Your company's records may be worth money

Data licensing means giving a buyer defined rights to use your company’s own operational records, such as procedures, support tickets, CRM history and project files, while you keep your copy. A buyer reviews the records and decides whether to make an offer, and the price depends on what the records hold and the terms you agree.

Which company records buyers license

AI labs want examples of how real companies do their work, and the public web does not hold them. Buyers license records like the ones below. The last column is our own reading of the personal-data load and is not a rule.

Licensing is different from selling customer lists

Search results mix two different things. Licensing your own operational records is the first. Who removes personal data, and when, depends on the buyer. Selling lists of customers or staff is a separate market that involves personal data directly, and UK GDPR applies to it from the first step. This site covers the first and gives no help with the second.

What moves the price

We know of no standard method for valuing company records. The factors below are our own reading of what makes records easier or harder to license:

• Years of history. History cannot be recreated, so a long, continuous record is hard for a buyer to replace.
• Domain depth. Records specific to your field are hard for a buyer to replace. Generic records are easier to replace.
• Breadth. Records from several teams and business functions cover more of how the company works than one team’s files do.
• Structure. Consistent fields, linked records and few gaps need less preparation. A ticket linked to its resolution is more useful than a free-form dump.
• Personal-data load. The more personal data is mixed in, the more removal work and legal risk there is.
• Ownership and exclusivity. Clear ownership keeps more of your data in scope, and giving up the right to license the same records again should show up in the price.

What your company must own

A company can license only the data it owns. Records you hold for clients under a contract or NDA are usually not yours to license. Read client contracts, supplier terms and NDAs before you list a system.

Personal data sets a second limit. Under UK GDPR, personal data is any information relating to an identified or identifiable person. Truly anonymous information falls outside the law, but anonymising records is itself processing that needs a lawful basis, and removing names alone is not enough. Pseudonymised data is still personal data. Our guide to anonymising company records sets out the ICO’s test.

The ICO says you must use the motivated intruder test to assess the risk. It asks whether a reasonably competent person, with access to resources such as the internet, libraries and public documents, would succeed in identifying someone. In our reading, this matters most for support tickets, emails, chat logs and CRM notes. Their free text carries names, and also job titles, locations, account numbers, dates and project names that can point to one person.

Treat staff records as the highest-risk part of the inventory. The ICO’s employment guidance covers sharing workers’ information in a reorganisation or insolvency. It says to establish a lawful basis for sharing, tell workers and document your decisions.

If your company holds personal data for clients as their processor, UK GDPR lets it act only on the client’s documented instructions. A processor that decides its own purposes is treated as a controller for that processing. That is a reason to take advice before you list any system that holds client personal data.

If the company is closing

Timing changes the answer. On a voluntary strike-off, the directors deal with the company’s assets before they apply, and when the company is dissolved its remaining assets pass to the Crown. In a liquidation, the liquidator takes control of the company, and the directors must hand over its records and paperwork. In administration, the directors hand control to the administrator.

No official source we read says whether company records count as property that a liquidator or administrator can sell or license, or who signs a data licence for a company in either process. So agree any licence before the closure step, with advice from a solicitor and, where one is involved, the practitioner. Our guide to closing a limited company shows who controls the records on each route, and how long to keep business records covers what the law asks you to keep.

How a deal runs

Agree the scope, the handling of personal data and any approvals in writing before anything is shared. A buyer may describe its process on its own site. The signed agreement is what binds both sides, so check that it says the same.

UK law puts responsibility for personal data on your company, so ask the buyer four questions in writing before you share anything:

1. Who removes or anonymises the personal data, and when?
2. Does it act for your company as a processor, or on its own account as a controller?
3. Where will the data go, and which transfer rules apply?
4. What happens to the data when the licence ends?

The answers set your duties. If the buyer acts as your processor, it may act only on your documented instructions, under a contract (Article 28(3) of UK GDPR). If records that still hold personal data leave the UK, the ICO says every restricted transfer must be covered by UK adequacy regulations, appropriate safeguards or an exception. Properly anonymised data raises no transfer question under that rule.

The ICO says to use a data protection impact assessment (DPIA) to structure and document your anonymisation decisions, and to record your key decisions and the reasons for them. Take advice before you share any records that still hold personal data.

What to check in a licence agreement

A data licensing agreement sets what the buyer may do with your records. Before you sign, check how it handles:

• Rights granted. What the buyer may use the records for, and whether it may pass them on.
• Exclusivity and duration. Whether you can license the same records to anyone else, and for how long.
• Personal data. Who removes or anonymises it, whether the buyer acts as your processor or on its own account, and where the data may go.
• Re-identification and copies. Whether the buyer may use the records only for the agreed purpose, must not try to re-identify anyone and may make only limited copies. The ICO lists safeguards like these for limited-access sharing, and in our reading a licence to one buyer is closer to limited access than to open release.
• Warranties and indemnities. What you promise about ownership, and who pays if a promise proves wrong.
• Deletion. When the buyer deletes its copies, and whether it must tell you.
• Payment. What triggers it, whether it comes in one payment or several, and what happens if the buyer rejects part of the data.

Have a solicitor read the agreement before you sign, and ask your accountant how the fee will be taxed.

Check the records before they are destroyed

Some company records can be licensed for AI training. Answer four questions to see whether yours might qualify, without sharing any files.

Check eligibility

Next steps

Use the eligibility check to see whether your company fits our referral rule. If it has fewer than 30 employees, the sections above on ownership and personal data still apply to any buyer you approach.