Guide: rights and privacy

Selling company data
in Australia.

The legal setting is the quiet reason Australian business data commands attention from global buyers. Here is how rights, consent and privacy actually work in a sale, in plain language.

The licence-first advantage

In 2025, Australia declined to introduce a text-and-data-mining exception to copyright law. In practical terms: there is no "fair use for AI training" shortcut here. Anyone who wants Australian data for AI has to license it from whoever owns it.

For data owners, that is not a restriction. It is the entire basis of the market working in your favour. Global buyers pricing legal risk into scraped or ambiguously-sourced data pay a premium for supply that is licensed, consented and warranted end to end, and Australian supply is exactly that by default.

What you are actually selling

A data sale is a licence, not a removal. Your business grants defined rights, typically to use the prepared dataset for AI training, under written terms. You warrant that you had the authority to grant those rights. The dataset itself is a prepared, de-identified derivative, not your live systems and not your files as they sit today. You keep operating exactly as before; the licence covers what was extracted and prepared.

The rights checklist

Work product: under standard Australian employment arrangements, work created by employees in the course of employment belongs to the company. Contractor agreements need a check for IP assignment clauses.
Customer content: data belonging to your customers is excluded at extraction unless separately consented. What sells is your organisation's own operational record.
Third-party material: licensed software content, purchased datasets and copyrighted material are filtered out during extraction. They were never yours to sell, so they never enter the package.

How privacy is handled

Personal information is not what buyers want, and it is not what gets sold. Before anything reaches a buyer, the dataset goes through irreversible de-identification: names, emails, phone numbers, addresses, financial identifiers, and dozens more categories are removed or transformed so individuals cannot be re-identified, consistent with the de-identification principles of the Privacy Act and OAIC guidance. Every removal is recorded in an audit ledger that travels with the dataset, so the process is provable, not promised. Contracts add a second lock: buyers commit to non-reidentification as a term of the licence.

What the buyer signs

  • A written data licence defining permitted use, term and territory.
  • Warranties from the seller on provenance, authority and chain of title, which is why the rights work happens first.
  • Non-reidentification and handling obligations on the buyer's side.
  • Acceptance criteria: the deal settles when the dataset passes the buyer's verification, which is how our own sale to a frontier lab concluded.

The order of operations is the whole game: rights first, privacy second, structure third, market last. Run in that order, a data sale is a clean commercial transaction. Run in any other order, it is a mess that buyers walk away from.

General information, not legal advice. Specific arrangements, industry regulation and contract terms need review on the facts, and we work alongside your lawyers when a transaction proceeds.

Rights questions about your data?

They are usually more fixable than owners fear. Ask us.

Talk to us