# The rules a large company's data sale turns on

> 6 of 14 legal texts read in GB and the US set conditions a company must meet before licensing its operating data, newest read 28 October 2026.

Sell Enterprise Data To AI · https://sellenterprisedatatoai.com/datasets/enterprise-data-sale-rules/ · computed 2026-10-28

**Rules that set conditions on a sale:** 6 of 14 instruments (20 texts read; 21 named).

## The answers, question by question

- **What the rule guards:** data or assets reaching a foreign power 3, personal data inside the records 2, the directors' or stockholders' say 2, agreements that restrict competition 2, information kept secret for its value 2, price-sensitive information disclosed selectively 2, not stated 1
- **What it does to a sale:** sets conditions the seller must meet 6, prohibits a kind of transaction 4, varies 3, gives the owner a right to enforce 1
- **Who enforces it:** not stated 10, stated 4

## Every instrument

| Instrument | What the rule guards | What it does to a sale | Who enforces it |
|---|---|---|---|
| California Consumer Privacy Act | personal data inside the records | sets conditions the seller must meet | not stated |
| Companies Act 2006 (UK) | the directors' or stockholders' say | sets conditions the seller must meet | not stated |
| Competition Act 1998 (UK) | agreements that restrict competition | prohibits a kind of transaction | not stated |
| Copyright and Rights in Databases Regulations 1997 (UK) | not stated | gives the owner a right to enforce | not stated |
| Defend Trade Secrets Act (US) | information kept secret for its value | varies by document | in exceptional circumstances that render an injunction inequitable, that conditions… |
| Delaware General Corporation Law | the directors' or stockholders' say | sets conditions the seller must meet | not stated |
| DOJ Data Security Program (US) | data or assets reaching a foreign power | varies by document | On December 26, 2024, the Department’s National Security Division issued a final rule to… |
| National Security and Investment Act 2021 (UK) | data or assets reaching a foreign power | sets conditions the seller must meet | The Secretary of State may by regulations prescribe the form and content of a mandatory… |
| Protecting Americans' Data from Foreign Adversaries Act (US) | data or assets reaching a foreign power | prohibits a kind of transaction | not stated |
| Regulation FD (US) | price-sensitive information disclosed selectively | sets conditions the seller must meet | not stated |
| Sherman Act (US) | agreements that restrict competition | prohibits a kind of transaction | shall be deemed guilty of a felony, and, on conviction thereof, shall be punished by fine |
| Trade Secrets (Enforcement, etc.) Regulations 2018 (UK) | information kept secret for its value | varies by document | not stated |
| UK GDPR | personal data inside the records | sets conditions the seller must meet | not stated |
| UK Market Abuse Regulation | price-sensitive information disclosed selectively | prohibits a kind of transaction | not stated |

