How do i sell my customer list (18 figures)
18 UK and US rules on the people in a CRM when the record is licensed or sold, read 28 October 2026.
What the rule governs
What it asks before the data moves
Where it applies
The rule, in its words
All the answers, rule by rule
A rule per row. Every answer opens onto the line it comes from, quoted exactly, with the statute or guidance page it sits in and the day of the read. "Not stated" marks a question the statute or guidance page leaves unanswered.
| Rule | What the rule governs | What it asks before the data moves | Where it applies | The rule, in its words |
|---|---|---|---|---|
| 11 U.S.C. 332 | selling personal information in bankruptcy | a court's approval or an ombudsman | US federal law | If a hearing is required under section 363(b)(1)(B), the court shall order the United… |
| 11 U.S.C. 363(b)(1) | selling personal information in bankruptcy | a court's approval or an ombudsman | US federal law | then the trustee may not sell or lease personally identifiable information to any person… |
| California data broker definition | registering as a data broker | no specific step stated | California | means a business that knowingly collects and sells to third parties the personal… |
| California data broker registry | registering as a data broker | no specific step stated | California | Any business that meets the definition of "data broker" must register with CalPrivacy… |
| CAN-SPAM | marketing to the people in a list | no specific step stated | US federal law | for the sender, or any other person who knows that the recipient has made such a request… |
| CCPA definition of sale | a sale of personal information and its opt-out | no specific step stated | California | The business transfers to a third party the personal information of a consumer as an… |
| CCPA right to opt out | a sale of personal information and its opt-out | notice to the person | California | A business to which another business transfers the personal information of a consumer as… |
| Data Protection Act 2018 s 170 | a criminal offence for selling personal data | the person's consent | the UK | It is an offence for a person to sell personal data if the person obtained the data in… |
| FTC Act section 5 | breaking a privacy promise | no specific step stated | US federal law | Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or… |
| ICO data sharing code on databases and lists | a sale of personal information and its opt-out | notice to the person | the UK | You are responsible for compliance with the law for the data you receive, and you have to… |
| ICO data sharing code on mergers and acquisitions | a sale of personal information and its opt-out | notice to the person | the UK | If a merger or acquisition or other change in organisational structure means that you… |
| ICO direct marketing guidance | marketing to the people in a list | no specific step stated | the UK | People have an absolute right to object to or opt out of direct marketing at any time |
| ICO guide to PECR: email marketing | marketing to the people in a list | the person's consent | the UK | There is a limited exception for your own previous customers, often called the ‘soft… |
| ICO guide to PECR: using marketing lists | a sale of personal information and its opt-out | the person's consent | the UK | As a general rule, you can only sell your marketing list if you have the consent of the… |
| PECR 2003 reg 22 | marketing to the people in a list | the person's consent | the UK | a person shall neither transmit, nor instigate the transmission of, unsolicited… |
| UK GDPR art 14 | telling people who holds their data | notice to the person | the UK | Where personal data have not been obtained from the data subject, the controller shall… |
| UK GDPR art 5 | reusing personal data for a new purpose | a lawful basis | the UK | processed lawfully, fairly and in a transparent manner in relation to the data subject |
| UK GDPR art 6 | a lawful basis for using or disclosing personal data | a lawful basis | the UK | the data subject has given consent to the processing of his or her personal data for one… |
Quoted wording for all 72 answers
- 11 U.S.C. 332, 11 U.S. Code section 332, read 2026-10-08, What the rule governs:
If a hearing is required under section 363(b)(1)(B), the court shall order the United States trustee to appoint
- 11 U.S.C. 332, 11 U.S. Code section 332, read 2026-10-08, What it asks before the data moves:
the court shall order the United States trustee to appoint
- 11 U.S.C. 332, 11 U.S. Code section 332, read 2026-10-08, Where it applies:
the court shall order the United States trustee to appoint
- 11 U.S.C. 332, 11 U.S. Code section 332, read 2026-10-08, The rule, in its words:
If a hearing is required under section 363(b)(1)(B), the court shall order the United States trustee to appoint
- 11 U.S.C. 363(b)(1), 11 U.S. Code section 363, read 2026-10-08, What the rule governs:
then the trustee may not sell or lease personally identifiable information to any person unless
- 11 U.S.C. 363(b)(1), 11 U.S. Code section 363, read 2026-10-08, What it asks before the data moves:
after appointment of a consumer privacy ombudsman in accordance with section 332, and after notice and a hearing, the court approves such sale
- 11 U.S.C. 363(b)(1), 11 U.S. Code section 363, read 2026-10-08, Where it applies:
then the trustee may not sell or lease personally identifiable information to any person unless
- 11 U.S.C. 363(b)(1), 11 U.S. Code section 363, read 2026-10-08, The rule, in its words:
then the trustee may not sell or lease personally identifiable information to any person unless
- California data broker definition, California Civil Code section 1798.99.80, read 2026-10-22, What the rule governs:
