For staff in the EU or UK, what legal basis lets you reuse the personal data in their work (messages, documents, code history, recordings) for a sale, and is that new purpose compatible with why you collected it?
The data is anonymised to the EU standard before it leaves (only truly anonymous data is outside GDPR; de-identified or pseudonymised data stays personal data), with a documented legitimate-interests and compatibility assessment covering the anonymisation step itself, and notice to staff.
Dated 11 Oct 2026Source checked 11 Oct 2026Quote found on its page again 16 Oct 2026Basis: stated
In the source's own words
“Given the dependency that results from the employer/employee relationship, it is unlikely that the data subject is able to deny his/her employer consent to data processing without experiencing the fear or real risk of detrimental effects as a result of a refusal.”
Where it was read
EDPB Guidelines 05/2020 on consent, section 3.1.1, checked 4 May 2020
GDPR Article 6(4), checked 11 Oct 2026
Everything read from this source (1)Archived copy, 12 Oct 2026
What it is about
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in these 2 guides