# How do i sell my customer list (18 figures)

> 18 UK and US rules on the people in a CRM when the record is licensed or sold, read 28 October 2026.

Sell CRM Data To AI · https://sellcrmdatatoai.com/datasets/crm-data-law/ · computed 2026-10-28

**Rules on the register:** 18 rules (18 statute and guidance pages read; 19 named).

## The answers, question by question

- **What the rule governs:** a sale of personal information and its opt-out 5, marketing to the people in a list 4, selling personal information in bankruptcy 2, registering as a data broker 2, a criminal offence for selling personal data 1, breaking a privacy promise 1, telling people who holds their data 1, reusing personal data for a new purpose 1, a lawful basis for using or disclosing personal data 1
- **What it asks before the data moves:** no specific step stated 6, notice to the person 4, the person's consent 4, a court's approval or an ombudsman 2, a lawful basis 2
- **Where it applies:** the UK 10, US federal law 4, California 4
- **The rule, in its words:** stated 18

## Every rule

| Rule | What the rule governs | What it asks before the data moves | Where it applies | The rule, in its words |
|---|---|---|---|---|
| 11 U.S.C. 332 | selling personal information in bankruptcy | a court's approval or an ombudsman | US federal law | If a hearing is required under section 363(b)(1)(B), the court shall order the United… |
| 11 U.S.C. 363(b)(1) | selling personal information in bankruptcy | a court's approval or an ombudsman | US federal law | then the trustee may not sell or lease personally identifiable information to any person… |
| California data broker definition | registering as a data broker | no specific step stated | California | means a business that knowingly collects and sells to third parties the personal… |
| California data broker registry | registering as a data broker | no specific step stated | California | Any business that meets the definition of "data broker" must register with CalPrivacy… |
| CAN-SPAM | marketing to the people in a list | no specific step stated | US federal law | for the sender, or any other person who knows that the recipient has made such a request… |
| CCPA definition of sale | a sale of personal information and its opt-out | no specific step stated | California | The business transfers to a third party the personal information of a consumer as an… |
| CCPA right to opt out | a sale of personal information and its opt-out | notice to the person | California | A business to which another business transfers the personal information of a consumer as… |
| Data Protection Act 2018 s 170 | a criminal offence for selling personal data | the person's consent | the UK | It is an offence for a person to sell personal data if the person obtained the data in… |
| FTC Act section 5 | breaking a privacy promise | no specific step stated | US federal law | Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or… |
| ICO data sharing code on databases and lists | a sale of personal information and its opt-out | notice to the person | the UK | You are responsible for compliance with the law for the data you receive, and you have to… |
| ICO data sharing code on mergers and acquisitions | a sale of personal information and its opt-out | notice to the person | the UK | If a merger or acquisition or other change in organisational structure means that you… |
| ICO direct marketing guidance | marketing to the people in a list | no specific step stated | the UK | People have an absolute right to object to or opt out of direct marketing at any time |
| ICO guide to PECR: email marketing | marketing to the people in a list | the person's consent | the UK | There is a limited exception for your own previous customers, often called the ‘soft… |
| ICO guide to PECR: using marketing lists | a sale of personal information and its opt-out | the person's consent | the UK | As a general rule, you can only sell your marketing list if you have the consent of the… |
| PECR 2003 reg 22 | marketing to the people in a list | the person's consent | the UK | a person shall neither transmit, nor instigate the transmission of, unsolicited… |
| UK GDPR art 14 | telling people who holds their data | notice to the person | the UK | Where personal data have not been obtained from the data subject, the controller shall… |
| UK GDPR art 5 | reusing personal data for a new purpose | a lawful basis | the UK | processed lawfully, fairly and in a transparent manner in relation to the data subject |
| UK GDPR art 6 | a lawful basis for using or disclosing personal data | a lawful basis | the UK | the data subject has given consent to the processing of his or her personal data for one… |

