Does any of the data belong to or describe your customers, and do your customer contracts and data processing agreements allow using it for anything other than serving them?
Customer content (support tickets, customer files, CRM notes, customer email) is excluded, or each customer contract expressly permits this use, or the data is anonymised to the standard in the anonymisation item and the contract does not forbid that.
Dated 11 Oct 2026Source checked 11 Oct 2026Quote found on its page again 16 Oct 2026Basis: stated
In the source's own words
“if a processor infringes this Regulation by determining the purposes and means of processing, the processor shall be considered to be a controller in respect of that processing.”
Where it was read
GDPR Article 28(3)(a) and 28(10), checked 11 Oct 2026
Everything read from this source (1)Archived copy, 12 Oct 2026
Frankfurt Kurnit (Daniel M. Goldberg), Selling Company Data For AI Training: What To Know Before You Say Yes, Legal 500, checked 6 Oct 2026
Venable: Contracting for AI Model Training, checked 5 Jun 2026
Also read from the same source
- Frankfurt Kurnit Klein & Selz (Daniel M. Goldberg) and companies selling data: legal or policy, company records (email, chat, code, HR)
- Does the data contain other companies' confidential information, such as partner documents, pricing, roadmaps or anything shared under an NDA?
- Is any of it data or content you licensed from someone else, such as purchased contact lists, research reports, stock media, fonts or design kits?
- Do the records include staff discussing pay, working conditions or union matters, or is any workforce covered by a collective bargaining agreement?
- Does the data include legal advice, litigation material, or trade secrets (yours or other companies')?
- Has any sample of the data already been shown to a buyer or broker before this rights review?
What it is about
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in these 2 guides