{
 "name": "The law on the people in a CRM when the record changes hands",
 "title": "The law on the people in a CRM when the record changes hands",
 "kind": "terms-board",
 "url": "https://sellcrmdatatoai.com/datasets/crm-data-law/",
 "csv": "https://sellcrmdatatoai.com/datasets/crm-data-law.csv",
 "markdown": "https://sellcrmdatatoai.com/datasets/crm-data-law/index.md",
 "computed_at": "2026-10-28",
 "license": "https://sellcrmdatatoai.com/terms",
 "headline": "18 UK and US rules on the people in a CRM when the record is licensed or sold, read 28 October 2026.",
 "quotes": [
  "18 UK and US rules on the people in a CRM when the record is licensed or sold, read 28 October 2026.",
  "What the rule governs, by rule: a sale of personal information and its opt-out 5 of 18, marketing to the people in a list 4 of 18, selling personal information in bankruptcy 2 of 18, registering as a data broker 2 of 18, breaking a privacy promise 1 of 18, a lawful basis for using or disclosing personal data 1 of 18, a criminal offence for selling personal data 1 of 18, reusing personal data for a new purpose 1 of 18, telling people who holds their data 1 of 18 (18 rules, read 28 October 2026).",
  "What it asks before the data moves, by rule: no specific step stated 6 of 18, the person's consent 4 of 18, notice to the person 4 of 18, a court's approval or an ombudsman 2 of 18, a lawful basis 2 of 18 (18 rules, read 28 October 2026).",
  "Where it applies, by rule: the UK 10 of 18, California 4 of 18, US federal law 4 of 18 (18 rules, read 28 October 2026).",
  "The rule, in its words, by rule: stated 18 of 18 (18 rules, read 28 October 2026)."
 ],
 "citation": "\"The law on the people in a CRM when the record changes hands\", updated 2026-10-28, https://sellcrmdatatoai.com/datasets/crm-data-law/.",
 "national": {
  "n": 18,
  "unit": "rules",
  "documents": 18,
  "published_sources": 18,
  "named_sources": 19
 },
 "board": {
  "type": "clauses",
  "noun": {
   "one": "rule",
   "many": "rules"
  },
  "document": {
   "one": "statute or guidance page",
   "many": "statute and guidance pages"
  },
  "fields": [
   {
    "id": "covers",
    "label": "What the rule governs",
    "counts": {
     "bankruptcy-sale": 2,
     "broker": 2,
     "marketing": 4,
     "sale": 5,
     "offence": 1,
     "deception": 1,
     "transparency": 1,
     "purpose": 1,
     "lawful-basis": 1
    },
    "values": [
     {
      "value": "lawful-basis",
      "text": "a lawful basis for using or disclosing personal data"
     },
     {
      "value": "purpose",
      "text": "reusing personal data for a new purpose"
     },
     {
      "value": "transparency",
      "text": "telling people who holds their data"
     },
     {
      "value": "offence",
      "text": "a criminal offence for selling personal data"
     },
     {
      "value": "marketing",
      "text": "marketing to the people in a list"
     },
     {
      "value": "sale",
      "text": "a sale of personal information and its opt-out"
     },
     {
      "value": "broker",
      "text": "registering as a data broker"
     },
     {
      "value": "bankruptcy-sale",
      "text": "selling personal information in bankruptcy"
     },
     {
      "value": "deception",
      "text": "breaking a privacy promise"
     }
    ]
   },
   {
    "id": "before_transfer",
    "label": "What it asks before the data moves",
    "counts": {
     "court-review": 2,
     "no-step": 6,
     "notice": 4,
     "consent": 4,
     "lawful-basis": 2
    },
    "values": [
     {
      "value": "consent",
      "text": "the person's consent"
     },
     {
      "value": "notice",
      "text": "notice to the person"
     },
     {
      "value": "lawful-basis",
      "text": "a lawful basis"
     },
     {
      "value": "court-review",
      "text": "a court's approval or an ombudsman"
     },
     {
      "value": "no-step",
      "text": "no specific step stated"
     }
    ]
   },
   {
    "id": "jurisdiction",
    "label": "Where it applies",
    "counts": {
     "us-federal": 4,
     "us-california": 4,
     "gb": 10
    },
    "values": [
     {
      "value": "gb",
      "text": "the UK"
     },
     {
      "value": "us-federal",
      "text": "US federal law"
     },
     {
      "value": "us-california",
      "text": "California"
     }
    ]
   },
   {
    "id": "clause",
    "label": "The rule, in its words",
    "counts": {
     "stated": 18
    },
    "values": [
     {
      "value": "stated",
      "text": "stated"
     }
    ],
    "clause": true
   }
  ],
  "lead": {
   "type": "count",
   "field": null,
   "value": null,
   "n": 18,
   "of": 18,
   "label": "Rules on the register"
  },
  "vendors": [
   {
    "name": "11 U.S.C. 332",
    "answers": {
     "covers": {
      "value": "bankruptcy-sale",
      "text": "selling personal information in bankruptcy",
      "documents": [
       {
        "document": "11 U.S. Code section 332",
        "url": "https://www.law.cornell.edu/uscode/text/11/332",
        "value": "bankruptcy-sale",
        "quote": "If a hearing is required under section 363(b)(1)(B), the court shall order the United States trustee to appoint"
       }
      ]
     },
     "before_transfer": {
      "value": "court-review",
      "text": "a court's approval or an ombudsman",
      "documents": [
       {
        "document": "11 U.S. Code section 332",
        "url": "https://www.law.cornell.edu/uscode/text/11/332",
        "value": "court-review",
        "quote": "the court shall order the United States trustee to appoint"
       }
      ]
     },
     "jurisdiction": {
      "value": "us-federal",
      "text": "US federal law",
      "documents": [
       {
        "document": "11 U.S. Code section 332",
        "url": "https://www.law.cornell.edu/uscode/text/11/332",
        "value": "us-federal",
        "quote": "the court shall order the United States trustee to appoint"
       }
      ]
     },
     "clause": {
      "value": "stated",
      "text": "If a hearing is required under section 363(b)(1)(B), the court shall order the United…",
      "documents": [
       {
        "document": "11 U.S. Code section 332",
        "url": "https://www.law.cornell.edu/uscode/text/11/332",
        "value": "stated",
        "quote": "If a hearing is required under section 363(b)(1)(B), the court shall order the United States trustee to appoint"
       }
      ]
     }
    }
   },
   {
    "name": "11 U.S.C. 363(b)(1)",
    "answers": {
     "covers": {
      "value": "bankruptcy-sale",
      "text": "selling personal information in bankruptcy",
      "documents": [
       {
        "document": "11 U.S. Code section 363",
        "url": "https://www.law.cornell.edu/uscode/text/11/363",
        "value": "bankruptcy-sale",
        "quote": "then the trustee may not sell or lease personally identifiable information to any person unless"
       }
      ]
     },
     "before_transfer": {
      "value": "court-review",
      "text": "a court's approval or an ombudsman",
      "documents": [
       {
        "document": "11 U.S. Code section 363",
        "url": "https://www.law.cornell.edu/uscode/text/11/363",
        "value": "court-review",
        "quote": "after appointment of a consumer privacy ombudsman in accordance with section 332, and after notice and a hearing, the court approves such sale"
       }
      ]
     },
     "jurisdiction": {
      "value": "us-federal",
      "text": "US federal law",
      "documents": [
       {
        "document": "11 U.S. Code section 363",
        "url": "https://www.law.cornell.edu/uscode/text/11/363",
        "value": "us-federal",
        "quote": "then the trustee may not sell or lease personally identifiable information to any person unless"
       }
      ]
     },
     "clause": {
      "value": "stated",
      "text": "then the trustee may not sell or lease personally identifiable information to any person…",
      "documents": [
       {
        "document": "11 U.S. Code section 363",
        "url": "https://www.law.cornell.edu/uscode/text/11/363",
        "value": "stated",
        "quote": "then the trustee may not sell or lease personally identifiable information to any person unless"
       }
      ]
     }
    }
   },
   {
    "name": "California data broker definition",
    "answers": {
     "covers": {
      "value": "broker",
      "text": "registering as a data broker",
      "documents": [
       {
        "document": "California Civil Code section 1798.99.80",
        "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.99.80",
        "value": "broker",
        "quote": "means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship"
       }
      ]
     },
     "before_transfer": {
      "value": "no-step",
      "text": "no specific step stated",
      "documents": [
       {
        "document": "California Civil Code section 1798.99.80",
        "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.99.80",
        "value": "no-step",
        "quote": "means a business that knowingly collects and sells to third parties the personal information of a consumer"
       }
      ]
     },
     "jurisdiction": {
      "value": "us-california",
      "text": "California",
      "documents": [
       {
        "document": "California Civil Code section 1798.99.80",
        "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.99.80",
        "value": "us-california",
        "quote": "means a business that knowingly collects and sells to third parties the personal information of a consumer"
       }
      ]
     },
     "clause": {
      "value": "stated",
      "text": "means a business that knowingly collects and sells to third parties the personal…",
      "documents": [
       {
        "document": "California Civil Code section 1798.99.80",
        "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.99.80",
        "value": "stated",
        "quote": "means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship"
       }
      ]
     }
    }
   },
   {
    "name": "California data broker registry",
    "answers": {
     "covers": {
      "value": "broker",
      "text": "registering as a data broker",
      "documents": [
       {
        "document": "California Data Broker Registry (CalPrivacy)",
        "url": "https://cppa.ca.gov/data_broker_registry/",
        "value": "broker",
        "quote": "must register with CalPrivacy annually between January 1-31 to report on its activities from the previous calendar year"
