The rules a large company's data sale turns on
6 of 14 legal texts read in GB and the US set conditions a company must meet before licensing its operating data, newest read 28 October 2026.
What it does to a sale
What the rule guards
Who enforces it
All the answers, instrument by instrument
Every row is a single instrument, and every answer expands to the wording it was taken from, the text it came from and when it was read. "Not stated" is used when the text says nothing on the point.
| Instrument | What the rule guards | What it does to a sale | Who enforces it |
|---|---|---|---|
| California Consumer Privacy Act | personal data inside the records | sets conditions the seller must meet | not statedNot addressed in Civil Code 1798.140, definitions |
| Companies Act 2006 (UK) | the directors' or stockholders' say | sets conditions the seller must meet | not statedNot addressed in Section 172, duty to promote the success of the company |
| Competition Act 1998 (UK) | agreements that restrict competition | prohibits a kind of transaction | not statedNot addressed in Section 2, the Chapter I prohibition |
| Copyright and Rights in Databases Regulations 1997 (UK) | not statedNot addressed in Regulation 13, database right | gives the owner a right to enforce | not statedNot addressed in Regulation 13, database right |
| Defend Trade Secrets Act (US) | information kept secret for its value Not addressed in 18 U.S.C. 1836, civil proceedings | varies by document | in exceptional circumstances that render an injunction inequitable, that conditions…Not addressed in 18 U.S.C. 1839, definitions |
| Delaware General Corporation Law | the directors' or stockholders' say | sets conditions the seller must meet | not statedNot addressed in Section 271, sale of assets |
| DOJ Data Security Program (US) | data or assets reaching a foreign power Not addressed in 28 CFR Part 202 | varies by document | On December 26, 2024, the Department’s National Security Division issued a final rule to… Not addressed in 28 CFR Part 202 |
| National Security and Investment Act 2021 (UK) | data or assets reaching a foreign power Not addressed in Section 14, mandatory notification | sets conditions the seller must meetNot addressed in Section 7, qualifying entities and assets | The Secretary of State may by regulations prescribe the form and content of a mandatory…Not addressed in Section 7, qualifying entities and assets |
| Protecting Americans' Data from Foreign Adversaries Act (US) | data or assets reaching a foreign power | prohibits a kind of transaction | not statedNot addressed in 15 U.S.C. 9901 |
| Regulation FD (US) | price-sensitive information disclosed selectively | sets conditions the seller must meet | not statedNot addressed in 17 CFR 243.100, general rule Not addressed in 17 CFR 243.101, definitions |
| Sherman Act (US) | agreements that restrict competition | prohibits a kind of transaction | shall be deemed guilty of a felony, and, on conviction thereof, shall be punished by fine |
| Trade Secrets (Enforcement, etc.) Regulations 2018 (UK) | information kept secret for its value Not addressed in Regulation 3, unlawful acquisition, use or disclosure | varies by document | not statedNot addressed in Regulation 2, interpretation Not addressed in Regulation 3, unlawful acquisition, use or disclosure |
| UK GDPR | personal data inside the records | sets conditions the seller must meet | not statedNot addressed in Article 28, processor |
| UK Market Abuse Regulation | price-sensitive information disclosed selectively | prohibits a kind of transactionNot addressed in Article 7, inside information | not statedNot addressed in Article 7, inside information Not addressed in Article 10, unlawful disclosure of inside information |
Quoted wording for all 60 answers
- California Consumer Privacy Act, Civil Code 1798.140, definitions, read 2026-10-08, What the rule guards:
a consumer’s personal information by the business to a third party for monetary or other valuable consideration.
- California Consumer Privacy Act, Civil Code 1798.140, definitions, read 2026-10-08, What it does to a sale:
“Sell,” “selling,” “sale,” or “sold,’’ means selling, renting, releasing, disclosing, disseminating, making available, transferring
- California Consumer Privacy Act, Civil Code 1798.140, definitions, read 2026-10-08, Who enforces it: Left open by the text (36,374 characters, read in full 2026-10-08).
