Compliance for Data Sellers: Licensing, PII, and Cross-Border

Selling data globally comes with a compliance tax. This post is a practical guide to the three areas sellers get wrong most often: how to license cleanly, how to handle personal information, and how to manage cross-border transfers. Each section lands on something you can do this week.

Licensing is a product decision, not a legal one

Legal teams write license text, but product teams own the shape of the license. The shape decides what buyers can do with the data and therefore how valuable the dataset is. A permissive license lets buyers combine your data with other sources and resell derivatives. A restrictive license limits them to internal use. Both are valid, but they attract different buyers at different price points.

Decide the shape before you talk to legal. Then ask legal to translate that into clean language. Reversing the order is how you end up with a license nobody understands and nobody buys.

• Scope: who in the buyer's organisation can use the data? Just the project team, the whole company, affiliates?
• Duration: perpetual, time-boxed, or subscription?
• Territory: worldwide, country-limited, continent-limited?
• Permitted uses: internal analysis, model training, resale, redistribution, publication?
• Required attribution: how must the buyer credit the source?

PII is a listing decision, not an afterthought

If your dataset contains personal information, you need to say so in the listing. Trying to hide it to avoid awkward questions is the single fastest way to end up in a dispute. Buyers today know what to look for, and procurement teams increasingly scan listings specifically for PII indicators.

Decide, before you list, whether the dataset is anonymised, pseudonymised, or identifiable. The three are legally different.

• Anonymised: the data cannot be used to identify an individual, even in combination with other data the recipient might reasonably obtain. GDPR largely treats this as not personal data, but 'cannot be used' is a high bar.
• Pseudonymised: identifiers have been replaced with a key held separately. Still personal data under GDPR, and buyers need a legal basis to process it.
• Identifiable: contains direct identifiers like names or email addresses. Sellers must have a lawful basis to share and buyers must have one to process.

Cross-border transfers under GDPR and UK GDPR

The moment your buyer is in a different country from your dataset's data subjects, cross-border rules may apply. GDPR and UK GDPR both require a transfer mechanism when data moves to a country without an adequacy decision. The dominant mechanism is the Standard Contractual Clauses, published by the European Commission and the UK ICO.

Marketplaces help by making the SCCs part of the standard license options. Sellers who adopt the standard template can sign off deals in days instead of weeks because buyers' legal teams already know the clauses.

• Adequacy: check whether the buyer's country has an adequacy decision. If yes, no SCCs needed.
• SCCs: use the current EU 2021 clauses or the UK IDTA, not the old 2010 clauses.
• Transfer impact assessment: a short written document describing the risks and the technical measures mitigating them.
• Supplementary measures: encryption, access controls, retention limits.

The CCPA, the CPRA, and 'do not sell'

California introduced the right to opt out of 'selling' personal information. The CPRA extended it to 'sharing' for cross-context behavioural advertising. If any of your dataset's data subjects are California residents, you need to know whether your transfer qualifies as selling or sharing under those definitions.

Most B2B datasets will not meet the strict California definitions, but the burden is on the seller to document that. A short internal memo saying why the transfer is not a sale protects you if a buyer asks.

Compliance is boring until it is late. The sellers who treat it as a weekly habit, not a quarterly fire drill, scale faster.

The 'listing-ready' compliance checklist

• License shape decided and written in plain language.
• PII posture declared on the listing: anonymised, pseudonymised, or identifiable.
• Transfer mechanism attached when the buyer or data is in a GDPR jurisdiction.
• Retention and deletion terms written into the license.
• Security measures summarised: encryption at rest, access controls, incident response.
• Point of contact for data protection questions, usually a shared email alias.

What the marketplace does for you

The platform helps by publishing standard license templates, surfacing PII fields on listings, and holding escrow until delivery is accepted. It does not replace your own legal review, but it reduces the surface area of that review by making the common case repeatable.

For sellers who deal with regulated data regularly, maintain a one-page compliance brief that your legal team has pre-approved. Attach it to every listing in that category. The deal that would have taken weeks will take days.