What "selling" usually means
Most deals are licences. The company keeps its original records and grants a buyer the right to use a de-identified copy for set purposes, such as training or evaluating AI models, for a set term. The terms that matter most are scope (which systems and years), exclusivity, deletion at the end, and a ban on re-identifying anyone.
What AI developers want
Buyers want the record of how work actually happens, not polished outputs. Labelbox Prism, for example, lists operational workflows, human decisions and escalation paths, expert reviews and corrections, and edge cases among the most valuable data. Turing says a long, well-preserved operating history is worth more than a short one.
- Support tickets with the recorded outcome.
- Email and team chat where decisions were made.
- CRM history, especially win and loss reasons.
- Code with pull-request and review history.
- Documents and SOPs: procedures, proposals, project write-ups.
Who buys
Several AI data programmes publish their terms. Handshake AI advertises $100k–$4m for companies with 20+ full-time staff and 3+ years in operation. micro1 advertises $200k–$2m+ for companies with 30+ employees. AfterQuery welcomes operating, winding-down and closed companies with several teams and a few years of history. These are advertised ranges, not offers. Our buyer comparison sets out eight programmes side by side, with sources.
What to check before you start
- Ownership. The workspaces should belong to the company, not to staff members' personal accounts or a client's systems. Content created by contractors or freelancers may belong to them unless it was assigned to the company.
- Contracts. Customer contracts may restrict how their information is used. Data you process on a client's behalf, as their processor, is theirs.
- Sensitive data. Health records, children's data, criminal records and HR files stay out entirely.
- Purpose compatibility. Using old records for a new purpose needs an assessment under UK GDPR Article 8A, usually alongside a legitimate interests assessment.
- Transparency. Privacy notices should tell staff and customers about the new use before it starts (UK GDPR Articles 13 and 14).
How the process runs
- Inventory the systems, years and approximate volumes.
- Check rights and agree what's excluded.
- Complete the data protection assessments.
- De-identify a sample inside your own systems and test it with a motivated intruder test, as the ICO describes.
- Send an unnamed profile to several buyers and evaluate interest under NDA.
- Agree the licence, then deliver the cleaned copy.
Buyers publish fast timelines: AfterQuery replies within three business days, and Turing confirms its figure after sampling, usually within a week. The preparation on your side is what takes time.
Frequently asked questions
Is it legal to sell company data to AI developers in the UK?
It can be, if it's done properly. Business records usually contain personal data, so you need a lawful basis, an assessment that the new use is compatible with why the data was collected (UK GDPR Article 8A), updated privacy notices, and exclusion of sensitive categories. Every case is different, so take advice on yours.
Do we lose ownership of our data?
Usually not. Most deals license a de-identified copy for a set purpose and term; the company keeps its originals. Check the licence for exclusivity, deletion and permitted use before signing.
How big does a company need to be?
Published programmes mostly ask for 20 to 30 or more staff and several years of records, but some accept smaller or closed companies. Depth of history and the variety of systems matter as much as headcount.
Will buyers know which company the data came from?
Profiles can be shared unnamed at first. What a buyer learns later, and what it can say about the source, is set by the licence.
Related
Sources
- Labelbox Prism, FAQs
- Turing, Project Lazarus
- Handshake AI, employer data partnerships (Apr 2026)
- Handshake AI, License your data
- micro1, Company data partnerships
- AfterQuery, Data partnerships
- UK GDPR, Article 8A (purpose compatibility)
- UK GDPR, Article 13 (information to be provided)
- UK GDPR, Article 14 (information where data not obtained from the data subject)
- ICO, Anonymisation guidance
- ICO, Controllers and processors
Figures are each buyer's own published wording, checked on 30 October 2026. Advertised ranges are not offers. Record Yield isn't affiliated with or endorsed by any of the companies named. This page is general information, not legal advice.