Avoid fines when selling personal data

The GDPR does not prohibit the sale of personal data, but it imposes strict requirements: you need a valid legal basis — almost always free, specific, informed, and revocable consent in the case of a sale — and you must transfer the data securely. Anyone who fails to comply with these rules risks a fine from the Dutch Data Protection Authority. Below, you can read under what conditions selling is permitted and what to look out for.

Are you allowed to sell personal data?

Personal data is valuable — it is not for nothing that data is called “the new oil”. The digital footprint people leave behind is worth its weight in gold to marketers and behavioral analysts. The General Data Protection Regulation (GDPR) does not prohibit the sale of personal data, but subjects it to strict rules to prevent abuse. Selling is therefore possible, but only within those frameworks.

You need a valid legal basis

Any processing of personal data — including sales — requires a valid legal basis under the GDPR. Possibilities include the performance of a contract, a legal obligation, or a legitimate interest. consent by far the most important legal basis for the sale of personal data.

If you rely on a legitimate interest, you must carefully weigh this against the privacy interests of the data subjects. This balancing act requires a thorough assessment of your business interest versus the impact on the privacy of the people concerned.

Valid consent: what requirements must it meet?

If you use consent, it must free, specific, informed, and unambiguous . In concrete terms, this means:

• Free: people must have a genuine choice and must not suffer any disadvantage if they refuse.
• Specific and informed: they must know exactly what they are giving consent for and how their data is used.
• Unambiguous and active: consent must be given actively; pre-ticked boxes or silence do not count.
• Revocable: people must be able to withdraw their consent at any time just as easily as they give it.

If these conditions are met, companies may sell personal data, provided they ensure a secure transfer.

What does the Court of Justice say?

The European Court of Justice issued a relevant ruling regarding the online auction of personal data for advertising purposes (Case C-604/22). The Court emphasized that the user must first give consent and must be able to object. Anyone who disagrees with the sale of their data can report this to the Dutch Data Protection Authority, which can impose fines.

Personal data in the event of bankruptcy

A bankruptcy trustee can also obtain personal data as part of the estate of a bankrupt company. He, too, may not simply sell it: there must be a valid legal basis and, if necessary, consent must be requested. If there is no such basis, the sale may not take place.

The same applies to data carriers such as laptops and computers: the trustee may only sell these if the personal data has been irreversibly destroyed or if the devices no longer contain any data.

Frequently asked questions about the sale of personal data

Am I allowed to sell my customer base during a business acquisition?

Not without further ado. Customer data is personal data; a valid legal basis is required for transfer, and the data subjects must be informed. In many cases, additional consent is required, especially if the data is used for a different purpose than originally intended.

What is the risk if I don't arrange this properly?

The GDPR imposes heavy fines for processing without a valid legal basis. In addition, data subjects can lodge a complaint with the Dutch Data Protection Authority or claim damages, and you may suffer reputational damage. A careful approach is therefore not only mandatory but also wise.

Does this also apply to sharing data with partners?

Yes. Not only sales, but any form of sharing with third parties is processing that requires a legal basis. Document the agreements with partners and ensure that data subjects know with whom their data is being shared.

Advice on the sale of personal data

The sale of personal data is possible, but strictly regulated. You must take both technical and organizational measures to ensure security and prevent data breaches . The legal experts at MKB Juristen verify whether you have a valid legal basis and whether consent is properly obtained. Schedule a no-obligation intake .