Privacy, consent and third-party data when licensing company data
The first question most founders ask about licensing company data is not about price. It is whether they are allowed to. Your Slack history, tickets and documents contain names, emails and opinions of employees, plus details of customers, clients and suppliers. This guide explains whose data is in your records, what privacy law and contracts generally expect, and how to approach a licence so that it is lawful and fair.
Cadabra is an independent referral partner of micro1 and may earn a referral fee if a company we introduce completes a data partnership. This is general information, not legal advice.
Whose data is in your records?
Before thinking about law, map the people who appear in the data. In a typical company archive there are four groups.
Employees and contractors
Chat messages, emails and documents carry names, work emails, job titles and sometimes personal remarks. Former staff are included too. This is personal data, even when it sits in a business tool.
Customers and their end users
Support tickets and CRM notes describe real customers, often with contact details, account information and the problems they reported.
Clients you work for
Agencies, consultancies and service firms hold material that belongs to or describes their clients. That content is frequently covered by NDAs or data processing agreements, which can matter more than privacy law itself.
Suppliers and partners
Contracts, quotes and correspondence with suppliers may contain commercially sensitive terms that you agreed to keep confidential.
What privacy law generally expects
In the UK and EU, GDPR applies to any personal data you hold. In the US, state laws such as the CCPA in California set similar, though narrower, duties. Four principles matter most for a data licence.
A lawful basis
You need a lawful reason to use personal data for a new purpose. Consent is one option, but regulators are sceptical of consent from employees because of the imbalance of power. Many companies instead consider legitimate interests, supported by a written assessment that weighs the business benefit against the impact on the people involved.
Purpose compatibility
Data collected to run your business was not collected for AI training. Using it for a new purpose requires checking that the new use is compatible, or that you have another basis for it. De-identification strongly helps this analysis.
Transparency
People should be told, in plain language, how their data is used. Review your privacy notices and employee handbook, and plan a clear notice for the licence.
Minimisation and security
Share only what is needed, remove what is not, and transfer data securely to a recipient bound by contract to protect it.
De-identification: the core safeguard
In a well-run licence, names, emails, phone numbers and other personal identifiers are removed or masked before data leaves your control, and the result is reviewed before transfer. That is how micro1 describes its process too. Two cautions apply. First, free text can identify people indirectly, for example a unique job title or a described event. Second, data that can still be linked back to a person remains personal data in law. Ask how de-identification is done, how it is checked, and whether you can review a sample.
Contracts and third-party rights
Privacy law is only half the picture. Read through:
- Client contracts and NDAs, for restrictions on using their information.
- Data processing agreements, where you act as a processor for someone else's data. You usually cannot reuse that data for your own purposes.
- Customer terms of service and your public privacy policy.
- SaaS provider terms, since some limit how exported data or API access may be used.
- Investor or lender agreements that need consent for asset disposals.
Where a restriction applies, exclude that data from scope rather than hoping it will not matter. A narrower, clean data package is worth more than a larger one with disputed rights. See AI training data licensing for businesses for the contract clauses to check.
Data to exclude by default
- Special category data such as health, biometric, religious or union information.
- HR files, disciplinary records, payroll and bank details.
- Private direct messages, unless your policies clearly cover them and you have taken advice.
- Passwords, keys and security credentials.
- Client content you hold under NDA or as a processor.
Telling employees
Even where the law does not demand consent, a short, honest notice is good practice. Explain what categories of data are included, what is excluded, how identifiers are removed, who receives it and why. Give a contact for questions. Surprises damage trust far more than the licence itself.
A privacy checklist before you sign
- Map which systems hold data and which people appear in each.
- Choose and document a lawful basis, with a legitimate interests assessment if relevant.
- Consider a data protection impact assessment for large or sensitive archives.
- Review client contracts, NDAs, DPAs and SaaS terms; exclude restricted data.
- Agree the de-identification standard and review a sample.
- Update privacy notices and inform employees.
- Confirm deletion, security and confidentiality terms in the contract.
- Keep a written record of decisions and exclusions.
Where this leaves the value
Careful scoping can reduce volume, but it rarely destroys value, because what AI labs want is how work gets done, not who did it. For reference, micro1's published range ($100k to $2M+ per data package), subject to micro1's review and approval; not guaranteed. To understand what drives that figure, read how much your company's data is worth, or see the full process in the micro1 data partnership, explained.
Frequently asked questions
- Do I need every employee's consent to license company records?
- Not always. Under GDPR and UK GDPR, consent is only one lawful basis, and in an employment relationship it is often not freely given. Many companies rely on legitimate interests backed by an assessment, de-identification and clear notice. Take legal advice for your situation.
- Is de-identified data still personal data?
- It can be. If people can still be re-identified using other information that is reasonably available, the data remains personal data. Properly anonymised data falls outside GDPR, but the bar is high, so treat de-identification as a risk reduction, not an automatic exemption.
- Can I include client or customer data?
- Only if your contracts allow it. Many client agreements, NDAs and data processing agreements limit how you can use their information. Content you hold on a client's behalf is usually excluded unless the client agrees.
- Do my software providers' terms matter?
- Yes. Some SaaS providers restrict how exported data or API access may be used, including for AI training. Check the terms of each tool before including its data.
- Should I tell employees?
- In most cases, yes. Transparency is a core privacy principle, and a short, honest notice explaining what is shared, how it is de-identified and why reduces both legal and reputational risk.
- Is Cadabra the buyer of the data?
- No. Cadabra is an independent referral partner of micro1 and may earn a referral fee if a company completes a data partnership.