## The sentence each answer rests on (60)

- California Consumer Privacy Act, [Civil Code 1798.140, definitions](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140), read 2026-10-08, What the rule guards: "a consumer’s personal information by the business to a third party for monetary or other valuable consideration."
- California Consumer Privacy Act, [Civil Code 1798.140, definitions](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140), read 2026-10-08, What it does to a sale: "“Sell,” “selling,” “sale,” or “sold,’’ means selling, renting, releasing, disclosing, disseminating, making available, transferring"
- California Consumer Privacy Act, [Civil Code 1798.140, definitions](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140), read 2026-10-08, Who enforces it: Left open by the text (36,374 characters, read in full 2026-10-08).
- Companies Act 2006 (UK), [Section 172, duty to promote the success of the company](https://www.legislation.gov.uk/ukpga/2006/46/section/172), read 2026-10-28, What the rule guards: "would be most likely to promote the success of the company for the benefit of its members as a whole"
- Companies Act 2006 (UK), [Section 172, duty to promote the success of the company](https://www.legislation.gov.uk/ukpga/2006/46/section/172), read 2026-10-28, What it does to a sale: "A director of a company must act in the way he considers, in good faith"
- Companies Act 2006 (UK), [Section 172, duty to promote the success of the company](https://www.legislation.gov.uk/ukpga/2006/46/section/172), read 2026-10-28, Who enforces it: Left open by the text (7,206 characters, read in full 2026-10-28).
- Competition Act 1998 (UK), [Section 2, the Chapter I prohibition](https://www.legislation.gov.uk/ukpga/1998/41/section/2), read 2026-10-28, What the rule guards: "concerted practices which have as their object or effect the prevention, restriction or distortion of competition within the United Kingdom"
- Competition Act 1998 (UK), [Section 2, the Chapter I prohibition](https://www.legislation.gov.uk/ukpga/1998/41/section/2), read 2026-10-28, What it does to a sale: "Any agreement or decision which is prohibited by subsection (1) is void."
- Competition Act 1998 (UK), [Section 2, the Chapter I prohibition](https://www.legislation.gov.uk/ukpga/1998/41/section/2), read 2026-10-28, Who enforces it: Left open by the text (9,516 characters, read in full 2026-10-28).
- Copyright and Rights in Databases Regulations 1997 (UK), [Regulation 13, database right](https://www.legislation.gov.uk/uksi/1997/3032/regulation/13), read 2026-10-08, What the rule guards: Left open by the text (4,747 characters, read in full 2026-10-08).
- Copyright and Rights in Databases Regulations 1997 (UK), [Regulation 13, database right](https://www.legislation.gov.uk/uksi/1997/3032/regulation/13), read 2026-10-08, What it does to a sale: "A property right (“database right”) subsists, in accordance with this Part, in a database if there has been a substantial investment in obtaining, verifying or presenting the contents of the database."
- Copyright and Rights in Databases Regulations 1997 (UK), [Regulation 13, database right](https://www.legislation.gov.uk/uksi/1997/3032/regulation/13), read 2026-10-08, Who enforces it: Left open by the text (4,747 characters, read in full 2026-10-08).
- Defend Trade Secrets Act (US), [18 U.S.C. 1836, civil proceedings](https://www.law.cornell.edu/uscode/text/18/1836), read 2026-10-08, What the rule guards: Left open by the text (18,731 characters, read in full 2026-10-08).
- Defend Trade Secrets Act (US), [18 U.S.C. 1836, civil proceedings](https://www.law.cornell.edu/uscode/text/18/1836), read 2026-10-08, What it does to a sale: "that is misappropriated may bring a civil action under this subsection if the"
- Defend Trade Secrets Act (US), [18 U.S.C. 1836, civil proceedings](https://www.law.cornell.edu/uscode/text/18/1836), read 2026-10-08, Who enforces it: "in exceptional circumstances that render an injunction inequitable, that conditions future use of the"