       }
      ]
     },
     "before_transfer": {
      "value": "no-step",
      "text": "no specific step stated",
      "documents": [
       {
        "document": "California Data Broker Registry (CalPrivacy)",
        "url": "https://cppa.ca.gov/data_broker_registry/",
        "value": "no-step",
        "quote": "must register with CalPrivacy annually between January 1-31"
       }
      ]
     },
     "jurisdiction": {
      "value": "us-california",
      "text": "California",
      "documents": [
       {
        "document": "California Data Broker Registry (CalPrivacy)",
        "url": "https://cppa.ca.gov/data_broker_registry/",
        "value": "us-california",
        "quote": "must register with CalPrivacy annually between January 1-31"
       }
      ]
     },
     "clause": {
      "value": "stated",
      "text": "Any business that meets the definition of \"data broker\" must register with CalPrivacy…",
      "documents": [
       {
        "document": "California Data Broker Registry (CalPrivacy)",
        "url": "https://cppa.ca.gov/data_broker_registry/",
        "value": "stated",
        "quote": "Any business that meets the definition of \"data broker\" must register with CalPrivacy annually between January 1-31"
       }
      ]
     }
    }
   },
   {
    "name": "CAN-SPAM",
    "answers": {
     "covers": {
      "value": "marketing",
      "text": "marketing to the people in a list",
      "documents": [
       {
        "document": "15 U.S. Code section 7704",
        "url": "https://www.law.cornell.edu/uscode/text/15/7704",
        "value": "marketing",
        "quote": "to sell, lease, exchange, or otherwise transfer or release the electronic mail address of the recipient"
       }
      ]
     },
     "before_transfer": {
      "value": "no-step",
      "text": "no specific step stated",
      "documents": [
       {
        "document": "15 U.S. Code section 7704",
        "url": "https://www.law.cornell.edu/uscode/text/15/7704",
        "value": "no-step",
        "quote": "to sell, lease, exchange, or otherwise transfer or release the electronic mail address of the recipient"
       }
      ]
     },
     "jurisdiction": {
      "value": "us-federal",
      "text": "US federal law",
      "documents": [
       {
        "document": "15 U.S. Code section 7704",
        "url": "https://www.law.cornell.edu/uscode/text/15/7704",
        "value": "us-federal",
        "quote": "to sell, lease, exchange, or otherwise transfer or release the electronic mail address of the recipient"
       }
      ]
     },
     "clause": {
      "value": "stated",
      "text": "for the sender, or any other person who knows that the recipient has made such a request…",
      "documents": [
       {
        "document": "15 U.S. Code section 7704",
        "url": "https://www.law.cornell.edu/uscode/text/15/7704",
        "value": "stated",
        "quote": "for the sender, or any other person who knows that the recipient has made such a request, to sell, lease, exchange, or otherwise transfer or release the electronic mail address of the recipient"
       }
      ]
     }
    }
   },
   {
    "name": "CCPA definition of sale",
    "answers": {
     "covers": {
      "value": "sale",
      "text": "a sale of personal information and its opt-out",
      "documents": [
       {
        "document": "California Civil Code section 1798.140",
        "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140",
        "value": "sale",
        "quote": "a consumer’s personal information by the business to a third party for monetary or othe"
       }
      ]
     },
     "before_transfer": {
      "value": "no-step",
      "text": "no specific step stated",
      "documents": [
       {
        "document": "California Civil Code section 1798.140",
        "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140",
        "value": "no-step",
        "quote": "The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction"
       }
      ]
     },
     "jurisdiction": {
      "value": "us-california",
      "text": "California",
      "documents": [
       {
        "document": "California Civil Code section 1798.140",
        "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140",
        "value": "us-california",
        "quote": "The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy"
       }
      ]
     },
     "clause": {
      "value": "stated",
      "text": "The business transfers to a third party the personal information of a consumer as an…",
      "documents": [
       {
        "document": "California Civil Code section 1798.140",
        "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140",
        "value": "stated",
        "quote": "The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business"
       }
      ]
     }
    }
   },
   {
    "name": "CCPA right to opt out",
    "answers": {
     "covers": {
      "value": "sale",
      "text": "a sale of personal information and its opt-out",
      "documents": [
       {
        "document": "California Civil Code section 1798.120",
        "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.120",
        "value": "sale",
        "quote": "A consumer shall have the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell"
       }
      ]
     },
     "before_transfer": {
      "value": "notice",
      "text": "notice to the person",
      "documents": [
       {
        "document": "California Civil Code section 1798.120",
        "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.120",
        "value": "notice",
        "quote": "This right may be referred to as the right to opt out of sale or sharing"
       }
      ]
     },
     "jurisdiction": {
      "value": "us-california",
      "text": "California",
      "documents": [
       {
        "document": "California Civil Code section 1798.120",
        "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.120",
        "value": "us-california",
        "quote": "This right may be referred to as the right to opt out of sale or sharing"
       }
      ]
     },
     "clause": {
      "value": "stated",
      "text": "A business to which another business transfers the personal information of a consumer as…",
      "documents": [
       {
        "document": "California Civil Code section 1798.120",
        "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.120",
        "value": "stated",
        "quote": "A business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction"
       }
      ]
     }
    }
   },
   {
    "name": "Data Protection Act 2018 s 170",
    "answers": {
     "covers": {
      "value": "offence",
      "text": "a criminal offence for selling personal data",
      "documents": [
       {
        "document": "Data Protection Act 2018, section 170",
        "url": "https://www.legislation.gov.uk/ukpga/2018/12/section/170",
        "value": "offence",
        "quote": "It is an offence for a person to sell personal data if the person obtained the data in circumstances in which an offence under subsection (1) was committed"
       }
      ]
     },
     "before_transfer": {
      "value": "consent",
      "text": "the person's consent",
      "documents": [
       {
        "document": "Data Protection Act 2018, section 170",
        "url": "https://www.legislation.gov.uk/ukpga/2018/12/section/170",
        "value": "consent",
        "quote": "to obtain or disclose personal data without the consent of the controller"
       }
      ]
     },
     "jurisdiction": {
      "value": "gb",
      "text": "the UK",
      "documents": [
       {
        "document": "Data Protection Act 2018, section 170",
        "url": "https://www.legislation.gov.uk/ukpga/2018/12/section/170",
        "value": "gb",
        "quote": "It is an offence for a person knowingly or recklessly"
       }
      ]
     },
     "clause": {
      "value": "stated",
      "text": "It is an offence for a person to sell personal data if the person obtained the data in…",
      "documents": [
       {
        "document": "Data Protection Act 2018, section 170",
        "url": "https://www.legislation.gov.uk/ukpga/2018/12/section/170",
        "value": "stated",
        "quote": "It is an offence for a person to sell personal data if the person obtained the data in circumstances in which an offence under subsection (1) was committed"
       }
      ]
     }
    }
   },
   {
    "name": "FTC Act section 5",
    "answers": {
     "covers": {
      "value": "deception",
      "text": "breaking a privacy promise",
      "documents": [
       {
        "document": "15 U.S. Code section 45",
        "url": "https://www.law.cornell.edu/uscode/text/15/45",
        "value": "deception",
        "quote": "unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful"
       }
      ]
     },
     "before_transfer": {
      "value": "no-step",
      "text": "no specific step stated",
      "documents": [
       {
        "document": "15 U.S. Code section 45",
        "url": "https://www.law.cornell.edu/uscode/text/15/45",
        "value": "no-step",
        "quote": "unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful"
       }
      ]
     },
     "jurisdiction": {
      "value": "us-federal",
      "text": "US federal law",
      "documents": [
       {
        "document": "15 U.S. Code section 45",
        "url": "https://www.law.cornell.edu/uscode/text/15/45",
        "value": "us-federal",
        "quote": "unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful"
       }
      ]
     },
     "clause": {
      "value": "stated",
      "text": "Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or…",
      "documents": [
       {
        "document": "15 U.S. Code section 45",
        "url": "https://www.law.cornell.edu/uscode/text/15/45",
        "value": "stated",
        "quote": "Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful"
       }
      ]
     }
    }
   },
   {
    "name": "ICO data sharing code on databases and lists",
    "answers": {
     "covers": {
      "value": "sale",
      "text": "a sale of personal information and its opt-out",
      "documents": [
       {
        "document": "ICO code of practice page",
        "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/",
        "value": "sale",
        "quote": "The transfer of databases or lists of individuals is a form of data sharing, whether for money or other consideration, and whether for profit or not."