- Companies Act 2006 (UK), Section 172, duty to promote the success of the company, read 2026-10-28, What the rule guards:
would be most likely to promote the success of the company for the benefit of its members as a whole
- Companies Act 2006 (UK), Section 172, duty to promote the success of the company, read 2026-10-28, What it does to a sale:
A director of a company must act in the way he considers, in good faith
- Companies Act 2006 (UK), Section 172, duty to promote the success of the company, read 2026-10-28, Who enforces it: Left open by the text (7,206 characters, read in full 2026-10-28).
- Competition Act 1998 (UK), Section 2, the Chapter I prohibition, read 2026-10-28, What the rule guards:
concerted practices which have as their object or effect the prevention, restriction or distortion of competition within the United Kingdom
- Competition Act 1998 (UK), Section 2, the Chapter I prohibition, read 2026-10-28, What it does to a sale:
Any agreement or decision which is prohibited by subsection (1) is void.
- Competition Act 1998 (UK), Section 2, the Chapter I prohibition, read 2026-10-28, Who enforces it: Left open by the text (9,516 characters, read in full 2026-10-28).
- Copyright and Rights in Databases Regulations 1997 (UK), Regulation 13, database right, read 2026-10-08, What the rule guards: Left open by the text (4,747 characters, read in full 2026-10-08).
- Copyright and Rights in Databases Regulations 1997 (UK), Regulation 13, database right, read 2026-10-08, What it does to a sale:
A property right (“database right”) subsists, in accordance with this Part, in a database if there has been a substantial investment in obtaining, verifying or presenting the contents of the database.
- Copyright and Rights in Databases Regulations 1997 (UK), Regulation 13, database right, read 2026-10-08, Who enforces it: Left open by the text (4,747 characters, read in full 2026-10-08).
- Defend Trade Secrets Act (US), 18 U.S.C. 1836, civil proceedings, read 2026-10-08, What the rule guards: Left open by the text (18,731 characters, read in full 2026-10-08).
- Defend Trade Secrets Act (US), 18 U.S.C. 1836, civil proceedings, read 2026-10-08, What it does to a sale:
that is misappropriated may bring a civil action under this subsection if the
- Defend Trade Secrets Act (US), 18 U.S.C. 1836, civil proceedings, read 2026-10-08, Who enforces it:
in exceptional circumstances that render an injunction inequitable, that conditions future use of the
- Defend Trade Secrets Act (US), 18 U.S.C. 1839, definitions, read 2026-10-08, What the rule guards:
thereof has taken reasonable measures to keep such information secret; and
- Defend Trade Secrets Act (US), 18 U.S.C. 1839, definitions, read 2026-10-08, What it does to a sale:
the information derives independent economic value, actual or potential, from not being generally known to
- Defend Trade Secrets Act (US), 18 U.S.C. 1839, definitions, read 2026-10-08, Who enforces it: Left open by the text (9,909 characters, read in full 2026-10-08).
- Delaware General Corporation Law, Section 271, sale of assets, read 2026-10-08, What the rule guards:
when and as authorized by a resolution adopted by the holders of a majority of the outstanding stock of the corporation entitled to vote thereon
- Delaware General Corporation Law, Section 271, sale of assets, read 2026-10-08, What it does to a sale:
sell, lease or exchange all or substantially all of its property and assets, including its goodwill and its corporate franchises
- Delaware General Corporation Law, Section 271, sale of assets, read 2026-10-08, Who enforces it: Left open by the text (41,950 characters, read in full 2026-10-08).
- DOJ Data Security Program (US), National Security Division, Data Security Program, read 2026-10-28, What the rule guards:
The Data Security Program addresses the national-security risks posed by the continued efforts of foreign adversaries to use commercial activities to access and exploit U.S. Government-related data and Americans’ bulk sensitive personal data.
