers the form. It does not decide a license of company records.
United States
Sector laws, including HIPAA
HHS states the scope this way: The HIPAA Rules apply to covered entities and business associates. An entity that is neither a covered entity nor a business associate does not have to comply with the HIPAA Rules. Covered entities are health care providers that conduct standard electronic transactions, health plans, and health care clearinghouses, and business associates have their own duties.
Many ordinary companies are not covered entities. Whether your company is one is a question for your lawyer.
State laws and contracts
Your own contracts can restrict a license. Customer terms, employment agreements, and vendor terms are the usual places. State privacy laws can restrict one too. If a state privacy law matters to your records, your lawyer is the person who reads it.
The employees section covers staff contracts and IT policies.
Bankruptcy and liquidation
Who controls the assets
In a US bankruptcy, an office holder controls the assets of the estate. In a liquidation, a liquidator or an equivalent office holder controls the assets. Day-to-day managers are not the people who sign once that handoff has happened.
Vetrix's own process asks who has the right to license. A company in bankruptcy or liquidation should expect the office holder to be the one who can sign. That is a rule of the program. What the Bankruptcy Code allows the office holder to do is a question for your lawyer.
For the practical steps in that situation, see selling company data in bankruptcy.
Consumer privacy ombudsman
Section 363(b)(1) provides that if a privacy policy in effect at the start of the case prohibited transfer of personally identifiable information to unaffiliated persons, the trustee may not sell or lease that information unless the sale matches the policy, or the court approves it after a consumer privacy ombudsman is appointed under section 332.
If a hearing is required under 11 U.S.C. §363(b)(1)(B), section 332 requires the court to order the United States trustee to appoint one disinterested person as consumer privacy ombudsman, not later than 7 days before the hearing. The ombudsman may be heard on the debtor's privacy policy and on the effect on consumers. The ombudsman may also be heard on alternatives that would reduce the privacy loss.
Not every sale of business records uses an ombudsman. The hearing in §363(b)(1)(B) is the trigger: the path used when the sale does not match the privacy policy. A sale that matches the policy is a different branch of the same subsection.
Employees
We do not share who did the work.
Read your employment contracts and your IT policies before you sign. Your lawyer reads them with you.
What is never shared includes staff details.
Employee privacy when companies sell data to AI is a separate question from the rules above.
Rights you have to hold first
Data that belongs to a client or a former parent company must be cleared first. That is a condition of the program. It is about the right to license, not a theory of who owns the work.
The company data license agreement terms set out what you keep and what you agree.
Talk to your lawyer before signing
The licensing agreement is with the data partner. We recommend your lawyer reviews it first. Vetrix does not give legal advice.
General information only. This is not legal, tax or financial advice.
Your lawyer should read the agreement you are shown before anyone signs. That agreement is what governs. Read the license terms before that meeting.
How does company data licensing work? See where your lawyer comes in.
Once a lawyer has read the agreement, the practical path is how to sell company data to AI companies.
Related
- What's shared
Which records can be licensed, which details never leave, and what you approve.
- License terms
The four license terms: what you give, keep, agree, and sign.
- How it works
The six steps from a short enquiry to payment, and how to stop.
- Privacy
How Vetrix Labs handles enquiry details. No cookies and no analytics.
Questions about the law
Does the GDPR apply to information that is truly anonymous?
No. Recital 26 says the regulation does not concern anonymous information, meaning information that does not relate to an identified or identifiable natural person, or personal data rendered anonymous so the person is no longer identifiable. That is a legal test, not a label we put on a licensed copy. The recital also says identifiability takes account of means reasonably likely to be used. Removing a name is not, by itself, that test.
Is pseudonymized data still personal data under the GDPR?
Yes, where additional information could still tie the data to a person. Article 4(5) and Recital 26 both treat that situation as personal data. Deleting a name, with nothing more, is not the recital's test for anonymous information. The extra information has to be kept separately before that definition is even in play.
Does HIPAA apply to every company's business records?
No. The U.S. Department of Health and Human Services states that the HIPAA Rules apply to covered entities and their business associates. A company that is neither does not have to comply with those Rules. Many ordinary companies are not covered entities. Whether a particular company is one is a question for its lawyer. Covered entities are certain health care providers, health plans, and health care clearinghouses.
When can a US bankruptcy court involve a consumer privacy ombudsman?
When a hearing is required under 11 U.S.C. §363(b)(1)(B) because a privacy policy barred transfer of personally identifiable information, section 332 provides for a consumer privacy ombudsman. The court orders the United States trustee to appoint one disinterested person before that hearing. It is not a feature of every sale of business records. A sale that matches the privacy policy follows a different path in the same section.
Does Vetrix share which person did the work?
No. Who did the work stays off the licensed copy. Read the employment contract and the IT policy with your lawyer before you sign. You choose which systems are included, and personal details come off before anything leaves the company.
Do we still need our lawyer to review the agreement?
Yes. Bring the agreement to your own lawyer before anyone signs. Warranties, a term of years, and a withdrawal right belong in that agreement, if they are covered there at all. We recommend that review. Quoting a statute does not replace your lawyer's reading of the agreement.
Sources
- EUR-Lex. Regulation (EU) 2016/679, Recital 26. Checked 2026-11-04
- EUR-Lex. Regulation (EU) 2016/679, Article 4(5). Checked 2026-11-04
- Information Commissioner's Office. Pseudonymisation. Checked 2026-11-04
- European Data Protection Board. Guidelines 01/2025 on Pseudonymisation, adopted 16 January 2025. Checked 2026-11-04
- legislation.gov.uk. UK GDPR, Recital 26. Checked 2026-11-04
- Federal Republic of Nigeria. Nigeria Data Protection Act, 2023. Checked 2026-11-04
- Federal Republic of Nigeria. Nigeria Data Protection Act, 2023, section 2. Checked 2026-11-04
- U.S. Department of Health and Human Services. Covered Entities and Business Associates. Checked 2026-11-04
- Office of the Law Revision Counsel. 11 U.S.C. §332. Checked 2026-11-04
- Office of the Law Revision Counsel. 11 U.S.C. §363. Checked 2026-11-04