       }
      ]
     },
     "before_transfer": {
      "value": "notice",
      "text": "notice to the person",
      "documents": [
       {
        "document": "ICO code of practice page",
        "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/",
        "value": "notice",
        "quote": "You must tell data subjects who you are sharing their data with, and for what purposes."
       }
      ]
     },
     "jurisdiction": {
      "value": "gb",
      "text": "the UK",
      "documents": [
       {
        "document": "ICO code of practice page",
        "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/",
        "value": "gb",
        "quote": "check what information was given to individuals in accordance with Article 14 of the UK GDPR"
       }
      ]
     },
     "clause": {
      "value": "stated",
      "text": "You are responsible for compliance with the law for the data you receive, and you have to…",
      "documents": [
       {
        "document": "ICO code of practice page",
        "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/",
        "value": "stated",
        "quote": "You are responsible for compliance with the law for the data you receive, and you have to respond to any complaints about it."
       }
      ]
     }
    }
   },
   {
    "name": "ICO data sharing code on mergers and acquisitions",
    "answers": {
     "covers": {
      "value": "sale",
      "text": "a sale of personal information and its opt-out",
      "documents": [
       {
        "document": "ICO code of practice page",
        "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/",
        "value": "sale",
        "quote": "on insolvency, data might be sold as an asset to a different legal personality"
       }
      ]
     },
     "before_transfer": {
      "value": "notice",
      "text": "notice to the person",
      "documents": [
       {
        "document": "ICO code of practice page",
        "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/",
        "value": "notice",
        "quote": "consider when and how you will inform data subjects about what is happening"
       }
      ]
     },
     "jurisdiction": {
      "value": "gb",
      "text": "the UK",
      "documents": [
       {
        "document": "ICO code of practice page",
        "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/",
        "value": "gb",
        "quote": "Under the UK GDPR you are required to keep individual data subjects informed about certain changes relating to the processing of their data, and they may have a right to object."
       }
      ]
     },
     "clause": {
      "value": "stated",
      "text": "If a merger or acquisition or other change in organisational structure means that you…",
      "documents": [
       {
        "document": "ICO code of practice page",
        "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/",
        "value": "stated",
        "quote": "If a merger or acquisition or other change in organisational structure means that you have to transfer data to a different or additional controller, you must consider data sharing as part of the due diligence you carry out when taking on the organisation and its obligations."
       }
      ]
     }
    }
   },
   {
    "name": "ICO direct marketing guidance",
    "answers": {
     "covers": {
      "value": "marketing",
      "text": "marketing to the people in a list",
      "documents": [
       {
        "document": "ICO: direct marketing guidance",
        "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/",
        "value": "marketing",
        "quote": "People have an absolute right to object to or opt out of direct marketing at any time"
       }
      ]
     },
     "before_transfer": {
      "value": "no-step",
      "text": "no specific step stated",
      "documents": [
       {
        "document": "ICO: direct marketing guidance",
        "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/",
        "value": "no-step",
        "quote": "People have an absolute right to object to or opt out of direct marketing at any time"
       }
      ]
     },
     "jurisdiction": {
      "value": "gb",
      "text": "the UK",
      "documents": [
       {
        "document": "ICO: direct marketing guidance",
        "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/",
        "value": "gb",
        "quote": "People have an absolute right to object to or opt out of direct marketing at any time"
       }
      ]
     },
     "clause": {
      "value": "stated",
      "text": "People have an absolute right to object to or opt out of direct marketing at any time",
      "documents": [
       {
        "document": "ICO: direct marketing guidance",
        "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/",
        "value": "stated",
        "quote": "People have an absolute right to object to or opt out of direct marketing at any time"
       }
      ]
     }
    }
   },
   {
    "name": "ICO guide to PECR: email marketing",
    "answers": {
     "covers": {
      "value": "marketing",
      "text": "marketing to the people in a list",
      "documents": [
       {
        "document": "ICO: guide to PECR, electronic mail marketing",
        "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/",
        "value": "marketing",
        "quote": "You must not send marketing emails or texts to individuals without specific consent"
       }
      ]
     },
     "before_transfer": {
      "value": "consent",
      "text": "the person's consent",
      "documents": [
       {
        "document": "ICO: guide to PECR, electronic mail marketing",
        "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/",
        "value": "consent",
        "quote": "You must not send marketing emails or texts to individuals without specific consent"
       }
      ]
     },
     "jurisdiction": {
      "value": "gb",
      "text": "the UK",
      "documents": [
       {
        "document": "ICO: guide to PECR, electronic mail marketing",
        "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/",
        "value": "gb",
        "quote": "The rules on electronic mail marketing are in regulation 22"
       }
      ]
     },
     "clause": {
      "value": "stated",
      "text": "There is a limited exception for your own previous customers, often called the ‘soft…",
      "documents": [
       {
        "document": "ICO: guide to PECR, electronic mail marketing",
        "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/",
        "value": "stated",
        "quote": "There is a limited exception for your own previous customers, often called the ‘soft opt-in’"
       }
      ]
     }
    }
   },
   {
    "name": "ICO guide to PECR: using marketing lists",
    "answers": {
     "covers": {
      "value": "sale",
      "text": "a sale of personal information and its opt-out",
      "documents": [
       {
        "document": "ICO guidance page",
        "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/using-marketing-lists/",
        "value": "sale",
        "quote": "As a general rule, you can only sell your marketing list if you have the consent of the listed individuals to do so."
       }
      ]
     },
     "before_transfer": {
      "value": "consent",
      "text": "the person's consent",
      "documents": [
       {
        "document": "ICO guidance page",
        "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/using-marketing-lists/",
        "value": "consent",
        "quote": "Ask for specific consent also if you want to pass details to other companies, and make sure you name or describe those companies."
       }
      ]
     },
     "jurisdiction": {
      "value": "gb",
      "text": "the UK",
      "documents": [
       {
        "document": "ICO guidance page",
        "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/using-marketing-lists/",
        "value": "gb",
        "quote": "You should screen call lists against the TPS"
       }
      ]
     },
     "clause": {
      "value": "stated",
      "text": "As a general rule, you can only sell your marketing list if you have the consent of the…",
      "documents": [
       {
        "document": "ICO guidance page",
        "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/using-marketing-lists/",
        "value": "stated",
        "quote": "As a general rule, you can only sell your marketing list if you have the consent of the listed individuals to do so."