- Defend Trade Secrets Act (US), [18 U.S.C. 1839, definitions](https://www.law.cornell.edu/uscode/text/18/1839), read 2026-10-08, What the rule guards: "thereof has taken reasonable measures to keep such information secret; and"
- Defend Trade Secrets Act (US), [18 U.S.C. 1839, definitions](https://www.law.cornell.edu/uscode/text/18/1839), read 2026-10-08, What it does to a sale: "the information derives independent economic value, actual or potential, from not being generally known to"
- Defend Trade Secrets Act (US), [18 U.S.C. 1839, definitions](https://www.law.cornell.edu/uscode/text/18/1839), read 2026-10-08, Who enforces it: Left open by the text (9,909 characters, read in full 2026-10-08).
- Delaware General Corporation Law, [Section 271, sale of assets](https://delcode.delaware.gov/title8/c001/sc10/index.html), read 2026-10-08, What the rule guards: "when and as authorized by a resolution adopted by the holders of a majority of the outstanding stock of the corporation entitled to vote thereon"
- Delaware General Corporation Law, [Section 271, sale of assets](https://delcode.delaware.gov/title8/c001/sc10/index.html), read 2026-10-08, What it does to a sale: "sell, lease or exchange all or substantially all of its property and assets, including its goodwill and its corporate franchises"
- Delaware General Corporation Law, [Section 271, sale of assets](https://delcode.delaware.gov/title8/c001/sc10/index.html), read 2026-10-08, Who enforces it: Left open by the text (41,950 characters, read in full 2026-10-08).
- DOJ Data Security Program (US), [National Security Division, Data Security Program](https://www.justice.gov/nsd/data-security), read 2026-10-28, What the rule guards: "The Data Security Program addresses the national-security risks posed by the continued efforts of foreign adversaries to use commercial activities to access and exploit U.S. Government-related data and Americans’ bulk sensitive personal data."
- DOJ Data Security Program (US), [National Security Division, Data Security Program](https://www.justice.gov/nsd/data-security), read 2026-10-28, What it does to a sale: "with certain affirmative requirements regarding due diligence and audits for restricted transactions (subpart J)"
- DOJ Data Security Program (US), [National Security Division, Data Security Program](https://www.justice.gov/nsd/data-security), read 2026-10-28, Who enforces it: "On December 26, 2024, the Department’s National Security Division issued a final rule to implement Executive Order 14117."
- DOJ Data Security Program (US), [28 CFR Part 202](https://www.law.cornell.edu/cfr/text/28/part-202), read 2026-10-28, What the rule guards: Left open by the text (1,748 characters, read in full 2026-10-28).
- DOJ Data Security Program (US), [28 CFR Part 202](https://www.law.cornell.edu/cfr/text/28/part-202), read 2026-10-28, What it does to a sale: "Subpart C—Prohibited Transactions and Related Activities (§§ 202.301 - 202.305)"
- DOJ Data Security Program (US), [28 CFR Part 202](https://www.law.cornell.edu/cfr/text/28/part-202), read 2026-10-28, Who enforces it: Left open by the text (1,748 characters, read in full 2026-10-28).
- National Security and Investment Act 2021 (UK), [Section 14, mandatory notification](https://www.legislation.gov.uk/ukpga/2021/25/section/14), read 2026-10-28, What the rule guards: Left open by the text (6,497 characters, read in full 2026-10-28).
- National Security and Investment Act 2021 (UK), [Section 14, mandatory notification](https://www.legislation.gov.uk/ukpga/2021/25/section/14), read 2026-10-28, What it does to a sale: "a person must give notice to the Secretary of State before the person, pursuant to a notifiable acquisition, gains control in circumstances falling within section 6(2)."
- National Security and Investment Act 2021 (UK), [Section 14, mandatory notification](https://www.legislation.gov.uk/ukpga/2021/25/section/14), read 2026-10-28, Who enforces it: "The Secretary of State may by regulations prescribe the form and content of a mandatory notice."