- DOJ Data Security Program (US), National Security Division, Data Security Program, read 2026-10-28, What it does to a sale:
with certain affirmative requirements regarding due diligence and audits for restricted transactions (subpart J)
- DOJ Data Security Program (US), National Security Division, Data Security Program, read 2026-10-28, Who enforces it:
On December 26, 2024, the Department’s National Security Division issued a final rule to implement Executive Order 14117.
- DOJ Data Security Program (US), 28 CFR Part 202, read 2026-10-28, What the rule guards: Left open by the text (1,748 characters, read in full 2026-10-28).
- DOJ Data Security Program (US), 28 CFR Part 202, read 2026-10-28, What it does to a sale:
Subpart C—Prohibited Transactions and Related Activities (§§ 202.301 - 202.305)
- DOJ Data Security Program (US), 28 CFR Part 202, read 2026-10-28, Who enforces it: Left open by the text (1,748 characters, read in full 2026-10-28).
- National Security and Investment Act 2021 (UK), Section 14, mandatory notification, read 2026-10-28, What the rule guards: Left open by the text (6,497 characters, read in full 2026-10-28).
- National Security and Investment Act 2021 (UK), Section 14, mandatory notification, read 2026-10-28, What it does to a sale:
a person must give notice to the Secretary of State before the person, pursuant to a notifiable acquisition, gains control in circumstances falling within section 6(2).
- National Security and Investment Act 2021 (UK), Section 14, mandatory notification, read 2026-10-28, Who enforces it:
The Secretary of State may by regulations prescribe the form and content of a mandatory notice.
- National Security and Investment Act 2021 (UK), Section 7, qualifying entities and assets, read 2026-10-28, What the rule guards:
ideas, information or techniques which have industrial, commercial or other economic value.
- National Security and Investment Act 2021 (UK), Section 7, qualifying entities and assets, read 2026-10-28, What it does to a sale: Left open by the text (5,784 characters, read in full 2026-10-28).
- National Security and Investment Act 2021 (UK), Section 7, qualifying entities and assets, read 2026-10-28, Who enforces it: Left open by the text (5,784 characters, read in full 2026-10-28).
- Protecting Americans' Data from Foreign Adversaries Act (US), 15 U.S.C. 9901, read 2026-10-28, What the rule guards:
It shall be unlawful for a data broker to sell, license, rent, trade, transfer, release, disclose, provide access to, or otherwise make available personally identifiable sensitive data of a United States individual to
- Protecting Americans' Data from Foreign Adversaries Act (US), 15 U.S.C. 9901, read 2026-10-28, What it does to a sale:
any entity that is controlled by a foreign adversary.
- Protecting Americans' Data from Foreign Adversaries Act (US), 15 U.S.C. 9901, read 2026-10-28, Who enforces it: Left open by the text (8,270 characters, read in full 2026-10-28).
- Regulation FD (US), 17 CFR 243.100, general rule, read 2026-10-28, What the rule guards:
discloses any material nonpublic information regarding that issuer or its securities to any person described in paragraph (b)(1) of this section
- Regulation FD (US), 17 CFR 243.100, general rule, read 2026-10-28, What it does to a sale:
the issuer shall make public disclosure of that information as provided in § 243.101(e):
- Regulation FD (US), 17 CFR 243.100, general rule, read 2026-10-28, Who enforces it: Left open by the text (5,170 characters, read in full 2026-10-28).
- Regulation FD (US), 17 CFR 243.101, definitions, read 2026-10-28, What the rule guards:
A selective disclosure of material nonpublic information is “intentional” when the person making the disclosure either knows
- Regulation FD (US), 17 CFR 243.101, definitions, read 2026-10-28, What it does to a sale:
“Promptly” means as soon as reasonably practicable (but in no event after the later of 24 hours or the commencement of the next day's trading on the New York Stock Exchange)
- Regulation FD (US), 17 CFR 243.101, definitions, read 2026-10-28, Who enforces it: Left open by the text (5,120 characters, read in full 2026-10-28).
