What is Business data?

Two ways the term is used

In everyday business, “business data” means everything an organization creates or holds while it runs: financial statements, contracts, documents, source code, support tickets, emails and chat messages.

Some regulators use the term more narrowly, as the opposite of personal data. The UK ICO lists business data as an example of non-personal information, such as a work email address that does not contain someone’s name, or a company’s financial statements (ICO). The EU Data Act uses a similar split: it defines “non-personal data” simply as data other than personal data (EUR-Lex).

Where business data becomes personal data

The dividing line is whether a person can be identified. GDPR Article 4(1) defines personal data as any information relating to an identified or identifiable natural person, such as through a name or online identifier (GDPR). The ICO says that if a person can be identified, directly or indirectly, the information is personal data even when they are acting in a business capacity (ICO). In its worked example, a work email address containing a named employee’s name is that person’s personal data, while a generic company inbox contains none (ICO).

California moved the same way. The CCPA’s business-to-business exemption had largely excluded business contacts’ personal information (Holland & Knight), but it expired on January 1, 2023, when the legislature did not extend it (California Lawyers Association).

Most company datasets are mixed

European Commission guidance on the free flow of non-personal data (COM(2019) 250) says that in most real-life situations a dataset is very likely to contain both personal and non-personal data, a “mixed dataset.” Its examples include tax records naming the managing director with a phone number, and a company’s knowledge of IT problems built from individual incident reports. Where the two parts are inextricably linked, GDPR applies to the whole dataset, even if the personal part is small (CEE Legal Matters).

Replacing identifiers so data can’t be linked to a person without separately kept information is called pseudonymisation (GDPR Art. 4(5)). One legal explainer notes that pseudonymised data still counts as personal data under GDPR (Legiscope).

Why it matters if you sell data

Before licensing business data for AI training, a company will typically want to separate the parts that identify people from those that don’t, and confirm what its contracts and policies allow. Some business data may also qualify as a trade secret, a reason to choose carefully what to share. US law can treat financial, business, technical and engineering information this way if the owner takes reasonable measures to keep it secret and it gains independent economic value from not being generally known (18 U.S.C. §1839).

Terms matter too. The EU Data Act does not prevent parties from agreeing terms that exclude or limit the use of non-personal data (EUR-Lex). FTC staff warned (February 13, 2024) that it may be unfair or deceptive for a company to start using consumers’ data for AI training if the only notice is a hidden, retroactive change to its terms of service or privacy policy (FTC). This is general information; ask counsel how far data must be de-identified.

SellMyData does not buy consumer personal data, health records tied to people, or payment card data (details). Every dataset goes through a rights check with the company, and names, contact details and identifiers are removed (de-identification) before anything is listed. To see what your company’s data might be worth, request an estimate or book a 30-minute call with the founder; neither commits you to anything.