- National Security and Investment Act 2021 (UK), [Section 7, qualifying entities and assets](https://www.legislation.gov.uk/ukpga/2021/25/section/7), read 2026-10-28, What the rule guards: "ideas, information or techniques which have industrial, commercial or other economic value."
- National Security and Investment Act 2021 (UK), [Section 7, qualifying entities and assets](https://www.legislation.gov.uk/ukpga/2021/25/section/7), read 2026-10-28, What it does to a sale: Left open by the text (5,784 characters, read in full 2026-10-28).
- National Security and Investment Act 2021 (UK), [Section 7, qualifying entities and assets](https://www.legislation.gov.uk/ukpga/2021/25/section/7), read 2026-10-28, Who enforces it: Left open by the text (5,784 characters, read in full 2026-10-28).
- Protecting Americans' Data from Foreign Adversaries Act (US), [15 U.S.C. 9901](https://www.law.cornell.edu/uscode/text/15/9901), read 2026-10-28, What the rule guards: "It shall be unlawful for a data broker to sell, license, rent, trade, transfer, release, disclose, provide access to, or otherwise make available personally identifiable sensitive data of a United States individual to"
- Protecting Americans' Data from Foreign Adversaries Act (US), [15 U.S.C. 9901](https://www.law.cornell.edu/uscode/text/15/9901), read 2026-10-28, What it does to a sale: "any entity that is controlled by a foreign adversary."
- Protecting Americans' Data from Foreign Adversaries Act (US), [15 U.S.C. 9901](https://www.law.cornell.edu/uscode/text/15/9901), read 2026-10-28, Who enforces it: Left open by the text (8,270 characters, read in full 2026-10-28).
- Regulation FD (US), [17 CFR 243.100, general rule](https://www.law.cornell.edu/cfr/text/17/243.100), read 2026-10-28, What the rule guards: "discloses any material nonpublic information regarding that issuer or its securities to any person described in paragraph (b)(1) of this section"
- Regulation FD (US), [17 CFR 243.100, general rule](https://www.law.cornell.edu/cfr/text/17/243.100), read 2026-10-28, What it does to a sale: "the issuer shall make public disclosure of that information as provided in § 243.101(e):"
- Regulation FD (US), [17 CFR 243.100, general rule](https://www.law.cornell.edu/cfr/text/17/243.100), read 2026-10-28, Who enforces it: Left open by the text (5,170 characters, read in full 2026-10-28).
- Regulation FD (US), [17 CFR 243.101, definitions](https://www.law.cornell.edu/cfr/text/17/243.101), read 2026-10-28, What the rule guards: "A selective disclosure of material nonpublic information is “intentional” when the person making the disclosure either knows"
- Regulation FD (US), [17 CFR 243.101, definitions](https://www.law.cornell.edu/cfr/text/17/243.101), read 2026-10-28, What it does to a sale: "“Promptly” means as soon as reasonably practicable (but in no event after the later of 24 hours or the commencement of the next day's trading on the New York Stock Exchange)"
- Regulation FD (US), [17 CFR 243.101, definitions](https://www.law.cornell.edu/cfr/text/17/243.101), read 2026-10-28, Who enforces it: Left open by the text (5,120 characters, read in full 2026-10-28).
- Sherman Act (US), [15 U.S.C. 1](https://www.law.cornell.edu/uscode/text/15/1), read 2026-10-28, What the rule guards: "Every contract, combination in the form of trust or otherwise, or conspiracy, in restraint of trade or commerce among the several States"
- Sherman Act (US), [15 U.S.C. 1](https://www.law.cornell.edu/uscode/text/15/1), read 2026-10-28, What it does to a sale: "in restraint of trade or commerce among the several States, or with foreign nations, is declared to be illegal"
- Sherman Act (US), [15 U.S.C. 1](https://www.law.cornell.edu/uscode/text/15/1), read 2026-10-28, Who enforces it: "shall be deemed guilty of a felony, and, on conviction thereof, shall be punished by fine"