       }
      ]
     }
    }
   },
   {
    "name": "PECR 2003 reg 22",
    "answers": {
     "covers": {
      "value": "marketing",
      "text": "marketing to the people in a list",
      "documents": [
       {
        "document": "Privacy and Electronic Communications Regulations 2003, regulation 22",
        "url": "https://www.legislation.gov.uk/uksi/2003/2426/regulation/22",
        "value": "marketing",
        "quote": "a person shall neither transmit, nor instigate the transmission of, unsolicited communications for the purposes of direct marketing by means of electronic mail"
       }
      ]
     },
     "before_transfer": {
      "value": "consent",
      "text": "the person's consent",
      "documents": [
       {
        "document": "Privacy and Electronic Communications Regulations 2003, regulation 22",
        "url": "https://www.legislation.gov.uk/uksi/2003/2426/regulation/22",
        "value": "consent",
        "quote": "unless the recipient of the electronic mail has previously notified the sender that he consents"
       }
      ]
     },
     "jurisdiction": {
      "value": "gb",
      "text": "the UK",
      "documents": [
       {
        "document": "Privacy and Electronic Communications Regulations 2003, regulation 22",
        "url": "https://www.legislation.gov.uk/uksi/2003/2426/regulation/22",
        "value": "gb",
        "quote": "a person shall neither transmit, nor instigate the transmission of, unsolicited communications"
       }
      ]
     },
     "clause": {
      "value": "stated",
      "text": "a person shall neither transmit, nor instigate the transmission of, unsolicited…",
      "documents": [
       {
        "document": "Privacy and Electronic Communications Regulations 2003, regulation 22",
        "url": "https://www.legislation.gov.uk/uksi/2003/2426/regulation/22",
        "value": "stated",
        "quote": "a person shall neither transmit, nor instigate the transmission of, unsolicited communications for the purposes of direct marketing by means of electronic mail"
       }
      ]
     }
    }
   },
   {
    "name": "UK GDPR art 14",
    "answers": {
     "covers": {
      "value": "transparency",
      "text": "telling people who holds their data",
      "documents": [
       {
        "document": "UK GDPR, Article 14",
        "url": "https://www.legislation.gov.uk/eur/2016/679/article/14",
        "value": "transparency",
        "quote": "Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information"
       }
      ]
     },
     "before_transfer": {
      "value": "notice",
      "text": "notice to the person",
      "documents": [
       {
        "document": "UK GDPR, Article 14",
        "url": "https://www.legislation.gov.uk/eur/2016/679/article/14",
        "value": "notice",
        "quote": "the controller shall provide the data subject with the following information"
       }
      ]
     },
     "jurisdiction": {
      "value": "gb",
      "text": "the UK",
      "documents": [
       {
        "document": "UK GDPR, Article 14",
        "url": "https://www.legislation.gov.uk/eur/2016/679/article/14",
        "value": "gb",
        "quote": "the controller shall provide the data subject with the following information"
       }
      ]
     },
     "clause": {
      "value": "stated",
      "text": "Where personal data have not been obtained from the data subject, the controller shall…",
      "documents": [
       {
        "document": "UK GDPR, Article 14",
        "url": "https://www.legislation.gov.uk/eur/2016/679/article/14",
        "value": "stated",
        "quote": "Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information"
       }
      ]
     }
    }
   },
   {
    "name": "UK GDPR art 5",
    "answers": {
     "covers": {
      "value": "purpose",
      "text": "reusing personal data for a new purpose",
      "documents": [
       {
        "document": "UK GDPR, Article 5",
        "url": "https://www.legislation.gov.uk/eur/2016/679/article/5",
        "value": "purpose",
        "quote": "for specified, explicit and legitimate purposes and not further process"
       }
      ]
     },
     "before_transfer": {
      "value": "lawful-basis",
      "text": "a lawful basis",
      "documents": [
       {
        "document": "UK GDPR, Article 5",
        "url": "https://www.legislation.gov.uk/eur/2016/679/article/5",
        "value": "lawful-basis",
        "quote": "processed lawfully, fairly and in a transparent manner in relation to the data subject"
       }
      ]
     },
     "jurisdiction": {
      "value": "gb",
      "text": "the UK",
      "documents": [
       {
        "document": "UK GDPR, Article 5",
        "url": "https://www.legislation.gov.uk/eur/2016/679/article/5",
        "value": "gb",
        "quote": "processed lawfully, fairly and in a transparent manner in relation to the data subject"
       }
      ]
     },
     "clause": {
      "value": "stated",
      "text": "processed lawfully, fairly and in a transparent manner in relation to the data subject",
      "documents": [
       {
        "document": "UK GDPR, Article 5",
        "url": "https://www.legislation.gov.uk/eur/2016/679/article/5",
        "value": "stated",
        "quote": "processed lawfully, fairly and in a transparent manner in relation to the data subject"
       }
      ]
     }
    }
   },
   {
    "name": "UK GDPR art 6",
    "answers": {
     "covers": {
      "value": "lawful-basis",
      "text": "a lawful basis for using or disclosing personal data",
      "documents": [
       {
        "document": "UK GDPR, Article 6",
        "url": "https://www.legislation.gov.uk/eur/2016/679/article/6",
        "value": "lawful-basis",
        "quote": "Processing shall be lawful only if and to the extent that at least one of the following applies"
       }
      ]
     },
     "before_transfer": {
      "value": "lawful-basis",
      "text": "a lawful basis",
      "documents": [
       {
        "document": "UK GDPR, Article 6",
        "url": "https://www.legislation.gov.uk/eur/2016/679/article/6",
        "value": "lawful-basis",
        "quote": "Processing shall be lawful only if and to the extent that at least one of the following applies"
       }
      ]
     },
     "jurisdiction": {
      "value": "gb",
      "text": "the UK",
      "documents": [
       {
        "document": "UK GDPR, Article 6",
        "url": "https://www.legislation.gov.uk/eur/2016/679/article/6",
        "value": "gb",
        "quote": "Processing shall be lawful only if and to the extent that at least one of the following applies"
       }
      ]
     },
     "clause": {
      "value": "stated",
      "text": "the data subject has given consent to the processing of his or her personal data for one…",
      "documents": [
       {
        "document": "UK GDPR, Article 6",
        "url": "https://www.legislation.gov.uk/eur/2016/679/article/6",
        "value": "stated",
        "quote": "the data subject has given consent to the processing of his or her personal data for one or more specific purposes"
       }
      ]
     }
    }
   }
  ]
 },
 "subject_kind": "rule",
 "rows": [
  {
   "subject": "11 U.S.C. 332",
   "url": "https://www.law.cornell.edu/uscode/text/11/332",
   "document": "11 U.S. Code section 332",
   "question": "covers",
   "answer": "bankruptcy-sale",
   "answer_text": "selling personal information in bankruptcy",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "If a hearing is required under section 363(b)(1)(B), the court shall order the United States trustee to appoint",
   "text_sha256": "1bb3a91530d97ef6bb3f891292c15c195d66dc3e718430baa91bf2481938d6b8"
  },
  {
   "subject": "11 U.S.C. 332",
   "url": "https://www.law.cornell.edu/uscode/text/11/332",
   "document": "11 U.S. Code section 332",
   "question": "before_transfer",
   "answer": "court-review",
   "answer_text": "a court's approval or an ombudsman",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "the court shall order the United States trustee to appoint",
   "text_sha256": "1bb3a91530d97ef6bb3f891292c15c195d66dc3e718430baa91bf2481938d6b8"
  },
  {
   "subject": "11 U.S.C. 332",
   "url": "https://www.law.cornell.edu/uscode/text/11/332",
   "document": "11 U.S. Code section 332",
   "question": "jurisdiction",
   "answer": "us-federal",
   "answer_text": "US federal law",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "the court shall order the United States trustee to appoint",
   "text_sha256": "1bb3a91530d97ef6bb3f891292c15c195d66dc3e718430baa91bf2481938d6b8"
  },
  {
   "subject": "11 U.S.C. 332",
   "url": "https://www.law.cornell.edu/uscode/text/11/332",
   "document": "11 U.S. Code section 332",
   "question": "clause",
   "answer": "stated",
   "answer_text": "If a hearing is required under section 363(b)(1)(B), the court shall order the United…",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "If a hearing is required under section 363(b)(1)(B), the court shall order the United States trustee to appoint",
   "text_sha256": "1bb3a91530d97ef6bb3f891292c15c195d66dc3e718430baa91bf2481938d6b8"
  },
  {
   "subject": "11 U.S.C. 363(b)(1)",
   "url": "https://www.law.cornell.edu/uscode/text/11/363",
   "document": "11 U.S. Code section 363",
   "question": "covers",
   "answer": "bankruptcy-sale",
   "answer_text": "selling personal information in bankruptcy",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "then the trustee may not sell or lease personally identifiable information to any person unless",
   "text_sha256": "f3a43b14cba78eb9942855de6148ad677a67ef14fb154add1c957c39a846cc08"
  },
  {
   "subject": "11 U.S.C. 363(b)(1)",
