Updated October 2026
Regulated or sensitive data: what to know before you apply
Your records have Social Security numbers, health details or bank information mixed in somewhere, and you are worried that rules you out. It usually does not, but tell the buyer up front and expect those records to be cut out or cleaned hard. Buyers ask up front whether your data includes regulated or sensitive information, and some leave sensitive employee and health records out altogether. Whether you may license any of it is something to talk through with the buyer you're working with, and you are welcome to bring your own advisor.1,2
Where it hides
Sensitive data turns up in ordinary places
Owners think of the HR cabinet, but the bigger problem is email: a customer who sends a photo of a check, an employee who emails a doctor's note, a W-9 attached to a supplier thread. Ticket systems and shared drives collect the same things. Even Spirit Airlines' archive held about 176,000 employee records alongside its emails and Teams messages.3
That is why buyers ask early, and some will not take certain industries at all: Ventra cannot take legal, healthcare, financial services or accounting companies right now. Others build their process around it, from removing all 18 standard health identifiers to cleaning records in a secure workspace. These are the companies' own descriptions.1,4,5,6
How buyers handle it
Exclude, scrub or walk away
Exclude: some buyers keep sensitive employee and health records out, and Spirit Airlines' passenger records were left out of the archive put up for sale, with a consumer privacy ombudsman appointed. Scrub: buyers say personal details are stripped out before any use, sometimes by an outside partner. Walk away: some archives cost more to clean than they are worth.2,7,8,9,10
Cleaning is never perfect, and the honest buyers say so, which is why they advise leaving out anything you would not want shared and reviewing a sample before you sign. Research found 99.98% of Americans could be picked out of a dataset from 15 basic details, so the more sensitive the record, the more a slip costs.11,12,13
Before you apply
What to do before the first call
Map where sensitive records sit: HR, payroll, health, bank and card details, anything about minors. Decide what you will leave out entirely, since buyers say any folder can be left out, and answer the sensitive-data question honestly. Put the questions below to the buyer you're working with in writing before anything is signed, because an attorney quoted by MIT Technology Review called this kind of data "legally radioactive". Our quiz asks about sensitive records too, and only introduces you to the buyers we work with that take a business like yours.14,15
FAQ
Questions, answered with sources
It adds cleaning cost and risk, and buyers weigh it alongside headcount and years. The less of it in what you send, the simpler the deal.1
Not always. Research found 99.98% of Americans could be picked out of a dataset from 15 basic details, which is why you should review a sample.13
Every business is different, so this one is best talked through with the buyer you're working with. Their team goes over it with you before anything is signed.
Every business is different, so this one is best talked through with the buyer you're working with. Their team goes over it with you before anything is signed.
Before you sign
Questions to talk through with your buyer
Every business is different, so these are best talked through with the buyer you're working with. Their team goes over them with you before anything is signed.
Questions for this kind of business
- Which of our records count as regulated, and who decides before export?
- Who checks the method for removing names and personal details, and do we approve it?
- How do CCPA, GDPR, UK GDPR and state privacy laws apply, and is de-identified data still personal information?
- Do professional rules apply (AICPA, IRC 7216, HIPAA, ABA Model Rule 1.17, insurance agency contracts, adviser rules, state boards)?
Questions for any buyer
- Is the license exclusive, and for how long?
- Can you sublicense the data, and to whom?
- Which AI labs will receive it, and will you tell us?
- How long do you keep it, and how is it deleted?
- What is your liability cap, and who indemnifies whom?
- Will the contract ban re-identification of people in the data?
- Who removes personal data, by what method, and do we approve it first?