- Trade Secrets (Enforcement, etc.) Regulations 2018 (UK), [Regulation 2, interpretation](https://www.legislation.gov.uk/uksi/2018/597/regulation/2), read 2026-10-27, What the rule guards: "has commercial value because it is secret, and"
- Trade Secrets (Enforcement, etc.) Regulations 2018 (UK), [Regulation 2, interpretation](https://www.legislation.gov.uk/uksi/2018/597/regulation/2), read 2026-10-27, What it does to a sale: "is secret in the sense that it is not, as a body or in the precise configuration and assembly of its components, generally known among"
- Trade Secrets (Enforcement, etc.) Regulations 2018 (UK), [Regulation 2, interpretation](https://www.legislation.gov.uk/uksi/2018/597/regulation/2), read 2026-10-27, Who enforces it: Left open by the text (5,695 characters, read in full 2026-10-27).
- Trade Secrets (Enforcement, etc.) Regulations 2018 (UK), [Regulation 3, unlawful acquisition, use or disclosure](https://www.legislation.gov.uk/uksi/2018/597/regulation/3), read 2026-10-08, What the rule guards: Left open by the text (10,589 characters, read in full 2026-10-08).
- Trade Secrets (Enforcement, etc.) Regulations 2018 (UK), [Regulation 3, unlawful acquisition, use or disclosure](https://www.legislation.gov.uk/uksi/2018/597/regulation/3), read 2026-10-08, What it does to a sale: "The acquisition, use or disclosure of a trade secret is unlawful where the acquisition, use or disclosure constitutes a breach of confidence in confidential information."
- Trade Secrets (Enforcement, etc.) Regulations 2018 (UK), [Regulation 3, unlawful acquisition, use or disclosure](https://www.legislation.gov.uk/uksi/2018/597/regulation/3), read 2026-10-08, Who enforces it: Left open by the text (10,589 characters, read in full 2026-10-08).
- UK GDPR, [Article 28, processor](https://www.legislation.gov.uk/eur/2016/679/article/28), read 2026-10-08, What the rule guards: "processes the personal data only on documented instructions from the controller"
- UK GDPR, [Article 28, processor](https://www.legislation.gov.uk/eur/2016/679/article/28), read 2026-10-08, What it does to a sale: "Processing by a processor shall be governed by a contract or other legal act under"
- UK GDPR, [Article 28, processor](https://www.legislation.gov.uk/eur/2016/679/article/28), read 2026-10-08, Who enforces it: Left open by the text (12,826 characters, read in full 2026-10-08).
- UK Market Abuse Regulation, [Article 10, unlawful disclosure of inside information](https://www.legislation.gov.uk/eur/2014/596/article/10), read 2026-10-28, What the rule guards: "unlawful disclosure of inside information arises where a person possesses inside information and discloses that information to any other person"
- UK Market Abuse Regulation, [Article 10, unlawful disclosure of inside information](https://www.legislation.gov.uk/eur/2014/596/article/10), read 2026-10-28, What it does to a sale: "except where the disclosure is made in the normal exercise of an employment, a profession or duties."
- UK Market Abuse Regulation, [Article 10, unlawful disclosure of inside information](https://www.legislation.gov.uk/eur/2014/596/article/10), read 2026-10-28, Who enforces it: Left open by the text (5,839 characters, read in full 2026-10-28).
- UK Market Abuse Regulation, [Article 7, inside information](https://www.legislation.gov.uk/eur/2014/596/article/7), read 2026-10-28, What the rule guards: "information of a precise nature, which has not been made public, relating, directly or indirectly, to one or more issuers or to one or more financial instruments"
- UK Market Abuse Regulation, [Article 7, inside information](https://www.legislation.gov.uk/eur/2014/596/article/7), read 2026-10-28, What it does to a sale: Left open by the text (12,188 characters, read in full 2026-10-28).
- UK Market Abuse Regulation, [Article 7, inside information](https://www.legislation.gov.uk/eur/2014/596/article/7), read 2026-10-28, Who enforces it: Left open by the text (12,188 characters, read in full 2026-10-28).