## The sentence each answer rests on (72)

- 11 U.S.C. 332, [11 U.S. Code section 332](https://www.law.cornell.edu/uscode/text/11/332), read 2026-10-08, What the rule governs: "If a hearing is required under section 363(b)(1)(B), the court shall order the United States trustee to appoint"
- 11 U.S.C. 332, [11 U.S. Code section 332](https://www.law.cornell.edu/uscode/text/11/332), read 2026-10-08, What it asks before the data moves: "the court shall order the United States trustee to appoint"
- 11 U.S.C. 332, [11 U.S. Code section 332](https://www.law.cornell.edu/uscode/text/11/332), read 2026-10-08, Where it applies: "the court shall order the United States trustee to appoint"
- 11 U.S.C. 332, [11 U.S. Code section 332](https://www.law.cornell.edu/uscode/text/11/332), read 2026-10-08, The rule, in its words: "If a hearing is required under section 363(b)(1)(B), the court shall order the United States trustee to appoint"
- 11 U.S.C. 363(b)(1), [11 U.S. Code section 363](https://www.law.cornell.edu/uscode/text/11/363), read 2026-10-08, What the rule governs: "then the trustee may not sell or lease personally identifiable information to any person unless"
- 11 U.S.C. 363(b)(1), [11 U.S. Code section 363](https://www.law.cornell.edu/uscode/text/11/363), read 2026-10-08, What it asks before the data moves: "after appointment of a consumer privacy ombudsman in accordance with section 332, and after notice and a hearing, the court approves such sale"
- 11 U.S.C. 363(b)(1), [11 U.S. Code section 363](https://www.law.cornell.edu/uscode/text/11/363), read 2026-10-08, Where it applies: "then the trustee may not sell or lease personally identifiable information to any person unless"
- 11 U.S.C. 363(b)(1), [11 U.S. Code section 363](https://www.law.cornell.edu/uscode/text/11/363), read 2026-10-08, The rule, in its words: "then the trustee may not sell or lease personally identifiable information to any person unless"
- California data broker definition, [California Civil Code section 1798.99.80](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.99.80), read 2026-10-22, What the rule governs: "means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship"
- California data broker definition, [California Civil Code section 1798.99.80](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.99.80), read 2026-10-22, What it asks before the data moves: "means a business that knowingly collects and sells to third parties the personal information of a consumer"
- California data broker definition, [California Civil Code section 1798.99.80](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.99.80), read 2026-10-22, Where it applies: "means a business that knowingly collects and sells to third parties the personal information of a consumer"
- California data broker definition, [California Civil Code section 1798.99.80](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.99.80), read 2026-10-22, The rule, in its words: "means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship"
- California data broker registry, [California Data Broker Registry (CalPrivacy)](https://cppa.ca.gov/data_broker_registry/), read 2026-10-08, What the rule governs: "must register with CalPrivacy annually between January 1-31 to report on its activities from the previous calendar year"
- California data broker registry, [California Data Broker Registry (CalPrivacy)](https://cppa.ca.gov/data_broker_registry/), read 2026-10-08, What it asks before the data moves: "must register with CalPrivacy annually between January 1-31"
- California data broker registry, [California Data Broker Registry (CalPrivacy)](https://cppa.ca.gov/data_broker_registry/), read 2026-10-08, Where it applies: "must register with CalPrivacy annually between January 1-31"
- California data broker registry, [California Data Broker Registry (CalPrivacy)](https://cppa.ca.gov/data_broker_registry/), read 2026-10-08, The rule, in its words: "Any business that meets the definition of "data broker" must register with CalPrivacy annually between January 1-31"
- CAN-SPAM, [15 U.S. Code section 7704](https://www.law.cornell.edu/uscode/text/15/7704), read 2026-10-28, What the rule governs: "to sell, lease, exchange, or otherwise transfer or release the electronic mail address of the recipient"
- CAN-SPAM, [15 U.S. Code section 7704](https://www.law.cornell.edu/uscode/text/15/7704), read 2026-10-28, What it asks before the data moves: "to sell, lease, exchange, or otherwise transfer or release the electronic mail address of the recipient"
- CAN-SPAM, [15 U.S. Code section 7704](https://www.law.cornell.edu/uscode/text/15/7704), read 2026-10-28, Where it applies: "to sell, lease, exchange, or otherwise transfer or release the electronic mail address of the recipient"