   "url": "https://www.law.cornell.edu/uscode/text/11/363",
   "document": "11 U.S. Code section 363",
   "question": "before_transfer",
   "answer": "court-review",
   "answer_text": "a court's approval or an ombudsman",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "after appointment of a consumer privacy ombudsman in accordance with section 332, and after notice and a hearing, the court approves such sale",
   "text_sha256": "f3a43b14cba78eb9942855de6148ad677a67ef14fb154add1c957c39a846cc08"
  },
  {
   "subject": "11 U.S.C. 363(b)(1)",
   "url": "https://www.law.cornell.edu/uscode/text/11/363",
   "document": "11 U.S. Code section 363",
   "question": "jurisdiction",
   "answer": "us-federal",
   "answer_text": "US federal law",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "then the trustee may not sell or lease personally identifiable information to any person unless",
   "text_sha256": "f3a43b14cba78eb9942855de6148ad677a67ef14fb154add1c957c39a846cc08"
  },
  {
   "subject": "11 U.S.C. 363(b)(1)",
   "url": "https://www.law.cornell.edu/uscode/text/11/363",
   "document": "11 U.S. Code section 363",
   "question": "clause",
   "answer": "stated",
   "answer_text": "then the trustee may not sell or lease personally identifiable information to any person…",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "then the trustee may not sell or lease personally identifiable information to any person unless",
   "text_sha256": "f3a43b14cba78eb9942855de6148ad677a67ef14fb154add1c957c39a846cc08"
  },
  {
   "subject": "California data broker definition",
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.99.80",
   "document": "California Civil Code section 1798.99.80",
   "question": "covers",
   "answer": "broker",
   "answer_text": "registering as a data broker",
   "status": "stated",
   "retrieved_at": "2026-10-22",
   "quote": "means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship",
   "text_sha256": "f234d2a1d574c544e3d0c86a4c15e9cdf5081cdc1ee4848da45911a96d92ced5"
  },
  {
   "subject": "California data broker definition",
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.99.80",
   "document": "California Civil Code section 1798.99.80",
   "question": "before_transfer",
   "answer": "no-step",
   "answer_text": "no specific step stated",
   "status": "stated",
   "retrieved_at": "2026-10-22",
   "quote": "means a business that knowingly collects and sells to third parties the personal information of a consumer",
   "text_sha256": "f234d2a1d574c544e3d0c86a4c15e9cdf5081cdc1ee4848da45911a96d92ced5"
  },
  {
   "subject": "California data broker definition",
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.99.80",
   "document": "California Civil Code section 1798.99.80",
   "question": "jurisdiction",
   "answer": "us-california",
   "answer_text": "California",
   "status": "stated",
   "retrieved_at": "2026-10-22",
   "quote": "means a business that knowingly collects and sells to third parties the personal information of a consumer",
   "text_sha256": "f234d2a1d574c544e3d0c86a4c15e9cdf5081cdc1ee4848da45911a96d92ced5"
  },
  {
   "subject": "California data broker definition",
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.99.80",
   "document": "California Civil Code section 1798.99.80",
   "question": "clause",
   "answer": "stated",
   "answer_text": "means a business that knowingly collects and sells to third parties the personal…",
   "status": "stated",
   "retrieved_at": "2026-10-22",
   "quote": "means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship",
   "text_sha256": "f234d2a1d574c544e3d0c86a4c15e9cdf5081cdc1ee4848da45911a96d92ced5"
  },
  {
   "subject": "California data broker registry",
   "url": "https://cppa.ca.gov/data_broker_registry/",
   "document": "California Data Broker Registry (CalPrivacy)",
   "question": "covers",
   "answer": "broker",
   "answer_text": "registering as a data broker",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "must register with CalPrivacy annually between January 1-31 to report on its activities from the previous calendar year",
   "text_sha256": "3486c40246f0dd913aa017e57466c638a7284f90be21cf6fa63b32ee8ccc1098"
  },
  {
   "subject": "California data broker registry",
   "url": "https://cppa.ca.gov/data_broker_registry/",
   "document": "California Data Broker Registry (CalPrivacy)",
   "question": "before_transfer",
   "answer": "no-step",
   "answer_text": "no specific step stated",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "must register with CalPrivacy annually between January 1-31",
   "text_sha256": "3486c40246f0dd913aa017e57466c638a7284f90be21cf6fa63b32ee8ccc1098"
  },
  {
   "subject": "California data broker registry",
   "url": "https://cppa.ca.gov/data_broker_registry/",
   "document": "California Data Broker Registry (CalPrivacy)",
   "question": "jurisdiction",
   "answer": "us-california",
   "answer_text": "California",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "must register with CalPrivacy annually between January 1-31",
   "text_sha256": "3486c40246f0dd913aa017e57466c638a7284f90be21cf6fa63b32ee8ccc1098"
  },
  {
   "subject": "California data broker registry",
   "url": "https://cppa.ca.gov/data_broker_registry/",
   "document": "California Data Broker Registry (CalPrivacy)",
   "question": "clause",
   "answer": "stated",
   "answer_text": "Any business that meets the definition of \"data broker\" must register with CalPrivacy…",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "Any business that meets the definition of \"data broker\" must register with CalPrivacy annually between January 1-31",
   "text_sha256": "3486c40246f0dd913aa017e57466c638a7284f90be21cf6fa63b32ee8ccc1098"
  },
  {
   "subject": "CAN-SPAM",
   "url": "https://www.law.cornell.edu/uscode/text/15/7704",
   "document": "15 U.S. Code section 7704",
   "question": "covers",
   "answer": "marketing",
   "answer_text": "marketing to the people in a list",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "to sell, lease, exchange, or otherwise transfer or release the electronic mail address of the recipient",
   "text_sha256": "d42f1b215c629c8647ef7b2dbf4e7ce196a3935ca9fc6829e65c2b4635b5e28b"
  },
  {
   "subject": "CAN-SPAM",
   "url": "https://www.law.cornell.edu/uscode/text/15/7704",
   "document": "15 U.S. Code section 7704",
   "question": "before_transfer",
   "answer": "no-step",
   "answer_text": "no specific step stated",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "to sell, lease, exchange, or otherwise transfer or release the electronic mail address of the recipient",
   "text_sha256": "d42f1b215c629c8647ef7b2dbf4e7ce196a3935ca9fc6829e65c2b4635b5e28b"
  },
  {
   "subject": "CAN-SPAM",
   "url": "https://www.law.cornell.edu/uscode/text/15/7704",
   "document": "15 U.S. Code section 7704",
   "question": "jurisdiction",
   "answer": "us-federal",
   "answer_text": "US federal law",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "to sell, lease, exchange, or otherwise transfer or release the electronic mail address of the recipient",
   "text_sha256": "d42f1b215c629c8647ef7b2dbf4e7ce196a3935ca9fc6829e65c2b4635b5e28b"
  },
  {
   "subject": "CAN-SPAM",
   "url": "https://www.law.cornell.edu/uscode/text/15/7704",
   "document": "15 U.S. Code section 7704",
   "question": "clause",
   "answer": "stated",
   "answer_text": "for the sender, or any other person who knows that the recipient has made such a request…",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "for the sender, or any other person who knows that the recipient has made such a request, to sell, lease, exchange, or otherwise transfer or release the electronic mail address of the recipient",
   "text_sha256": "d42f1b215c629c8647ef7b2dbf4e7ce196a3935ca9fc6829e65c2b4635b5e28b"
  },
  {
   "subject": "CCPA definition of sale",
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140",
   "document": "California Civil Code section 1798.140",
   "question": "covers",
   "answer": "sale",
   "answer_text": "a sale of personal information and its opt-out",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "a consumer’s personal information by the business to a third party for monetary or othe",
   "text_sha256": "e3c6e568a063521dc4d2277af4c0e193823b014d89f6df49ee26845afb13a82b"
  },
  {
   "subject": "CCPA definition of sale",
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140",
   "document": "California Civil Code section 1798.140",
   "question": "before_transfer",
   "answer": "no-step",
   "answer_text": "no specific step stated",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction",
   "text_sha256": "e3c6e568a063521dc4d2277af4c0e193823b014d89f6df49ee26845afb13a82b"
  },
  {
   "subject": "CCPA definition of sale",
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140",
   "document": "California Civil Code section 1798.140",
   "question": "jurisdiction",
   "answer": "us-california",
   "answer_text": "California",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy",
   "text_sha256": "e3c6e568a063521dc4d2277af4c0e193823b014d89f6df49ee26845afb13a82b"
  },
  {
   "subject": "CCPA definition of sale",
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140",
   "document": "California Civil Code section 1798.140",
   "question": "clause",
   "answer": "stated",
   "answer_text": "The business transfers to a third party the personal information of a consumer as an…",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business",
   "text_sha256": "e3c6e568a063521dc4d2277af4c0e193823b014d89f6df49ee26845afb13a82b"
  },
  {
   "subject": "CCPA right to opt out",