## Methodology

Each instrument's own the statutes and regulators' own texts in GB and the US were read through estate-fetch and stored whole (sha256 on every row). For every text, three questions were answered from its own words: what the rule guards, what it does to a sale, who enforces it. Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the text read does not address the question. A instrument with several texts reads 'varies' where they disagree. 14 instruments, 20 texts.

## Sources

- [18 U.S.C. 1839 (trade secret definitions)](https://www.law.cornell.edu/uscode/text/18/1839) (read)
- [18 U.S.C. 1836 (civil action for trade secret misappropriation)](https://www.law.cornell.edu/uscode/text/18/1836) (read)
- [Trade Secrets (Enforcement, etc.) Regulations 2018, reg. 2](https://www.legislation.gov.uk/uksi/2018/597/regulation/2) (read)
- [Trade Secrets (Enforcement, etc.) Regulations 2018, reg. 3](https://www.legislation.gov.uk/uksi/2018/597/regulation/3) (read)
- [17 CFR 243.100 (Regulation FD)](https://www.law.cornell.edu/cfr/text/17/243.100) (read)
- [17 CFR 243.101 (Regulation FD definitions)](https://www.law.cornell.edu/cfr/text/17/243.101) (read)
- [UK Market Abuse Regulation, art. 7 (inside information)](https://www.legislation.gov.uk/eur/2014/596/article/7) (read)
- [UK Market Abuse Regulation, art. 10 (unlawful disclosure)](https://www.legislation.gov.uk/eur/2014/596/article/10) (read)
- [15 U.S.C. 1 (Sherman Act section 1)](https://www.law.cornell.edu/uscode/text/15/1) (read)
- [Competition Act 1998, s. 2 (the Chapter I prohibition)](https://www.legislation.gov.uk/ukpga/1998/41/section/2) (read)
- [National Security and Investment Act 2021, s. 7 (qualifying entities and assets)](https://www.legislation.gov.uk/ukpga/2021/25/section/7) (read)
- [National Security and Investment Act 2021, s. 14 (mandatory notification)](https://www.legislation.gov.uk/ukpga/2021/25/section/14) (read)
- [DOJ National Security Division, Data Security Program](https://www.justice.gov/nsd/data-security) (read)
- [28 CFR Part 202 (access to US sensitive personal data by countries of concern)](https://www.law.cornell.edu/cfr/text/28/part-202) (read)
- [15 U.S.C. 9901 (Protecting Americans' Data from Foreign Adversaries Act)](https://www.law.cornell.edu/uscode/text/15/9901) (read)
- [California Civil Code 1798.140 (CCPA definitions)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140) (read)
- [UK GDPR, art. 28 (processor)](https://www.legislation.gov.uk/eur/2016/679/article/28) (read)
- [Copyright and Rights in Databases Regulations 1997, reg. 13 (database right)](https://www.legislation.gov.uk/uksi/1997/3032/regulation/13) (read)
- [Companies Act 2006, s. 172 (duty to promote the success of the company)](https://www.legislation.gov.uk/ukpga/2006/46/section/172) (read)
- [Delaware General Corporation Law, subchapter X (sale of assets, s. 271)](https://delcode.delaware.gov/title8/c001/sc10/index.html) (read)
- [the universe, rule 1](https://www.legislation.gov.uk/uksi/2018/597/contents) (unread)

## Cite or embed

- 6 of 14 legal texts read in GB and the US set conditions a company must meet before licensing its operating data, newest read 28 October 2026.
- What the rule guards, by instrument: data or assets reaching a foreign power 3 of 14, agreements that restrict competition 2 of 14, the directors' or stockholders' say 2 of 14, price-sensitive information disclosed selectively 2 of 14, personal data inside the records 2 of 14, information kept secret for its value 2 of 14, not stated 1 of 14 (14 instruments, read 28 October 2026).
- What it does to a sale, by instrument: sets conditions the seller must meet 6 of 14, prohibits a kind of transaction 4 of 14, varies 3 of 14, gives the owner a right to enforce 1 of 14 (14 instruments, read 28 October 2026).
- Who enforces it, by instrument: not stated 10 of 14, stated 4 of 14 (14 instruments, read 28 October 2026).

Cite as: "The rules a large company's data sale turns on", updated 2026-10-28, https://sellenterprisedatatoai.com/datasets/enterprise-data-sale-rules/.

CSV: https://sellenterprisedatatoai.com/datasets/enterprise-data-sale-rules.csv
JSON: https://sellenterprisedatatoai.com/datasets/enterprise-data-sale-rules.json
Embed (plain HTML, static link back): see https://sellenterprisedatatoai.com/datasets/enterprise-data-sale-rules/#lead