Can you sell customer data? GDPR, anonymization and lawful basis

Can you sell customer data? The question comes up more and more now that AI companies are looking for real business communication to train their models. The answer is rarely a simple yes or no. Customer data almost always contains personal data, and then GDPR governs what you may do. In practice, it is rarely about selling customer lists – it is about licensing content such as support tickets, email threads or CRM history after the personal data has been dealt with.

This guide is an overview and not legal advice. National rules and guidance vary. Before an actual deal, you need an assessment of your specific data, agreements and business.

Short answer: can you sell customer data?

You can't assume it is allowed just because the data is in your systems. For customer data to be used as training data, three things usually need to be in place:

1. There is a lawful basis for the new processing.
2. The new use is compatible with the original purpose for which the data was collected.
3. The personal data is de-identified as far as possible before anything leaves you.

On top of that come customer agreements, confidentiality obligations and platform terms. That is why we always assess rights and personal data first, and prioritize data without personal data.

What counts as customer data?

"Customer data" can mean very different things, and the difference matters:

• Customer lists – names, contact details, purchase history. This is pure personal data and rarely interesting as training data in itself.
• Communication – emails, chats and support tickets. Valuable for AI because it shows how problems are solved, but full of names, addresses and details about individuals.
• Business history in a CRM – notes, quotes and deal histories. Can contain both personal data and trade secrets.
• Aggregated or technical data – statistics, product data, error logs with no link to individuals. Often much simpler.

Even when the customers are businesses rather than consumers, there are almost always contacts with names and email addresses, and that is personal data.

Lawful basis: legitimate interest is not automatic

Many companies process customer data on the basis of a contract or legitimate interest. But the lawful basis for delivering a service doesn't automatically cover using the same data to train someone else's AI model.

In Opinion 28/2024, the European Data Protection Board (EDPB) clarified that legitimate interest is not an automatic basis for AI training. It requires a documented balancing test in which your interest and the buyer's are weighed against the rights and reasonable expectations of the data subjects. The more privacy-sensitive the data, and the less customers could reasonably have expected such use, the harder that balancing becomes.

Purpose limitation: is AI training compatible with the original purpose?

GDPR is built on personal data being collected for specified purposes. European data protection authorities have stressed that reuse for AI training must be compatible with the original purpose. Data collected to handle a product complaint can't simply be reused for an entirely different purpose.

Questions that usually decide it:

• What link is there between the original purpose and the AI training?
• What information were customers given, and what could they reasonably expect?
• How sensitive is the data?
• What safeguards are in place, such as de-identification?

Anonymization and pseudonymization

The most common way to make customer data usable is to remove the link to individuals. It is important to distinguish between two concepts:

• Pseudonymization means names and identifiers are replaced with codes or placeholders. The data still counts as personal data, because the link can in principle be restored.
• Anonymization means no person can be identified any longer, directly or indirectly. The threshold is high, and in free text such as emails and chats it is hard to reach – a detail about a town, a time and a job title can be enough to single someone out.

A provider calling data "anonymized" therefore doesn't say much on its own. The question is whether the data actually is anonymous, and that requires careful assessment of the method and context. Read more in our overview of GDPR and anonymization.

Synthetic data is no shortcut

A common suggestion is to create synthetic data from the real customer data and only license the synthetic version. Data protection authorities have pointed out that generating synthetic data from personal data is itself processing of personal data. That means the same lawful basis and purpose requirements apply to the generation itself. Synthetic data can be part of the solution, but it doesn't replace the assessment.

Data that can't be licensed

Some types of data are excluded from the outset or require so much that it is rarely worthwhile:

• Health data and other special categories under Article 9 GDPR. We don't broker such data.
• Data where customers were explicitly promised that it would only be used for a specific purpose.
• Material under confidentiality obligations to customers or partners that prevent further use.

It is better to establish early that a dataset won't work than to spend time on something that gets stopped later anyway.

Don't forget agreements and platform terms

GDPR isn't the only thing that matters. Also review:

• Customer agreements – are there clauses on confidentiality or limits on how customer data may be used?
• Vendor terms – in some systems, what you may do with exported data is governed by the platform's terms. Salesforce has reportedly restricted bulk export and LLM training through Slack's API terms. How you can export your own archives needs legal review.
• Employee communication – support tickets and emails also contain your staff's writing. Workplace privacy rules may apply, and depending on your country, employee representatives or a works council may need to be consulted.

Common misconceptions

A few beliefs come up again and again when companies think about customer data and AI:

• "It's our data, so we decide." You may own the systems and have rights to the content in a business sense, but the data subjects still have their rights under GDPR.
• "Our customers are businesses, so GDPR doesn't apply." Contacts, case handlers and signatories are private individuals in GDPR's sense.
• "We remove the names, so it's anonymous." Free text often contains indirect details – job titles, towns, order numbers – that still allow people to be identified.
• "The buyer takes responsibility." Both the party disclosing data and the party receiving it have their own obligations. Responsibility can't be passed on.
• "An agreement is enough." An agreement between you and the buyer doesn't replace a lawful basis with respect to the people the data is about.

Knowing these misconceptions makes it easier to ask the right questions early.

A cautious order of work

If you are considering licensing content based on customer data, you can work in this order:

1. Map which data sources are involved and what types of personal data they contain.
2. Set aside what clearly won't work, such as health data and material under confidentiality promises.
3. Review purpose and information – what did you tell customers when the data was collected?
4. Carry out a balancing test and document it, if legitimate interest is relevant.
5. Plan de-identification and realistically assess whether the result will be anonymous or only pseudonymous.
6. Bring in legal review before any agreement is signed.

With us, the first step is always an assessment of exactly this, and it is free. You describe the data in a short form without sending any files. Nothing is shared until there is a non-disclosure agreement and an offer you have approved, and delivery only takes place after de-identification. To see how it works for a specific data source, read about customer service data or CRM and business data.

Summary

Can you sell customer data? Not in the form it usually has, and never without the GDPR questions having been worked through. A lawful basis requires a documented balancing test, the new use must be compatible with the original purpose, and de-identification is almost always necessary – but no guarantee. What often remains after a careful review is content with no link to individuals, and that is where a license can become possible. Always start from a legal assessment of your own case.