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.120",
   "document": "California Civil Code section 1798.120",
   "question": "covers",
   "answer": "sale",
   "answer_text": "a sale of personal information and its opt-out",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "A consumer shall have the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell",
   "text_sha256": "5abb921a8cb0f58568061ffba0573718b226c5e64dce22ba67be5836462cea56"
  },
  {
   "subject": "CCPA right to opt out",
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.120",
   "document": "California Civil Code section 1798.120",
   "question": "before_transfer",
   "answer": "notice",
   "answer_text": "notice to the person",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "This right may be referred to as the right to opt out of sale or sharing",
   "text_sha256": "5abb921a8cb0f58568061ffba0573718b226c5e64dce22ba67be5836462cea56"
  },
  {
   "subject": "CCPA right to opt out",
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.120",
   "document": "California Civil Code section 1798.120",
   "question": "jurisdiction",
   "answer": "us-california",
   "answer_text": "California",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "This right may be referred to as the right to opt out of sale or sharing",
   "text_sha256": "5abb921a8cb0f58568061ffba0573718b226c5e64dce22ba67be5836462cea56"
  },
  {
   "subject": "CCPA right to opt out",
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.120",
   "document": "California Civil Code section 1798.120",
   "question": "clause",
   "answer": "stated",
   "answer_text": "A business to which another business transfers the personal information of a consumer as…",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "A business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction",
   "text_sha256": "5abb921a8cb0f58568061ffba0573718b226c5e64dce22ba67be5836462cea56"
  },
  {
   "subject": "Data Protection Act 2018 s 170",
   "url": "https://www.legislation.gov.uk/ukpga/2018/12/section/170",
   "document": "Data Protection Act 2018, section 170",
   "question": "covers",
   "answer": "offence",
   "answer_text": "a criminal offence for selling personal data",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "It is an offence for a person to sell personal data if the person obtained the data in circumstances in which an offence under subsection (1) was committed",
   "text_sha256": "45651c453d0912ade536a172dcf6802da437a3edee01857b9c38f0f9ca9a60ce"
  },
  {
   "subject": "Data Protection Act 2018 s 170",
   "url": "https://www.legislation.gov.uk/ukpga/2018/12/section/170",
   "document": "Data Protection Act 2018, section 170",
   "question": "before_transfer",
   "answer": "consent",
   "answer_text": "the person's consent",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "to obtain or disclose personal data without the consent of the controller",
   "text_sha256": "45651c453d0912ade536a172dcf6802da437a3edee01857b9c38f0f9ca9a60ce"
  },
  {
   "subject": "Data Protection Act 2018 s 170",
   "url": "https://www.legislation.gov.uk/ukpga/2018/12/section/170",
   "document": "Data Protection Act 2018, section 170",
   "question": "jurisdiction",
   "answer": "gb",
   "answer_text": "the UK",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "It is an offence for a person knowingly or recklessly",
   "text_sha256": "45651c453d0912ade536a172dcf6802da437a3edee01857b9c38f0f9ca9a60ce"
  },
  {
   "subject": "Data Protection Act 2018 s 170",
   "url": "https://www.legislation.gov.uk/ukpga/2018/12/section/170",
   "document": "Data Protection Act 2018, section 170",
   "question": "clause",
   "answer": "stated",
   "answer_text": "It is an offence for a person to sell personal data if the person obtained the data in…",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "It is an offence for a person to sell personal data if the person obtained the data in circumstances in which an offence under subsection (1) was committed",
   "text_sha256": "45651c453d0912ade536a172dcf6802da437a3edee01857b9c38f0f9ca9a60ce"
  },
  {
   "subject": "FTC Act section 5",
   "url": "https://www.law.cornell.edu/uscode/text/15/45",
   "document": "15 U.S. Code section 45",
   "question": "covers",
   "answer": "deception",
   "answer_text": "breaking a privacy promise",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful",
   "text_sha256": "ecf7c9aaa7d50202b4bae0873c790c9b81736e1b81bdd190087eecdf9239674d"
  },
  {
   "subject": "FTC Act section 5",
   "url": "https://www.law.cornell.edu/uscode/text/15/45",
   "document": "15 U.S. Code section 45",
   "question": "before_transfer",
   "answer": "no-step",
   "answer_text": "no specific step stated",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful",
   "text_sha256": "ecf7c9aaa7d50202b4bae0873c790c9b81736e1b81bdd190087eecdf9239674d"
  },
  {
   "subject": "FTC Act section 5",
   "url": "https://www.law.cornell.edu/uscode/text/15/45",
   "document": "15 U.S. Code section 45",
   "question": "jurisdiction",
   "answer": "us-federal",
   "answer_text": "US federal law",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful",
   "text_sha256": "ecf7c9aaa7d50202b4bae0873c790c9b81736e1b81bdd190087eecdf9239674d"
  },
  {
   "subject": "FTC Act section 5",
   "url": "https://www.law.cornell.edu/uscode/text/15/45",
   "document": "15 U.S. Code section 45",
   "question": "clause",
   "answer": "stated",
   "answer_text": "Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or…",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful",
   "text_sha256": "ecf7c9aaa7d50202b4bae0873c790c9b81736e1b81bdd190087eecdf9239674d"
  },
  {
   "subject": "ICO data sharing code on databases and lists",
   "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/",
   "document": "ICO code of practice page",
   "question": "covers",
   "answer": "sale",
   "answer_text": "a sale of personal information and its opt-out",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "The transfer of databases or lists of individuals is a form of data sharing, whether for money or other consideration, and whether for profit or not.",
   "text_sha256": "45491c28b98ddd7acdad6a36815ee82783f486edff845354d2a3a590a138bf0f"
  },
  {
   "subject": "ICO data sharing code on databases and lists",
   "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/",
   "document": "ICO code of practice page",
   "question": "before_transfer",
   "answer": "notice",
   "answer_text": "notice to the person",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "You must tell data subjects who you are sharing their data with, and for what purposes.",
   "text_sha256": "45491c28b98ddd7acdad6a36815ee82783f486edff845354d2a3a590a138bf0f"
  },
  {
   "subject": "ICO data sharing code on databases and lists",
   "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/",
   "document": "ICO code of practice page",
   "question": "jurisdiction",
   "answer": "gb",
   "answer_text": "the UK",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "check what information was given to individuals in accordance with Article 14 of the UK GDPR",
   "text_sha256": "45491c28b98ddd7acdad6a36815ee82783f486edff845354d2a3a590a138bf0f"
  },
  {
   "subject": "ICO data sharing code on databases and lists",
   "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/",
   "document": "ICO code of practice page",
   "question": "clause",
   "answer": "stated",
   "answer_text": "You are responsible for compliance with the law for the data you receive, and you have to…",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "You are responsible for compliance with the law for the data you receive, and you have to respond to any complaints about it.",
   "text_sha256": "45491c28b98ddd7acdad6a36815ee82783f486edff845354d2a3a590a138bf0f"
  },
  {
   "subject": "ICO data sharing code on mergers and acquisitions",
   "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/",
   "document": "ICO code of practice page",
   "question": "covers",
   "answer": "sale",
   "answer_text": "a sale of personal information and its opt-out",
   "status": "stated",
   "retrieved_at": "2026-10-27",
   "quote": "on insolvency, data might be sold as an asset to a different legal personality",
   "text_sha256": "67a3c3febd20283f7ac3164789c886a6edb6c8a205cf23205c85f527d32f8b27"
  },
  {
   "subject": "ICO data sharing code on mergers and acquisitions",
   "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/",
   "document": "ICO code of practice page",
   "question": "before_transfer",
   "answer": "notice",
   "answer_text": "notice to the person",
   "status": "stated",
   "retrieved_at": "2026-10-27",
   "quote": "consider when and how you will inform data subjects about what is happening",
   "text_sha256": "67a3c3febd20283f7ac3164789c886a6edb6c8a205cf23205c85f527d32f8b27"
  },
  {
   "subject": "ICO data sharing code on mergers and acquisitions",
   "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/",
   "document": "ICO code of practice page",
   "question": "jurisdiction",
   "answer": "gb",
   "answer_text": "the UK",
   "status": "stated",
   "retrieved_at": "2026-10-27",
   "quote": "Under the UK GDPR you are required to keep individual data subjects informed about certain changes relating to the processing of their data, and they may have a right to object.",
   "text_sha256": "67a3c3febd20283f7ac3164789c886a6edb6c8a205cf23205c85f527d32f8b27"
  },
  {
   "subject": "ICO data sharing code on mergers and acquisitions",
   "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/",
   "document": "ICO code of practice page",
