At a glance
| First step | Don't sign, share logins or connect any system yet |
|---|---|
| Check the buyer | Who they are, where they're based, and who would actually hold the data |
| Check the scope | Which systems, which years, and what's excluded |
| Check the licence | Exclusive or not, how long, and what happens at the end |
| Check the cleaning | Who de-identifies the data, and where |
| Check the protections | No re-identification, deletion at the end, no onward sharing |
| Free second opinion | Send us the offer before you sign |
Is the offer genuine?
- Find the legal entity behind the offer. For a UK company, check it on the Companies House register; for an overseas buyer, find out where it's registered and where the data would be held.
- Check the person contacting you works for that organisation, using its own website rather than links in the message.
- Never send passwords, admin access or sample exports in reply to an unsolicited message.
- If an intermediary approached you, ask who they act for and how they're paid. It's a fair question, and a clear answer is a good sign.
What exactly would they get?
Pin down the scope in writing: which systems (email, chat, tickets, CRM, code, documents), which years, roughly what volume, and what is excluded. HR and payroll, health, union, legally privileged and customer-confidential material should normally stay out entirely. Records you hold for a client, as their processor, aren't yours to license.
Is it a sale or a licence?
- A licence lets the buyer use a copy for set purposes and a set term, and you keep your records. Most AI data deals are licences.
- Exclusive or not? An exclusive licence stops you licensing the same data to anyone else, so it should be worth more. A non-exclusive licence lets you license the same de-identified copy again.
- Term and end. How long it lasts, and whether the buyer must delete the data at the end, with confirmation.
- An outright sale of the records is rarer and harder to undo. Be clear which you're being offered.
Who would clean the data, and where?
Ask whether the buyer expects raw data, or access to your systems, so it can de-identify the data itself, or whether de-identification happens inside your environment before anything leaves. It changes what you disclose and what you're responsible for. See who cleans the data.
Would they need access to our systems?
Read-only access still shows everything in the system. If access is part of the offer, ask which accounts, for how long, what's logged, how it's revoked, and what happens to anything copied.
What stops anyone being re-identified?
The licence should ban re-identifying anyone, or trying to. Re-identifying de-identified personal data without consent can also be a criminal offence under section 171 of the Data Protection Act 2018. Ask how the buyer tests re-identification risk, and whether you'll see the result.
When and how would we be paid?
Offers vary widely, so get the payment terms in writing and check them against the delivery terms:
- Is the price fixed, staged, or dependent on what the buyer later accepts?
- What are the acceptance criteria, and what happens if the buyer rejects part of the data?
- When is each payment due: on signing, on delivery, or after acceptance?
- Are there deductions, set-offs or clawbacks?
- Is the headline figure an offer, or an advertised range?
Is the deadline real?
An offer that expires within days, or a request to sign before you've seen the full contract, is a reason to slow down. Comparing more than one buyer usually tells you more about value than a single number does.
What about our staff and customers?
- Using old records for a new purpose needs an assessment of whether it's compatible with why you hold them (UK GDPR Article 8A), usually with a legitimate interests assessment.
- A data protection impact assessment is normally expected for this kind of processing.
- Privacy notices should tell people about the new use before it starts (UK GDPR Articles 13 and 14).
- Check customer contracts for restrictions on how their information can be used.
Frequently asked questions
Should we reply to an unsolicited offer for our data?
You can, but verify who the buyer is first, and don't share logins, access or sample data until you've agreed scope and protections in writing.
Is it normal for a buyer to ask for access to our systems?
Some buyers do ask, so that they can de-identify the data themselves. Read-only access still exposes everything in the system, so ask exactly what access, for how long, and what happens to anything copied.
Can we license the same data to more than one buyer?
Yes, if the licences are non-exclusive. An exclusive licence stops you licensing that data to anyone else, so check which you're being offered.
Will you look at an offer we've received?
Yes. Send it to us before you sign and we'll review the commercial terms for free. It's not legal advice.
Related
Sources
- Companies House, Find and update company information
- Data Protection Act 2018, section 171
- UK GDPR, Article 8A (purpose compatibility)
- UK GDPR, Article 13 (information to be provided)
- UK GDPR, Article 14 (information where data not obtained from the data subject)
- ICO, Data protection impact assessments
- ICO, Anonymisation guidance
Last reviewed 30 Oct 2026 by Record Yield. Provider terms and legislation were read on that date and can change. This page is general information, not legal advice.