Is it legal to sell company data for AI training?

01"Selling" vs "licensing" company data

Most AI data programmes license data: you grant permission to use an agreed copy for agreed purposes, and you keep ownership. micro1, for example, says companies retain ownership of their underlying data. The licence terms (use, exclusivity, duration, resale, deletion) matter more than the word "sell".

02What's usually straightforward, and what isn't

The lowest-risk material is documentation your company created and controls, with little or no personal data in it: SOPs, checklists, playbooks, internal wikis, templates and process documents, and project workflows once personal details are removed. The harder material is anything that belongs to someone else or describes a person.

03What can limit what you share

1. Client contracts and NDAs

Many client agreements restrict how you use information you received while doing the work. Material that belongs to clients, or that you hold under confidentiality, usually has to be excluded or cleared first.

2. Personal data (UK GDPR and US state laws)

• UK and EU: if records contain personal data (staff or customer names, emails, notes about people), UK GDPR applies. You need a lawful basis, and using data for a new purpose has to be compatible with why it was collected, or have its own basis. People may need to be told. The ICO says that if you collect personal data intending to sell it, you must say so in your privacy information. Properly anonymised data falls outside UK GDPR; pseudonymised data (names swapped for codes) does not.
• US: there's no single federal privacy law. State laws like California's CCPA give rights over the "sale" and "sharing" of personal information, and since 2023 that includes employee data (California Privacy Protection Agency). Sector laws also apply, such as HIPAA for health information.

Programmes usually de-identify data (micro1 says it removes or transforms personal information before sharing). But the legal responsibility for what you hand over still starts with you.

3. Employee data

Employee records are sensitive. In the Spirit Airlines data sale (Google won the auction with a $10M bid in August 2026; court approval was pending at the time of writing), unions and more than 120 US lawmakers objected over employee information in the dataset. Treat HR, payroll, disciplinary and medical records as out of scope unless a lawyer says otherwise.

4. Privileged, regulated and sensitive material

• Legal advice (privilege can be lost)
• Payment card and financial account data
• Health information
• Children's data
• Anything export-controlled

Leave all of these out.

5. Who owns the work

Check that staff and contractor agreements assign work product to the company. Most employment contracts do; contractor agreements may not.

6. Selling the company later

A data licence may need disclosing in due diligence. Check whether it transfers to a buyer.

04UK and US at a glance

05A practical checklist before you apply

1. List your systems and how many years of history each holds.
2. Separate your own process documents from client material.
3. Flag records with personal data and decide what to exclude.
4. Check client contracts and NDAs for use restrictions.
5. Name an owner internally, and involve your lawyer before signing.
6. Before signing, ask the programme about: term, use (can models trained on your data be commercialised?), exclusivity, resale or onward use, restrictions, retention and deletion, and security.