Selling company data to AI companies from Germany

This guide covers German law for a German company licensing records to an AI buyer, usually in the US. EU-wide points, including anonymization and EDPB Opinion 28/2024, are covered in our guide to UK GDPR, EU GDPR and CCPA. Statute names are given as published in German, with English descriptions.

Which data protection law and regulator apply in Germany?

The EU GDPR and the Bundesdatenschutzgesetz apply to personal data in records a German company licenses. Section 40 of the Bundesdatenschutzgesetz gives the authorities responsible under state law supervision of private sector bodies, so your regulator is usually the data protection authority of the Land where you are established.

The Federal Commissioner for Data Protection and Freedom of Information, the BfDI, supervises federal public bodies and certain sectors. The Datenschutzkonferenz, the conference of the independent federal and state authorities, issues joint guidance that the state authorities apply.

What have German regulators said about AI training and anonymization?

German regulators have said that training data needs a legal basis and that its origin must be documented and traceable. That point comes from the Datenschutzkonferenz's June 2025 guidance on recommended technical and organizational measures for developing and operating AI systems, as summarized by Graf von Westphalen.

The 2025 guidance divides the AI lifecycle into design, development, introduction and operation. It treats selecting training, validation and test data as part of design, and says development should use only the data each purpose and processing step needs. An earlier Datenschutzkonferenz guidance of May 6, 2024 on AI and data protection focused on using AI applications and said training was not its focus.

At EU level, EDPB Opinion 28/2024 says models trained on personal data cannot always be treated as anonymous and that deployers should check how training data was processed. German buyers and their counsel apply that opinion, so expect them to ask for your legal basis and de-identification method.

Do you need consent to license employee and customer records?

You do not always need consent to license employee and customer records, but you need a legal basis under Article 6 GDPR for any personal data that stays in them. For customers, most sellers look at legitimate interests and the compatibility of the new purpose, or anonymize the data so the GDPR no longer applies.

Staff data is harder. Section 26(1) BDSG allows processing of employee data for the purposes of the employment relationship, and licensing it to an AI company is not obviously one of those purposes. Section 26(2) says consent in employment is judged by the employee's dependence on the employer and must generally be written or electronic.

Section 26(4) allows processing on the basis of collective agreements, including works agreements, provided Article 88(2) GDPR is respected. In Case C-34/21, decided on March 30, 2023, the Court of Justice held that a national rule on employee data must meet the conditions of Article 88 to apply as a more specific rule. Take advice on which basis fits your staff data.

Does the works council have a say in licensing staff data?

The works council may have a say in licensing staff data, depending on how the data is extracted and used. Section 87(1) no. 6 of the Betriebsverfassungsgesetz gives the works council a right of co-determination over the introduction and use of technical devices designed to monitor employee behavior or performance, where no statute or collective agreement already governs the matter.

If the employer and works council cannot agree, section 87(2) says the conciliation board decides and its ruling replaces their agreement. Section 80(3) adds that where the works council must assess the introduction or use of artificial intelligence, calling in an expert is deemed necessary.

In practice, German sellers that want to include staff communications usually involve the works council early and record the arrangement in a works agreement, which can also serve as the collective agreement section 26(4) BDSG refers to. Our guide to telling staff and clients about a data license covers the communication side.

You transfer personal data to a US buyer under the EU-US Data Privacy Framework if the buyer is certified, or under the European Commission's standard contractual clauses if it is not. The Commission adopted its adequacy decision for the Framework on July 10, 2023.

Jones Day reports that the EU General Court upheld the Framework on September 3, 2025 in Latombe v Commission, and WilmerHale reports that the case is now before the Court of Justice on appeal. For buyers outside the Framework, Commission Implementing Decision (EU) 2021/914 sets out the standard contractual clauses, usually with a transfer impact assessment. Anonymous data is not a transfer of personal data at all.

Do copyright and database rights affect a license?

Copyright and database rights affect a license because they decide what you can grant and why a buyer needs your permission. Section 44b of the Urheberrechtsgesetz, which implements Article 4 of the EU DSM Directive, allows reproductions of lawfully accessible works for text and data mining, but only if the rightsholder has not reserved those uses.

For works available online, section 44b(3) says a reservation is effective only in machine-readable form, and section 44b(2) requires copies to be deleted once they are no longer needed. Article 3 of the Directive, implemented in section 60d, covers research organizations. Your internal records are not lawfully accessible to an outside AI company, so these exceptions give a buyer no right to them.

Databases have their own protection. Section 87b gives the maker of a database the exclusive right to reproduce, distribute and communicate to the public the whole database or a substantial part, implementing the sui generis right in Directive 96/9/EC.

German courts are testing the limits. Bird and Bird reports that the Munich Regional Court held in GEMA v OpenAI, case 42 O 14139/24, decided in November 2025, that song lyrics memorized in model parameters were reproduced without permission and that the text and data mining exception did not cover that memorization. The judgment is not final.

Does a US buyer withhold tax on payments to a German seller?

A US buyer must generally withhold 30% on US-source royalties paid to a foreign seller unless a treaty reduces the rate, according to IRS Publication 515. IRS Tax Treaty Table 1 shows 0% for royalties paid to German residents under Article 12(1) of the Germany-US treaty, claimed on Form W-8BEN-E subject to the treaty's limitation on benefits rules.

For German VAT, section 3a(2) of the Umsatzsteuergesetz says a service to a business customer is generally supplied where the recipient runs its business, so a license supplied to a US company is not normally taxable in Germany. Whether a data license is a service for VAT purposes, and how German corporate tax treats the income, needs local tax advice. See our guide to tax on AI data license payments.

Which buyers accept sellers from Germany?

Few buyers in our directory name Germany. AWS Data Exchange lists EU member states, which include Germany, as eligible jurisdictions for paid sellers. micro1 prioritizes the US, UK and Canada and says other regions may still be considered, and it prefers mainly English-language records.

What are Germany's rules at a glance?

For a view of likely buyers, a realistic range and the rights issues to clear first, request a free data valuation.