means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship
- California data broker definition, California Civil Code section 1798.99.80, read 2026-10-22, What it asks before the data moves:
means a business that knowingly collects and sells to third parties the personal information of a consumer
- California data broker definition, California Civil Code section 1798.99.80, read 2026-10-22, Where it applies:
means a business that knowingly collects and sells to third parties the personal information of a consumer
- California data broker definition, California Civil Code section 1798.99.80, read 2026-10-22, The rule, in its words:
means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship
- California data broker registry, California Data Broker Registry (CalPrivacy), read 2026-10-08, What the rule governs:
must register with CalPrivacy annually between January 1-31 to report on its activities from the previous calendar year
- California data broker registry, California Data Broker Registry (CalPrivacy), read 2026-10-08, What it asks before the data moves:
must register with CalPrivacy annually between January 1-31
- California data broker registry, California Data Broker Registry (CalPrivacy), read 2026-10-08, Where it applies:
must register with CalPrivacy annually between January 1-31
- California data broker registry, California Data Broker Registry (CalPrivacy), read 2026-10-08, The rule, in its words:
Any business that meets the definition of "data broker" must register with CalPrivacy annually between January 1-31
- CAN-SPAM, 15 U.S. Code section 7704, read 2026-10-28, What the rule governs:
to sell, lease, exchange, or otherwise transfer or release the electronic mail address of the recipient
- CAN-SPAM, 15 U.S. Code section 7704, read 2026-10-28, What it asks before the data moves:
to sell, lease, exchange, or otherwise transfer or release the electronic mail address of the recipient
- CAN-SPAM, 15 U.S. Code section 7704, read 2026-10-28, Where it applies:
to sell, lease, exchange, or otherwise transfer or release the electronic mail address of the recipient
- CAN-SPAM, 15 U.S. Code section 7704, read 2026-10-28, The rule, in its words:
for the sender, or any other person who knows that the recipient has made such a request, to sell, lease, exchange, or otherwise transfer or release the electronic mail address of the recipient
- CCPA definition of sale, California Civil Code section 1798.140, read 2026-10-08, What the rule governs:
a consumer’s personal information by the business to a third party for monetary or othe
- CCPA definition of sale, California Civil Code section 1798.140, read 2026-10-08, What it asks before the data moves:
The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction
- CCPA definition of sale, California Civil Code section 1798.140, read 2026-10-08, Where it applies:
The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy
- CCPA definition of sale, California Civil Code section 1798.140, read 2026-10-08, The rule, in its words:
The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business
- CCPA right to opt out, California Civil Code section 1798.120, read 2026-10-08, What the rule governs:
A consumer shall have the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell
- CCPA right to opt out, California Civil Code section 1798.120, read 2026-10-08, What it asks before the data moves:
This right may be referred to as the right to opt out of sale or sharing
- CCPA right to opt out, California Civil Code section 1798.120, read 2026-10-08, Where it applies:
This right may be referred to as the right to opt out of sale or sharing
- CCPA right to opt out, California Civil Code section 1798.120, read 2026-10-08, The rule, in its words:
A business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction
- Data Protection Act 2018 s 170, Data Protection Act 2018, section 170, read 2026-10-08, What the rule governs:
It is an offence for a person to sell personal data if the person obtained the data in circumstances in which an offence under subsection (1) was committed
- Data Protection Act 2018 s 170, Data Protection Act 2018, section 170, read 2026-10-08, What it asks before the data moves:
to obtain or disclose personal data without the consent of the controller
- Data Protection Act 2018 s 170, Data Protection Act 2018, section 170, read 2026-10-08, Where it applies:
It is an offence for a person knowingly or recklessly
- Data Protection Act 2018 s 170, Data Protection Act 2018, section 170, read 2026-10-08, The rule, in its words:
It is an offence for a person to sell personal data if the person obtained the data in circumstances in which an offence under subsection (1) was committed
- FTC Act section 5, 15 U.S. Code section 45, read 2026-10-28, What the rule governs:
unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful
- FTC Act section 5, 15 U.S. Code section 45, read 2026-10-28, What it asks before the data moves:
unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful
- FTC Act section 5, 15 U.S. Code section 45, read 2026-10-28, Where it applies:
unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful
- FTC Act section 5, 15 U.S. Code section 45, read 2026-10-28, The rule, in its words:
Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful
- ICO data sharing code on databases and lists, ICO code of practice page, read 2026-10-28, What the rule governs:
The transfer of databases or lists of individuals is a form of data sharing, whether for money or other consideration, and whether for profit or not.
- ICO data sharing code on databases and lists, ICO code of practice page, read 2026-10-28, What it asks before the data moves:
You must tell data subjects who you are sharing their data with, and for what purposes.
