- Who created the data, what your privacy notices said, and what contracts allow decide whether you can license it.
- Sector laws such as HIPAA, GLBA, FERPA and Illinois BIPA add specific limits.
- Most issues can be resolved by excluding data, de-identifying it or getting consent.
What the checker looks at
- Ownership. Content your staff created in their jobs is usually yours. Content customers, users or contractors created may not be.
- Privacy notices. What you told people when you collected their data.
- Contracts. Customer agreements, NDAs and platform terms can prohibit sharing.
- Sector laws. Health, financial, education and biometric data have their own rules.
- Personal information. Whether it can be removed before transfer.
After the checker
Resolve red items before talking to buyers. Amber items usually need exclusions or de-identification. Then describe the data with the data manifest template.
Read is selling company data legal? and state privacy laws.
Read next
Questions
Is the result legal advice?
No. It flags issues to discuss with a lawyer and with us. Every data set needs its own review.
Sources
- California Attorney General: California Consumer Privacy Act (CCPA)
- US HHS: Guidance on de-identification of protected health information under HIPAA
- Illinois General Assembly: Biometric Information Privacy Act (740 ILCS 14)
- Frankfurt Kurnit Klein & Selz: Selling company data for AI training, what to know before you say yes