Telling staff and clients about a data license

"Will my staff or clients find out?" is one of the first questions sellers ask. The better question is what they should hear, from whom and when, because the people in your records are also the people most likely to object.

This guide sets out what US rules say about telling people, which groups need to hear what, and a practical order for the announcement, with a short section on UK and EU duties. It describes the law and published cases. It is not legal advice for your company, so take independent advice on your own notices and contracts.

Do you have to tell staff and clients about a data license?

You often have to tell staff and clients about a data license where it involves their personal data, and you usually should even where it does not. The legal duty attaches to personal data, while the commercial duty attaches to anyone whose confidential information or work is in the archive.

What do US rules require you to tell people?

US rules focus on the promises you made when you collected the data. FTC staff wrote on February 13, 2024 that "a business that collects user data based on one set of privacy commitments cannot then unilaterally renege on those commitments after collecting users' data".

The FTC post cites its 2004 case against Gateway Learning, which changed its privacy policy to share consumer data with third parties without telling consumers, and a 2023 case against a genetic testing company over a retroactive expansion of the third parties it could share data with. Frankfurt Kurnit Klein & Selz adds that companies must comply with the privacy statements in effect when the data was collected.

The CCPA adds specific duties for California residents, including employees and job applicants. Section 1798.100 bars a business from using personal information for additional purposes incompatible with those it disclosed at collection without giving notice, and section 1798.120 requires a business that sells personal information to tell consumers and let them opt out. The California Attorney General notes that the exemptions for employment-related information expired on December 31, 2022.

The practical effect is that a new notice rarely fixes old data. Compare each source against the notice in force when it was collected. Where the notice does not cover licensing, exclude the personal data or de-identify it, and remember that the CCPA treats a transfer of personal information for value as a sale unless it meets its de-identification standard, according to Frankfurt Kurnit Klein & Selz. Our guide to CCPA, state privacy laws and GDPR covers the other states.

Should you tell employees before or after signing?

You should tell employees before signing, once the scope is settled but before any data leaves. The CCPA's notice duty applies before personal information is put to a new use, and the order can matter for labor law as well as goodwill.

Daniel Goldberg of Frankfurt Kurnit Klein & Selz notes that employee communications "may be protected concerted activity under Section 7 of the National Labor Relations Act", and that where staff are unionized, "the collective bargaining agreement may restrict the sale, and the company may have bargaining obligations". He also observes that most employee notices and handbooks do not contemplate selling workplace communications for AI training.

Staff objections are not hypothetical. In the Spirit Airlines bankruptcy, flight attendants' unions objected to the sale of the airline's data, and the pilots' union argued that some safety records should stay confidential even after de-identification, Fortune reported in September 2026.

What should you tell clients about a data license?

You should tell clients what you are excluding, and for most sellers that is all of their material. Buyers expect it: Polyshares says its license does not cover data a company holds on behalf of its own clients, and Endless Data says it never licenses client books or privileged client matter content.

If client material is in scope, such as de-identified deliverables, check each contract and get written consent where the contract is unclear. Where you process a client's personal information as its CCPA service provider, California Civil Code section 1798.140(ag) requires your contract to bar you from selling it or using it outside the business purposes the contract specifies. Contract restrictions are one of the eight checks in our seller vetting standard.

Professional firms carry extra confidentiality duties to clients. Our pages for law firms and marketing agencies cover the client issues that come up most in each.

Public data deals show that the way people learn about a license shapes their reaction as much as the terms do. These cases involve publishers and platforms rather than company records, but the people affected reacted in similar ways.

The HarperCollins case is worth reading closely. Publishers Weekly reported that Robert Gottlieb of Trident Media said most of his authors were uneasy mainly because they did not know who the buyer was. Saying what kind of buyer will receive the data, and what it may do, answers much of that concern without naming the company.

Can you keep a data license confidential?

You can keep a data license's commercial terms confidential, including the buyer's name and the price, but not the processing itself from the people whose personal data is in it. Those are separate duties.

Several buyers offer confidentiality on the commercial side. Troveo says a seller's company is never named publicly and that buyers are introduced confidentially only after an agreement is signed. Polyshares keeps company names confidential on its track record page and does not disclose which labs take which data. With us, buyers see only redacted samples under a mutual NDA before a license is signed.

If you hold UK or EU data

UK GDPR requires you to tell people about a new purpose before you start processing their data for it. Article 13(3) covers data collected from the person and Article 14(4) covers data obtained from elsewhere, such as client contacts named in your email. Both say the controller must provide information on that other purpose "prior to that further processing".

The ICO's guidance on the right to be informed says: "You must bring any new uses of an individual's personal data to their attention before you start the processing." The ICO also treats anonymization as processing of personal data in its own right, so preparing records for a license is itself covered.

The information must include the right to object. Under Article 21(1), where processing rests on legitimate interests, a person can object on grounds relating to their particular situation, and the controller must stop unless it shows compelling legitimate grounds. Where you process a client's data as its processor, Article 28(10) treats a processor that sets its own purposes as a controller for that processing.

How do you plan the announcement?

You plan the announcement by fixing the scope first and the message second, then telling each group in order of how directly they are affected.

1. 1

   Settle scope and exclusions

   Decide which systems, date ranges and record types are in, and record what is out, such as HR files, private messages, health data and client material.

2. 2

   Check what people were told

   Collect the privacy notices, employee handbooks and client contracts in force when the data was collected, and note any gaps.

3. 3

   Get internal approvals

   Brief the board and investors with consent rights, and open consultation with any union whose agreement may apply.

4. 4

   Update privacy information

   Publish updated privacy information before any processing for the license begins, including how to opt out or object.

5. 5

   Tell employees directly

   Explain the license in a meeting or message from a senior leader, with written answers to common questions and a named contact.

6. 6

   Write to affected clients

   Confirm that their material is excluded, or ask for written consent where it is not.

7. 7

   Prepare a public line and keep records

   Agree a short statement in case the deal becomes public, and keep a record of who was told what and when.

What should the message to staff say?

The message to staff should say plainly what is being licensed, what is not and what protections apply. Staff will read it as a test of whether the company has thought about them.

• Why the company is licensing the data, in one or two sentences
• Which systems and years are included
• What is excluded, such as HR files, payroll, health information and direct messages if you leave them out
• How names and other identifiers are removed, and how the method was tested
• What kind of buyer will receive the data and what the license lets it do
• How to ask questions or object, and by when
• Whether staff share in the proceeds, stated honestly either way

Our guide to whether selling company data to AI is safe covers the wider risks, and the de-identification guide explains how to show staff their names have been removed. To plan a license with disclosure built in, book a free consultation.