- Sherman Act (US), 15 U.S.C. 1, read 2026-10-28, What the rule guards:
Every contract, combination in the form of trust or otherwise, or conspiracy, in restraint of trade or commerce among the several States
- Sherman Act (US), 15 U.S.C. 1, read 2026-10-28, What it does to a sale:
in restraint of trade or commerce among the several States, or with foreign nations, is declared to be illegal
- Sherman Act (US), 15 U.S.C. 1, read 2026-10-28, Who enforces it:
shall be deemed guilty of a felony, and, on conviction thereof, shall be punished by fine
- Trade Secrets (Enforcement, etc.) Regulations 2018 (UK), Regulation 2, interpretation, read 2026-10-27, What the rule guards:
has commercial value because it is secret, and
- Trade Secrets (Enforcement, etc.) Regulations 2018 (UK), Regulation 2, interpretation, read 2026-10-27, What it does to a sale:
is secret in the sense that it is not, as a body or in the precise configuration and assembly of its components, generally known among
- Trade Secrets (Enforcement, etc.) Regulations 2018 (UK), Regulation 2, interpretation, read 2026-10-27, Who enforces it: Left open by the text (5,695 characters, read in full 2026-10-27).
- Trade Secrets (Enforcement, etc.) Regulations 2018 (UK), Regulation 3, unlawful acquisition, use or disclosure, read 2026-10-08, What the rule guards: Left open by the text (10,589 characters, read in full 2026-10-08).
- Trade Secrets (Enforcement, etc.) Regulations 2018 (UK), Regulation 3, unlawful acquisition, use or disclosure, read 2026-10-08, What it does to a sale:
The acquisition, use or disclosure of a trade secret is unlawful where the acquisition, use or disclosure constitutes a breach of confidence in confidential information.
- Trade Secrets (Enforcement, etc.) Regulations 2018 (UK), Regulation 3, unlawful acquisition, use or disclosure, read 2026-10-08, Who enforces it: Left open by the text (10,589 characters, read in full 2026-10-08).
- UK GDPR, Article 28, processor, read 2026-10-08, What the rule guards:
processes the personal data only on documented instructions from the controller
- UK GDPR, Article 28, processor, read 2026-10-08, What it does to a sale:
Processing by a processor shall be governed by a contract or other legal act under
- UK GDPR, Article 28, processor, read 2026-10-08, Who enforces it: Left open by the text (12,826 characters, read in full 2026-10-08).
- UK Market Abuse Regulation, Article 10, unlawful disclosure of inside information, read 2026-10-28, What the rule guards:
unlawful disclosure of inside information arises where a person possesses inside information and discloses that information to any other person
- UK Market Abuse Regulation, Article 10, unlawful disclosure of inside information, read 2026-10-28, What it does to a sale:
except where the disclosure is made in the normal exercise of an employment, a profession or duties.
- UK Market Abuse Regulation, Article 10, unlawful disclosure of inside information, read 2026-10-28, Who enforces it: Left open by the text (5,839 characters, read in full 2026-10-28).
- UK Market Abuse Regulation, Article 7, inside information, read 2026-10-28, What the rule guards:
information of a precise nature, which has not been made public, relating, directly or indirectly, to one or more issuers or to one or more financial instruments
- UK Market Abuse Regulation, Article 7, inside information, read 2026-10-28, What it does to a sale: Left open by the text (12,188 characters, read in full 2026-10-28).
- UK Market Abuse Regulation, Article 7, inside information, read 2026-10-28, Who enforces it: Left open by the text (12,188 characters, read in full 2026-10-28).
How we read and count
Each instrument's own the statutes and regulators' own texts in GB and the US were read through estate-fetch and stored whole (sha256 on every row).
For every text, three questions were answered from its own words: what the rule guards, what it does to a sale, who enforces it.
Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the text read does not address the question.
A instrument with several texts reads 'varies' where they disagree.
14 instruments, 20 texts.
Not read yet, so not counted: 1 named document.
