Updated October 2026
Regulated or sensitive data: what to know before you apply
Tell the buyer up front, and expect those records to be cut out or cleaned hard. micro1's estimator asks whether your data includes regulated or sensitive information. SimpleClosure excludes sensitive employee and health records from its deals. Whether you may license any of it is a legal question for the licensing company.1,2
Where it hides
Sensitive data turns up in ordinary places
Owners think of the HR cabinet. The bigger problem is email: a customer who sends a photo of a check, an employee who emails a doctor's note, a W-9 attached to a vendor thread. Ticket systems and shared drives collect the same things. Spirit Airlines' archive held about 176,000 employee records alongside its emails and Teams messages.3
That is why buyers ask early. micro1's six estimator questions end with regulated or sensitive data. Clova Data advertises 100% de-identified records, and Shfa.ai, which works with medical practices, says it removes all 18 HIPAA identifiers. These are the companies' own descriptions of their process.1,4,5
How buyers handle it
Exclude, scrub or walk away
Exclude: SimpleClosure keeps sensitive employee and health records out. Spirit Airlines' passenger records were left out of the archive put up for sale, and a consumer privacy ombudsman was appointed. Scrub: Polyshares has a third-party PII partner clean data before licensing; micro1's partnership page says sensitive information is scrubbed before any downstream use. Walk away: some archives cost more to clean than they are worth.2,6,7,8,9
Cleaning is never perfect. Research found 99.98% of Americans could be re-identified in a dataset from 15 demographic attributes. The more sensitive the record, the more a slip costs.10
Before you apply
What to do before the first call
Map where sensitive records sit: HR, payroll, health, bank and card details, anything about minors. Decide what you will exclude outright; Nyne's ads say any folder can be excluded. Answer the sensitive-data question honestly. And write down the legal questions below for the licensing company, in writing, before anything is signed. An attorney quoted by MIT Technology Review called this kind of data "legally radioactive".11,12
FAQ
Questions, answered with sources
It adds cleaning cost and risk. micro1's estimator weighs it alongside headcount and years.1
Not always. Research found 99.98% of Americans could be re-identified from 15 demographic attributes.10
We do not answer legal questions. Ask the licensing company: their team reviews this with you before anything is signed.
We do not answer legal questions. Ask the licensing company: their team reviews this with you before anything is signed.
Before you sign
Legal questions go to the licensing company
We do not answer legal questions. Ask the licensing company before you sign: their team reviews these with you.
Questions for this kind of business
- Which of our records count as regulated, and who decides before export?
- Who certifies the de-identification method, and do we approve it?
- How do CCPA, GDPR, UK GDPR and state privacy laws apply, and is de-identified data still personal information?
- Do professional rules apply (AICPA, IRC 7216, HIPAA, ABA Model Rule 1.17, insurance agency contracts, adviser rules, state boards)?
Questions for any buyer
- Is the license exclusive, and for how long?
- Can you sublicense the data, and to whom?
- Which AI labs will receive it, and will you tell us?
- How long do you keep it, and how is it deleted?
- What is your liability cap, and who indemnifies whom?
- Will the contract ban re-identification of people in the data?
- Who removes personal data, by what method, and do we approve it first?