A privacy review before a buyer receives data

Begin with purpose and people

Write down why the data was collected, who appears in it, what they were told, and the proposed buyer use. Include employees, customers, contractors, bystanders, and people mentioned indirectly. A dataset can contain personal information even when the seller did not originally intend to collect it.

Have the legal basis and any required notices or permissions reviewed for the actual jurisdictions and transaction. Do not treat a buyer’s confidentiality agreement as a substitute for permission to disclose. An evaluation sample is still a disclosure and belongs inside the same review process.

Inspect more than obvious identifiers

Names and contact details are only part of the problem. Unusual job histories, precise dates, account events, locations, and rare combinations of attributes can reveal identities. Review free text, attachments, metadata, image content, and links. Consider what the intended recipient could combine with the proposed sample.

The ICO distinguishes effective anonymisation from pseudonymisation. Replacing names with stable identifiers does not automatically take a dataset outside privacy rules. Describe the actual technique and its tested limitations instead of applying an unsupported anonymous label.

Choose a task-preserving reduction

Remove information that the buyer does not need, then assess whether the remaining data still supports the task. Relative dates may preserve sequence without revealing exact schedules. Broad account categories may replace names. Attachment exclusions may be appropriate when a troubleshooting exchange remains understandable without them.

Test on difficult records, not only clean examples. Keep a restricted transformation log so errors can be investigated without distributing the original identifiers. Decide who handles requests, corrections, and newly discovered exposure after delivery, and how affected records can be located.

• Maintain an explicit sensitive-category review.
• Test re-identification risks in context.
• Keep redaction keys separate from disclosure copies.

Make controls part of the commercial scope

Define authorized recipients, permitted use, retention, access restrictions, incident reporting, and downstream sharing. Ask how the buyer separates evaluation data from training pipelines. A statement that a team will only take a look is not a concrete operational boundary.

If the risk cannot be reduced enough for the proposed use, exclude the material or stop. Document the reason so it is not reintroduced during a later negotiation. Privacy review is a decision gate, not merely a cleanup step after a price has been agreed; seek specialist advice when the legal position is uncertain.