MKB Juristen drafts custom legal documents
It is best not to cobble together or copy important contracts, terms and conditions, and other legal documents yourself. We help entrepreneurs on a budget with customized legal solutions, clear costs upfront, and practical explanations.
- Custom contracts, terms and conditions, and legal documents
- Budget-friendly and clear about the costs upfront
- Request a free consultation or a no-obligation quote
You may not simply sell or transfer personal data to third parties. You need a valid legal basis for doing so, and it must be compatible with the purpose for which you collected the data. In practice, this often means that you require consent.
Selling data is subject to the GDPR
Data is valuable, but selling it is a processing activity covered by the GDPR. You may only do so if you have a legal basis (Article 6 GDPR) and if it fits within the original purpose. If you collected data to provide a service, resale is rarely compatible with that.
When is it allowed?
Often, consent is the only usable legal basis for selling to third parties. That consent must be free, specific, and informed: the data subject knows to whom their data is being processed and for what purpose. A vague agreement in the fine print does not suffice.
Pay attention to purpose limitation and transparency
The GDPR requires purpose limitation: you may not use data for incompatible new purposes. If you wish to sell data, be transparent about this in advance in your privacy statement and during collection. Anonymization can be an alternative, provided the data is truly no longer traceable.
Also in the event of bankruptcy and acquisitions
It is not only the trade in data that is sensitive; in the event of bankruptcy or a company takeover, the question also arises as to whether customer files may be transferred. In such cases, too, GDPR rules apply: without a legal basis and transparency, transfer is risky.
Frequently Asked Questions
Am I allowed to sell my customer base?
Only with a valid legal basis, usually consent, and if it is compatible with the original purpose. Be transparent and pay attention to purpose limitation.
Does anonymizing help?
If data can truly no longer be traced back to individuals, it falls outside the scope of the GDPR. Pseudonymization is not enough; the bar for anonymization is set high.
Is a bankruptcy trustee allowed to sell customer data?
GDPR rules also apply in the event of bankruptcy. The transfer of personal data requires a legal basis and due care.
Arrange data usage in a GDPR-compliant manner?
Our legal experts review your data flows and draft the appropriate data processing agreement and privacy statement . View our privacyteam or schedule a free consultation.