Where we looked (21)
- 18 U.S.C. 1839 (trade secret definitions) (quoted for reporting from the publisher's the statutes and regulators' own texts in GB and the US)
- 18 U.S.C. 1836 (civil action for trade secret misappropriation) (quoted for reporting from the publisher's the statutes and regulators' own texts in GB and the US)
- Trade Secrets (Enforcement, etc.) Regulations 2018, reg. 2 (quoted for reporting from the publisher's the statutes and regulators' own texts in GB and the US)
- Trade Secrets (Enforcement, etc.) Regulations 2018, reg. 3 (quoted for reporting from the publisher's the statutes and regulators' own texts in GB and the US)
- 17 CFR 243.100 (Regulation FD) (quoted for reporting from the publisher's the statutes and regulators' own texts in GB and the US)
- 17 CFR 243.101 (Regulation FD definitions) (quoted for reporting from the publisher's the statutes and regulators' own texts in GB and the US)
- UK Market Abuse Regulation, art. 7 (inside information) (quoted for reporting from the publisher's the statutes and regulators' own texts in GB and the US)
- UK Market Abuse Regulation, art. 10 (unlawful disclosure) (quoted for reporting from the publisher's the statutes and regulators' own texts in GB and the US)
- 15 U.S.C. 1 (Sherman Act section 1) (quoted for reporting from the publisher's the statutes and regulators' own texts in GB and the US)
- Competition Act 1998, s. 2 (the Chapter I prohibition) (quoted for reporting from the publisher's the statutes and regulators' own texts in GB and the US)
- National Security and Investment Act 2021, s. 7 (qualifying entities and assets) (quoted for reporting from the publisher's the statutes and regulators' own texts in GB and the US)
- National Security and Investment Act 2021, s. 14 (mandatory notification) (quoted for reporting from the publisher's the statutes and regulators' own texts in GB and the US)
- DOJ National Security Division, Data Security Program (quoted for reporting from the publisher's the statutes and regulators' own texts in GB and the US)
- 28 CFR Part 202 (access to US sensitive personal data by countries of concern) (quoted for reporting from the publisher's the statutes and regulators' own texts in GB and the US)
- 15 U.S.C. 9901 (Protecting Americans' Data from Foreign Adversaries Act) (quoted for reporting from the publisher's the statutes and regulators' own texts in GB and the US)
- California Civil Code 1798.140 (CCPA definitions) (quoted for reporting from the publisher's the statutes and regulators' own texts in GB and the US)
- UK GDPR, art. 28 (processor) (quoted for reporting from the publisher's the statutes and regulators' own texts in GB and the US)
- Copyright and Rights in Databases Regulations 1997, reg. 13 (database right) (quoted for reporting from the publisher's the statutes and regulators' own texts in GB and the US)
- Companies Act 2006, s. 172 (duty to promote the success of the company) (quoted for reporting from the publisher's the statutes and regulators' own texts in GB and the US)
- Delaware General Corporation Law, subchapter X (sale of assets, s. 271) (quoted for reporting from the publisher's the statutes and regulators' own texts in GB and the US)
- the universe, rule 1 (not yet read)
Take this figure with you
6 of 14 legal texts read in GB and the US set conditions a company must meet before licensing its operating data, newest read 28 October 2026.
What the rule guards, by instrument: data or assets reaching a foreign power 3 of 14, agreements that restrict competition 2 of 14, the directors' or stockholders' say 2 of 14, price-sensitive information disclosed selectively 2 of 14, personal data inside the records 2 of 14, information kept secret for its value 2 of 14, not stated 1 of 14 (14 instruments, read 28 October 2026).
What it does to a sale, by instrument: sets conditions the seller must meet 6 of 14, prohibits a kind of transaction 4 of 14, varies 3 of 14, gives the owner a right to enforce 1 of 14 (14 instruments, read 28 October 2026).
Who enforces it, by instrument: not stated 10 of 14, stated 4 of 14 (14 instruments, read 28 October 2026).
Suggested citation: "The rules a large company's data sale turns on", updated 2026-10-28, https://sellenterprisedatatoai.com/datasets/enterprise-data-sale-rules/.
CSV download (60 answers, worked out 2026-10-28)