- CAN-SPAM, [15 U.S. Code section 7704](https://www.law.cornell.edu/uscode/text/15/7704), read 2026-10-28, The rule, in its words: "for the sender, or any other person who knows that the recipient has made such a request, to sell, lease, exchange, or otherwise transfer or release the electronic mail address of the recipient"
- CCPA definition of sale, [California Civil Code section 1798.140](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140), read 2026-10-08, What the rule governs: "a consumer’s personal information by the business to a third party for monetary or othe"
- CCPA definition of sale, [California Civil Code section 1798.140](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140), read 2026-10-08, What it asks before the data moves: "The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction"
- CCPA definition of sale, [California Civil Code section 1798.140](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140), read 2026-10-08, Where it applies: "The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy"
- CCPA definition of sale, [California Civil Code section 1798.140](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140), read 2026-10-08, The rule, in its words: "The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business"
- CCPA right to opt out, [California Civil Code section 1798.120](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.120), read 2026-10-08, What the rule governs: "A consumer shall have the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell"
- CCPA right to opt out, [California Civil Code section 1798.120](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.120), read 2026-10-08, What it asks before the data moves: "This right may be referred to as the right to opt out of sale or sharing"
- CCPA right to opt out, [California Civil Code section 1798.120](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.120), read 2026-10-08, Where it applies: "This right may be referred to as the right to opt out of sale or sharing"
- CCPA right to opt out, [California Civil Code section 1798.120](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.120), read 2026-10-08, The rule, in its words: "A business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction"
- Data Protection Act 2018 s 170, [Data Protection Act 2018, section 170](https://www.legislation.gov.uk/ukpga/2018/12/section/170), read 2026-10-08, What the rule governs: "It is an offence for a person to sell personal data if the person obtained the data in circumstances in which an offence under subsection (1) was committed"
- Data Protection Act 2018 s 170, [Data Protection Act 2018, section 170](https://www.legislation.gov.uk/ukpga/2018/12/section/170), read 2026-10-08, What it asks before the data moves: "to obtain or disclose personal data without the consent of the controller"
- Data Protection Act 2018 s 170, [Data Protection Act 2018, section 170](https://www.legislation.gov.uk/ukpga/2018/12/section/170), read 2026-10-08, Where it applies: "It is an offence for a person knowingly or recklessly"
- Data Protection Act 2018 s 170, [Data Protection Act 2018, section 170](https://www.legislation.gov.uk/ukpga/2018/12/section/170), read 2026-10-08, The rule, in its words: "It is an offence for a person to sell personal data if the person obtained the data in circumstances in which an offence under subsection (1) was committed"
- FTC Act section 5, [15 U.S. Code section 45](https://www.law.cornell.edu/uscode/text/15/45), read 2026-10-28, What the rule governs: "unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful"
- FTC Act section 5, [15 U.S. Code section 45](https://www.law.cornell.edu/uscode/text/15/45), read 2026-10-28, What it asks before the data moves: "unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful"
- FTC Act section 5, [15 U.S. Code section 45](https://www.law.cornell.edu/uscode/text/15/45), read 2026-10-28, Where it applies: "unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful"
- FTC Act section 5, [15 U.S. Code section 45](https://www.law.cornell.edu/uscode/text/15/45), read 2026-10-28, The rule, in its words: "Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful"
- ICO data sharing code on databases and lists, [ICO code of practice page](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/), read 2026-10-28, What the rule governs: "The transfer of databases or lists of individuals is a form of data sharing, whether for money or other consideration, and whether for profit or not."
- ICO data sharing code on databases and lists, [ICO code of practice page](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/), read 2026-10-28, What it asks before the data moves: "You must tell data subjects who you are sharing their data with, and for what purposes."
- ICO data sharing code on databases and lists, [ICO code of practice page](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/), read 2026-10-28, Where it applies: "check what information was given to individuals in accordance with Article 14 of the UK GDPR"