- ICO data sharing code on databases and lists, ICO code of practice page, read 2026-10-28, Where it applies:
check what information was given to individuals in accordance with Article 14 of the UK GDPR
- ICO data sharing code on databases and lists, ICO code of practice page, read 2026-10-28, The rule, in its words:
You are responsible for compliance with the law for the data you receive, and you have to respond to any complaints about it.
- ICO data sharing code on mergers and acquisitions, ICO code of practice page, read 2026-10-27, What the rule governs:
on insolvency, data might be sold as an asset to a different legal personality
- ICO data sharing code on mergers and acquisitions, ICO code of practice page, read 2026-10-27, What it asks before the data moves:
consider when and how you will inform data subjects about what is happening
- ICO data sharing code on mergers and acquisitions, ICO code of practice page, read 2026-10-27, Where it applies:
Under the UK GDPR you are required to keep individual data subjects informed about certain changes relating to the processing of their data, and they may have a right to object.
- ICO data sharing code on mergers and acquisitions, ICO code of practice page, read 2026-10-27, The rule, in its words:
If a merger or acquisition or other change in organisational structure means that you have to transfer data to a different or additional controller, you must consider data sharing as part of the due diligence you carry out when taking on the organisation and its obligations.
- ICO direct marketing guidance, ICO: direct marketing guidance, read 2026-10-24, What the rule governs:
People have an absolute right to object to or opt out of direct marketing at any time
- ICO direct marketing guidance, ICO: direct marketing guidance, read 2026-10-24, What it asks before the data moves:
People have an absolute right to object to or opt out of direct marketing at any time
- ICO direct marketing guidance, ICO: direct marketing guidance, read 2026-10-24, Where it applies:
People have an absolute right to object to or opt out of direct marketing at any time
- ICO direct marketing guidance, ICO: direct marketing guidance, read 2026-10-24, The rule, in its words:
People have an absolute right to object to or opt out of direct marketing at any time
- ICO guide to PECR: email marketing, ICO: guide to PECR, electronic mail marketing, read 2026-10-23, What the rule governs:
You must not send marketing emails or texts to individuals without specific consent
- ICO guide to PECR: email marketing, ICO: guide to PECR, electronic mail marketing, read 2026-10-23, What it asks before the data moves:
You must not send marketing emails or texts to individuals without specific consent
- ICO guide to PECR: email marketing, ICO: guide to PECR, electronic mail marketing, read 2026-10-23, Where it applies:
The rules on electronic mail marketing are in regulation 22
- ICO guide to PECR: email marketing, ICO: guide to PECR, electronic mail marketing, read 2026-10-23, The rule, in its words:
There is a limited exception for your own previous customers, often called the ‘soft opt-in’
- ICO guide to PECR: using marketing lists, ICO guidance page, read 2026-10-28, What the rule governs:
As a general rule, you can only sell your marketing list if you have the consent of the listed individuals to do so.
- ICO guide to PECR: using marketing lists, ICO guidance page, read 2026-10-28, What it asks before the data moves:
Ask for specific consent also if you want to pass details to other companies, and make sure you name or describe those companies.
- ICO guide to PECR: using marketing lists, ICO guidance page, read 2026-10-28, Where it applies:
You should screen call lists against the TPS
- ICO guide to PECR: using marketing lists, ICO guidance page, read 2026-10-28, The rule, in its words:
As a general rule, you can only sell your marketing list if you have the consent of the listed individuals to do so.