   "question": "clause",
   "answer": "stated",
   "answer_text": "If a merger or acquisition or other change in organisational structure means that you…",
   "status": "stated",
   "retrieved_at": "2026-10-27",
   "quote": "If a merger or acquisition or other change in organisational structure means that you have to transfer data to a different or additional controller, you must consider data sharing as part of the due diligence you carry out when taking on the organisation and its obligations.",
   "text_sha256": "67a3c3febd20283f7ac3164789c886a6edb6c8a205cf23205c85f527d32f8b27"
  },
  {
   "subject": "ICO direct marketing guidance",
   "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/",
   "document": "ICO: direct marketing guidance",
   "question": "covers",
   "answer": "marketing",
   "answer_text": "marketing to the people in a list",
   "status": "stated",
   "retrieved_at": "2026-10-24",
   "quote": "People have an absolute right to object to or opt out of direct marketing at any time",
   "text_sha256": "07d525f1741d7e3613b6adfcf821e8706b54f29d95ec5cbc83acd10b4cc443ba"
  },
  {
   "subject": "ICO direct marketing guidance",
   "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/",
   "document": "ICO: direct marketing guidance",
   "question": "before_transfer",
   "answer": "no-step",
   "answer_text": "no specific step stated",
   "status": "stated",
   "retrieved_at": "2026-10-24",
   "quote": "People have an absolute right to object to or opt out of direct marketing at any time",
   "text_sha256": "07d525f1741d7e3613b6adfcf821e8706b54f29d95ec5cbc83acd10b4cc443ba"
  },
  {
   "subject": "ICO direct marketing guidance",
   "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/",
   "document": "ICO: direct marketing guidance",
   "question": "jurisdiction",
   "answer": "gb",
   "answer_text": "the UK",
   "status": "stated",
   "retrieved_at": "2026-10-24",
   "quote": "People have an absolute right to object to or opt out of direct marketing at any time",
   "text_sha256": "07d525f1741d7e3613b6adfcf821e8706b54f29d95ec5cbc83acd10b4cc443ba"
  },
  {
   "subject": "ICO direct marketing guidance",
   "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/",
   "document": "ICO: direct marketing guidance",
   "question": "clause",
   "answer": "stated",
   "answer_text": "People have an absolute right to object to or opt out of direct marketing at any time",
   "status": "stated",
   "retrieved_at": "2026-10-24",
   "quote": "People have an absolute right to object to or opt out of direct marketing at any time",
   "text_sha256": "07d525f1741d7e3613b6adfcf821e8706b54f29d95ec5cbc83acd10b4cc443ba"
  },
  {
   "subject": "ICO guide to PECR: email marketing",
   "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/",
   "document": "ICO: guide to PECR, electronic mail marketing",
   "question": "covers",
   "answer": "marketing",
   "answer_text": "marketing to the people in a list",
   "status": "stated",
   "retrieved_at": "2026-10-23",
   "quote": "You must not send marketing emails or texts to individuals without specific consent",
   "text_sha256": "195e831e41565f3e319a3c2c8afa7ca4e7b34d969adcf25a1f9ab56590538cb8"
  },
  {
   "subject": "ICO guide to PECR: email marketing",
   "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/",
   "document": "ICO: guide to PECR, electronic mail marketing",
   "question": "before_transfer",
   "answer": "consent",
   "answer_text": "the person's consent",
   "status": "stated",
   "retrieved_at": "2026-10-23",
   "quote": "You must not send marketing emails or texts to individuals without specific consent",
   "text_sha256": "195e831e41565f3e319a3c2c8afa7ca4e7b34d969adcf25a1f9ab56590538cb8"
  },
  {
   "subject": "ICO guide to PECR: email marketing",
   "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/",
   "document": "ICO: guide to PECR, electronic mail marketing",
   "question": "jurisdiction",
   "answer": "gb",
   "answer_text": "the UK",
   "status": "stated",
   "retrieved_at": "2026-10-23",
   "quote": "The rules on electronic mail marketing are in regulation 22",
   "text_sha256": "195e831e41565f3e319a3c2c8afa7ca4e7b34d969adcf25a1f9ab56590538cb8"
  },
  {
   "subject": "ICO guide to PECR: email marketing",
   "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/",
   "document": "ICO: guide to PECR, electronic mail marketing",
   "question": "clause",
   "answer": "stated",
   "answer_text": "There is a limited exception for your own previous customers, often called the ‘soft…",
   "status": "stated",
   "retrieved_at": "2026-10-23",
   "quote": "There is a limited exception for your own previous customers, often called the ‘soft opt-in’",
   "text_sha256": "195e831e41565f3e319a3c2c8afa7ca4e7b34d969adcf25a1f9ab56590538cb8"
  },
  {
   "subject": "ICO guide to PECR: using marketing lists",
   "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/using-marketing-lists/",
   "document": "ICO guidance page",
   "question": "covers",
   "answer": "sale",
   "answer_text": "a sale of personal information and its opt-out",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "As a general rule, you can only sell your marketing list if you have the consent of the listed individuals to do so.",
   "text_sha256": "b391702a2866ca7b96516a0224c97a0097eeb3350d26b468ba836b4e3de03535"
  },
  {
   "subject": "ICO guide to PECR: using marketing lists",
   "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/using-marketing-lists/",
   "document": "ICO guidance page",
   "question": "before_transfer",
   "answer": "consent",
   "answer_text": "the person's consent",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "Ask for specific consent also if you want to pass details to other companies, and make sure you name or describe those companies.",
   "text_sha256": "b391702a2866ca7b96516a0224c97a0097eeb3350d26b468ba836b4e3de03535"
  },
  {
   "subject": "ICO guide to PECR: using marketing lists",
   "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/using-marketing-lists/",
   "document": "ICO guidance page",
   "question": "jurisdiction",
   "answer": "gb",
   "answer_text": "the UK",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "You should screen call lists against the TPS",
   "text_sha256": "b391702a2866ca7b96516a0224c97a0097eeb3350d26b468ba836b4e3de03535"
  },
  {
   "subject": "ICO guide to PECR: using marketing lists",
   "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/using-marketing-lists/",
   "document": "ICO guidance page",
   "question": "clause",
   "answer": "stated",
   "answer_text": "As a general rule, you can only sell your marketing list if you have the consent of the…",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "As a general rule, you can only sell your marketing list if you have the consent of the listed individuals to do so.",
   "text_sha256": "b391702a2866ca7b96516a0224c97a0097eeb3350d26b468ba836b4e3de03535"
  },
  {
   "subject": "PECR 2003 reg 22",
   "url": "https://www.legislation.gov.uk/uksi/2003/2426/regulation/22",
   "document": "Privacy and Electronic Communications Regulations 2003, regulation 22",
   "question": "covers",
   "answer": "marketing",
   "answer_text": "marketing to the people in a list",
   "status": "stated",
   "retrieved_at": "2026-10-23",
   "quote": "a person shall neither transmit, nor instigate the transmission of, unsolicited communications for the purposes of direct marketing by means of electronic mail",
   "text_sha256": "476d91e4c74d9c3cc0549f9ec74f8d75f574994a44ed31bd29b8fc7f6e307bd5"
  },
  {
   "subject": "PECR 2003 reg 22",
   "url": "https://www.legislation.gov.uk/uksi/2003/2426/regulation/22",
   "document": "Privacy and Electronic Communications Regulations 2003, regulation 22",
   "question": "before_transfer",
   "answer": "consent",
   "answer_text": "the person's consent",
   "status": "stated",
   "retrieved_at": "2026-10-23",
   "quote": "unless the recipient of the electronic mail has previously notified the sender that he consents",
   "text_sha256": "476d91e4c74d9c3cc0549f9ec74f8d75f574994a44ed31bd29b8fc7f6e307bd5"
  },
  {
   "subject": "PECR 2003 reg 22",
   "url": "https://www.legislation.gov.uk/uksi/2003/2426/regulation/22",
   "document": "Privacy and Electronic Communications Regulations 2003, regulation 22",
   "question": "jurisdiction",
   "answer": "gb",
   "answer_text": "the UK",
   "status": "stated",
   "retrieved_at": "2026-10-23",
   "quote": "a person shall neither transmit, nor instigate the transmission of, unsolicited communications",
   "text_sha256": "476d91e4c74d9c3cc0549f9ec74f8d75f574994a44ed31bd29b8fc7f6e307bd5"
  },
  {
   "subject": "PECR 2003 reg 22",
   "url": "https://www.legislation.gov.uk/uksi/2003/2426/regulation/22",
   "document": "Privacy and Electronic Communications Regulations 2003, regulation 22",
   "question": "clause",
   "answer": "stated",
   "answer_text": "a person shall neither transmit, nor instigate the transmission of, unsolicited…",
   "status": "stated",
   "retrieved_at": "2026-10-23",
   "quote": "a person shall neither transmit, nor instigate the transmission of, unsolicited communications for the purposes of direct marketing by means of electronic mail",
   "text_sha256": "476d91e4c74d9c3cc0549f9ec74f8d75f574994a44ed31bd29b8fc7f6e307bd5"
  },
  {
   "subject": "UK GDPR art 14",
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/14",
   "document": "UK GDPR, Article 14",
   "question": "covers",
   "answer": "transparency",
   "answer_text": "telling people who holds their data",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information",