- ICO data sharing code on databases and lists, [ICO code of practice page](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/), read 2026-10-28, The rule, in its words: "You are responsible for compliance with the law for the data you receive, and you have to respond to any complaints about it."
- ICO data sharing code on mergers and acquisitions, [ICO code of practice page](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/), read 2026-10-27, What the rule governs: "on insolvency, data might be sold as an asset to a different legal personality"
- ICO data sharing code on mergers and acquisitions, [ICO code of practice page](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/), read 2026-10-27, What it asks before the data moves: "consider when and how you will inform data subjects about what is happening"
- ICO data sharing code on mergers and acquisitions, [ICO code of practice page](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/), read 2026-10-27, Where it applies: "Under the UK GDPR you are required to keep individual data subjects informed about certain changes relating to the processing of their data, and they may have a right to object."
- ICO data sharing code on mergers and acquisitions, [ICO code of practice page](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/), read 2026-10-27, The rule, in its words: "If a merger or acquisition or other change in organisational structure means that you have to transfer data to a different or additional controller, you must consider data sharing as part of the due diligence you carry out when taking on the organisation and its obligations."
- ICO direct marketing guidance, [ICO: direct marketing guidance](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/), read 2026-10-24, What the rule governs: "People have an absolute right to object to or opt out of direct marketing at any time"
- ICO direct marketing guidance, [ICO: direct marketing guidance](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/), read 2026-10-24, What it asks before the data moves: "People have an absolute right to object to or opt out of direct marketing at any time"
- ICO direct marketing guidance, [ICO: direct marketing guidance](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/), read 2026-10-24, Where it applies: "People have an absolute right to object to or opt out of direct marketing at any time"
- ICO direct marketing guidance, [ICO: direct marketing guidance](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/), read 2026-10-24, The rule, in its words: "People have an absolute right to object to or opt out of direct marketing at any time"
- ICO guide to PECR: email marketing, [ICO: guide to PECR, electronic mail marketing](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/), read 2026-10-23, What the rule governs: "You must not send marketing emails or texts to individuals without specific consent"
- ICO guide to PECR: email marketing, [ICO: guide to PECR, electronic mail marketing](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/), read 2026-10-23, What it asks before the data moves: "You must not send marketing emails or texts to individuals without specific consent"
- ICO guide to PECR: email marketing, [ICO: guide to PECR, electronic mail marketing](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/), read 2026-10-23, Where it applies: "The rules on electronic mail marketing are in regulation 22"
- ICO guide to PECR: email marketing, [ICO: guide to PECR, electronic mail marketing](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/), read 2026-10-23, The rule, in its words: "There is a limited exception for your own previous customers, often called the ‘soft opt-in’"
- ICO guide to PECR: using marketing lists, [ICO guidance page](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/using-marketing-lists/), read 2026-10-28, What the rule governs: "As a general rule, you can only sell your marketing list if you have the consent of the listed individuals to do so."
- ICO guide to PECR: using marketing lists, [ICO guidance page](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/using-marketing-lists/), read 2026-10-28, What it asks before the data moves: "Ask for specific consent also if you want to pass details to other companies, and make sure you name or describe those companies."
- ICO guide to PECR: using marketing lists, [ICO guidance page](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/using-marketing-lists/), read 2026-10-28, Where it applies: "You should screen call lists against the TPS"
- ICO guide to PECR: using marketing lists, [ICO guidance page](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/using-marketing-lists/), read 2026-10-28, The rule, in its words: "As a general rule, you can only sell your marketing list if you have the consent of the listed individuals to do so."