- PECR 2003 reg 22, Privacy and Electronic Communications Regulations 2003, regulation 22, read 2026-10-23, What the rule governs:
a person shall neither transmit, nor instigate the transmission of, unsolicited communications for the purposes of direct marketing by means of electronic mail
- PECR 2003 reg 22, Privacy and Electronic Communications Regulations 2003, regulation 22, read 2026-10-23, What it asks before the data moves:
unless the recipient of the electronic mail has previously notified the sender that he consents
- PECR 2003 reg 22, Privacy and Electronic Communications Regulations 2003, regulation 22, read 2026-10-23, Where it applies:
a person shall neither transmit, nor instigate the transmission of, unsolicited communications
- PECR 2003 reg 22, Privacy and Electronic Communications Regulations 2003, regulation 22, read 2026-10-23, The rule, in its words:
a person shall neither transmit, nor instigate the transmission of, unsolicited communications for the purposes of direct marketing by means of electronic mail
- UK GDPR art 14, UK GDPR, Article 14, read 2026-10-08, What the rule governs:
Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information
- UK GDPR art 14, UK GDPR, Article 14, read 2026-10-08, What it asks before the data moves:
the controller shall provide the data subject with the following information
- UK GDPR art 14, UK GDPR, Article 14, read 2026-10-08, Where it applies:
the controller shall provide the data subject with the following information
- UK GDPR art 14, UK GDPR, Article 14, read 2026-10-08, The rule, in its words:
Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information
- UK GDPR art 5, UK GDPR, Article 5, read 2026-10-08, What the rule governs:
for specified, explicit and legitimate purposes and not further process
- UK GDPR art 5, UK GDPR, Article 5, read 2026-10-08, What it asks before the data moves:
processed lawfully, fairly and in a transparent manner in relation to the data subject
- UK GDPR art 5, UK GDPR, Article 5, read 2026-10-08, Where it applies:
processed lawfully, fairly and in a transparent manner in relation to the data subject
- UK GDPR art 5, UK GDPR, Article 5, read 2026-10-08, The rule, in its words:
processed lawfully, fairly and in a transparent manner in relation to the data subject
- UK GDPR art 6, UK GDPR, Article 6, read 2026-10-08, What the rule governs:
Processing shall be lawful only if and to the extent that at least one of the following applies
- UK GDPR art 6, UK GDPR, Article 6, read 2026-10-08, What it asks before the data moves:
Processing shall be lawful only if and to the extent that at least one of the following applies
- UK GDPR art 6, UK GDPR, Article 6, read 2026-10-08, Where it applies:
Processing shall be lawful only if and to the extent that at least one of the following applies
- UK GDPR art 6, UK GDPR, Article 6, read 2026-10-08, The rule, in its words:
the data subject has given consent to the processing of his or her personal data for one or more specific purposes
Set aside after reading
1 named document was read but is not the kind of document this board answers from; see why below. It is counted and never answered.
- ICO legitimate interests guidance: the contents page of the ICO's legitimate interests guidance, a list of questions with no rule stated; the lawful basis is read from UK GDPR article 6
How this was built
Each rule's own UK and US statutes, regulations and regulators' guidance were read through estate-fetch and stored whole (sha256 on every row).
For every statute or guidance page, four questions were answered from its own words: what the rule governs, what it asks before the data moves, where it applies, the rule, in its words.
Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the statute or guidance page read does not address the question.
A rule with several statute and guidance pages reads 'varies' where they disagree.
18 rules, 18 statute and guidance pages.
19 sources, with links
- UK GDPR art 5, principles (from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment)
- UK GDPR art 6, lawfulness of processing (from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment)
- UK GDPR art 14, information where data not obtained from the subject (from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment)
- Data Protection Act 2018 s 170, unlawful obtaining of personal data (from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment)
- PECR 2003 reg 22, unsolicited email marketing (from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment)
- ICO direct marketing guidance (from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment)
- ICO guide to PECR: electronic mail marketing (from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment)
- ICO legitimate interests guidance (read, set aside)
- California Civil Code 1798.140, CCPA definitions (from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment)
- California Civil Code 1798.120, right to opt out of sale (from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment)
- California Civil Code 1798.99.80, data broker definitions (from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment)
- California Privacy Protection Agency data broker registry (from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment)
- 15 U.S.C. 45, FTC Act section 5 (from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment)
- 15 U.S.C. 7704, CAN-SPAM requirements (from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment)
- 11 U.S.C. 363, use, sale or lease of property (from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment)
- 11 U.S.C. 332, consumer privacy ombudsman (from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment)
- ICO: due diligence when sharing data following mergers and acquisitions (from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment)
- ICO: sharing personal data in databases and lists (from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment)
- ICO guide to PECR: using marketing lists (from the publisher's own UK and US statutes, regulations and regulators' guidance; reproduced for comment)
Cite it or embed it
18 UK and US rules on the people in a CRM when the record is licensed or sold, read 28 October 2026.
What the rule governs, by rule: a sale of personal information and its opt-out 5 of 18, marketing to the people in a list 4 of 18, selling personal information in bankruptcy 2 of 18, registering as a data broker 2 of 18, breaking a privacy promise 1 of 18, a lawful basis for using or disclosing personal data 1 of 18, a criminal offence for selling personal data 1 of 18, reusing personal data for a new purpose 1 of 18, telling people who holds their data 1 of 18 (18 rules, read 28 October 2026).
What it asks before the data moves, by rule: no specific step stated 6 of 18, the person's consent 4 of 18, notice to the person 4 of 18, a court's approval or an ombudsman 2 of 18, a lawful basis 2 of 18 (18 rules, read 28 October 2026).
Where it applies, by rule: the UK 10 of 18, California 4 of 18, US federal law 4 of 18 (18 rules, read 28 October 2026).
The rule, in its words, by rule: stated 18 of 18 (18 rules, read 28 October 2026).
Citation: "The law on the people in a CRM when the record changes hands", updated 2026-10-28, https://sellcrmdatatoai.com/datasets/crm-data-law/.
Download as CSV (72 answers, worked out 2026-10-28)