   "text_sha256": "e2f02d432344356f4f1f55703ee05b567ed31dba311de5645fe0b94f9703de7c"
  },
  {
   "subject": "UK GDPR art 14",
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/14",
   "document": "UK GDPR, Article 14",
   "question": "before_transfer",
   "answer": "notice",
   "answer_text": "notice to the person",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "the controller shall provide the data subject with the following information",
   "text_sha256": "e2f02d432344356f4f1f55703ee05b567ed31dba311de5645fe0b94f9703de7c"
  },
  {
   "subject": "UK GDPR art 14",
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/14",
   "document": "UK GDPR, Article 14",
   "question": "jurisdiction",
   "answer": "gb",
   "answer_text": "the UK",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "the controller shall provide the data subject with the following information",
   "text_sha256": "e2f02d432344356f4f1f55703ee05b567ed31dba311de5645fe0b94f9703de7c"
  },
  {
   "subject": "UK GDPR art 14",
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/14",
   "document": "UK GDPR, Article 14",
   "question": "clause",
   "answer": "stated",
   "answer_text": "Where personal data have not been obtained from the data subject, the controller shall…",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information",
   "text_sha256": "e2f02d432344356f4f1f55703ee05b567ed31dba311de5645fe0b94f9703de7c"
  },
  {
   "subject": "UK GDPR art 5",
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/5",
   "document": "UK GDPR, Article 5",
   "question": "covers",
   "answer": "purpose",
   "answer_text": "reusing personal data for a new purpose",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "for specified, explicit and legitimate purposes and not further process",
   "text_sha256": "25a9d8f8009872e0433d4cd45121ffc8d2d4756f39c0dd3d6e332be90376bd04"
  },
  {
   "subject": "UK GDPR art 5",
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/5",
   "document": "UK GDPR, Article 5",
   "question": "before_transfer",
   "answer": "lawful-basis",
   "answer_text": "a lawful basis",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "processed lawfully, fairly and in a transparent manner in relation to the data subject",
   "text_sha256": "25a9d8f8009872e0433d4cd45121ffc8d2d4756f39c0dd3d6e332be90376bd04"
  },
  {
   "subject": "UK GDPR art 5",
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/5",
   "document": "UK GDPR, Article 5",
   "question": "jurisdiction",
   "answer": "gb",
   "answer_text": "the UK",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "processed lawfully, fairly and in a transparent manner in relation to the data subject",
   "text_sha256": "25a9d8f8009872e0433d4cd45121ffc8d2d4756f39c0dd3d6e332be90376bd04"
  },
  {
   "subject": "UK GDPR art 5",
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/5",
   "document": "UK GDPR, Article 5",
   "question": "clause",
   "answer": "stated",
   "answer_text": "processed lawfully, fairly and in a transparent manner in relation to the data subject",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "processed lawfully, fairly and in a transparent manner in relation to the data subject",
   "text_sha256": "25a9d8f8009872e0433d4cd45121ffc8d2d4756f39c0dd3d6e332be90376bd04"
  },
  {
   "subject": "UK GDPR art 6",
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/6",
   "document": "UK GDPR, Article 6",
   "question": "covers",
   "answer": "lawful-basis",
   "answer_text": "a lawful basis for using or disclosing personal data",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "Processing shall be lawful only if and to the extent that at least one of the following applies",
   "text_sha256": "7a5a6f24fb31d9243763b59989fd13d94b3c2be38ee902535f7781e7fa9a121d"
  },
  {
   "subject": "UK GDPR art 6",
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/6",
   "document": "UK GDPR, Article 6",
   "question": "before_transfer",
   "answer": "lawful-basis",
   "answer_text": "a lawful basis",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "Processing shall be lawful only if and to the extent that at least one of the following applies",
   "text_sha256": "7a5a6f24fb31d9243763b59989fd13d94b3c2be38ee902535f7781e7fa9a121d"
  },
  {
   "subject": "UK GDPR art 6",
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/6",
   "document": "UK GDPR, Article 6",
   "question": "jurisdiction",
   "answer": "gb",
   "answer_text": "the UK",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "Processing shall be lawful only if and to the extent that at least one of the following applies",
   "text_sha256": "7a5a6f24fb31d9243763b59989fd13d94b3c2be38ee902535f7781e7fa9a121d"
  },
  {
   "subject": "UK GDPR art 6",
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/6",
   "document": "UK GDPR, Article 6",
   "question": "clause",
   "answer": "stated",
   "answer_text": "the data subject has given consent to the processing of his or her personal data for one…",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "the data subject has given consent to the processing of his or her personal data for one or more specific purposes",
   "text_sha256": "7a5a6f24fb31d9243763b59989fd13d94b3c2be38ee902535f7781e7fa9a121d"
  }
 ],
 "sources": [
  {
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/5",
   "label": "UK GDPR art 5, principles",
   "license": "from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/6",
   "label": "UK GDPR art 6, lawfulness of processing",
   "license": "from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/14",
   "label": "UK GDPR art 14, information where data not obtained from the subject",
   "license": "from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.legislation.gov.uk/ukpga/2018/12/section/170",
   "label": "Data Protection Act 2018 s 170, unlawful obtaining of personal data",
   "license": "from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.legislation.gov.uk/uksi/2003/2426/regulation/22",
   "label": "PECR 2003 reg 22, unsolicited email marketing",
   "license": "from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/",
   "label": "ICO direct marketing guidance",
   "license": "from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/",
   "label": "ICO guide to PECR: electronic mail marketing",
   "license": "from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/legitimate-interests/",
   "label": "ICO legitimate interests guidance",
   "license": "from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment",
   "class": "primary-government",
   "status": "not-terms",
   "why": "the contents page of the ICO's legitimate interests guidance, a list of questions with no rule stated; the lawful basis is read from UK GDPR article 6"
  },
  {
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140",
   "label": "California Civil Code 1798.140, CCPA definitions",
   "license": "from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.120",
   "label": "California Civil Code 1798.120, right to opt out of sale",
   "license": "from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.99.80",
   "label": "California Civil Code 1798.99.80, data broker definitions",
   "license": "from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://cppa.ca.gov/data_broker_registry/",
   "label": "California Privacy Protection Agency data broker registry",
   "license": "from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.law.cornell.edu/uscode/text/15/45",
   "label": "15 U.S.C. 45, FTC Act section 5",
   "license": "from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.law.cornell.edu/uscode/text/15/7704",
   "label": "15 U.S.C. 7704, CAN-SPAM requirements",
   "license": "from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.law.cornell.edu/uscode/text/11/363",
   "label": "11 U.S.C. 363, use, sale or lease of property",
   "license": "from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.law.cornell.edu/uscode/text/11/332",
   "label": "11 U.S.C. 332, consumer privacy ombudsman",
   "license": "from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/",
   "label": "ICO: due diligence when sharing data following mergers and acquisitions",
   "license": "from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/",
   "label": "ICO: sharing personal data in databases and lists",
   "license": "from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/using-marketing-lists/",
   "label": "ICO guide to PECR: using marketing lists",
   "license": "from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  }
 ],
 "methodology": "Each rule's own UK and US statutes, regulations and regulators' guidance were read through estate-fetch and stored whole (sha256 on every row). For every statute or guidance page, four questions were answered from its own words: what the rule governs, what it asks before the data moves, where it applies, the rule, in its words. Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the statute or guidance page read does not address the question. A rule with several statute and guidance pages reads 'varies' where they disagree. 18 rules, 18 statute and guidance pages.",
 "embed": "<figure style=\"margin:0;padding:16px;border:1px solid #d0d0d0;background:#ffffff\"><blockquote style=\"margin:0 0 8px;background:#ffffff\">18 UK and US rules on the people in a CRM when the record is licensed or sold, read 28 October 2026.</blockquote><figcaption style=\"background:#ffffff\"><a href=\"https://sellcrmdatatoai.com/datasets/crm-data-law/\" style=\"background:#ffffff\">The law on the people in a CRM when the record changes hands, sellcrmdatatoai.com</a></figcaption></figure>"
}