- PECR 2003 reg 22, [Privacy and Electronic Communications Regulations 2003, regulation 22](https://www.legislation.gov.uk/uksi/2003/2426/regulation/22), read 2026-10-23, What the rule governs: "a person shall neither transmit, nor instigate the transmission of, unsolicited communications for the purposes of direct marketing by means of electronic mail"
- PECR 2003 reg 22, [Privacy and Electronic Communications Regulations 2003, regulation 22](https://www.legislation.gov.uk/uksi/2003/2426/regulation/22), read 2026-10-23, What it asks before the data moves: "unless the recipient of the electronic mail has previously notified the sender that he consents"
- PECR 2003 reg 22, [Privacy and Electronic Communications Regulations 2003, regulation 22](https://www.legislation.gov.uk/uksi/2003/2426/regulation/22), read 2026-10-23, Where it applies: "a person shall neither transmit, nor instigate the transmission of, unsolicited communications"
- PECR 2003 reg 22, [Privacy and Electronic Communications Regulations 2003, regulation 22](https://www.legislation.gov.uk/uksi/2003/2426/regulation/22), read 2026-10-23, The rule, in its words: "a person shall neither transmit, nor instigate the transmission of, unsolicited communications for the purposes of direct marketing by means of electronic mail"
- UK GDPR art 14, [UK GDPR, Article 14](https://www.legislation.gov.uk/eur/2016/679/article/14), read 2026-10-08, What the rule governs: "Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information"
- UK GDPR art 14, [UK GDPR, Article 14](https://www.legislation.gov.uk/eur/2016/679/article/14), read 2026-10-08, What it asks before the data moves: "the controller shall provide the data subject with the following information"
- UK GDPR art 14, [UK GDPR, Article 14](https://www.legislation.gov.uk/eur/2016/679/article/14), read 2026-10-08, Where it applies: "the controller shall provide the data subject with the following information"
- UK GDPR art 14, [UK GDPR, Article 14](https://www.legislation.gov.uk/eur/2016/679/article/14), read 2026-10-08, The rule, in its words: "Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information"
- UK GDPR art 5, [UK GDPR, Article 5](https://www.legislation.gov.uk/eur/2016/679/article/5), read 2026-10-08, What the rule governs: "for specified, explicit and legitimate purposes and not further process"
- UK GDPR art 5, [UK GDPR, Article 5](https://www.legislation.gov.uk/eur/2016/679/article/5), read 2026-10-08, What it asks before the data moves: "processed lawfully, fairly and in a transparent manner in relation to the data subject"
- UK GDPR art 5, [UK GDPR, Article 5](https://www.legislation.gov.uk/eur/2016/679/article/5), read 2026-10-08, Where it applies: "processed lawfully, fairly and in a transparent manner in relation to the data subject"
- UK GDPR art 5, [UK GDPR, Article 5](https://www.legislation.gov.uk/eur/2016/679/article/5), read 2026-10-08, The rule, in its words: "processed lawfully, fairly and in a transparent manner in relation to the data subject"
- UK GDPR art 6, [UK GDPR, Article 6](https://www.legislation.gov.uk/eur/2016/679/article/6), read 2026-10-08, What the rule governs: "Processing shall be lawful only if and to the extent that at least one of the following applies"
- UK GDPR art 6, [UK GDPR, Article 6](https://www.legislation.gov.uk/eur/2016/679/article/6), read 2026-10-08, What it asks before the data moves: "Processing shall be lawful only if and to the extent that at least one of the following applies"
- UK GDPR art 6, [UK GDPR, Article 6](https://www.legislation.gov.uk/eur/2016/679/article/6), read 2026-10-08, Where it applies: "Processing shall be lawful only if and to the extent that at least one of the following applies"
- UK GDPR art 6, [UK GDPR, Article 6](https://www.legislation.gov.uk/eur/2016/679/article/6), read 2026-10-08, The rule, in its words: "the data subject has given consent to the processing of his or her personal data for one or more specific purposes"

## Read and set aside

- [ICO legitimate interests guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/legitimate-interests/): the contents page of the ICO's legitimate interests guidance, a list of questions with no rule stated; the lawful basis is read from UK GDPR article 6

## Methodology

Each rule's own UK and US statutes, regulations and regulators' guidance were read through estate-fetch and stored whole (sha256 on every row). For every statute or guidance page, four questions were answered from its own words: what the rule governs, what it asks before the data moves, where it applies, the rule, in its words. Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the statute or guidance page read does not address the question. A rule with several statute and guidance pages reads 'varies' where they disagree. 18 rules, 18 statute and guidance pages.

## Sources

- [UK GDPR art 5, principles](https://www.legislation.gov.uk/eur/2016/679/article/5) (read)
- [UK GDPR art 6, lawfulness of processing](https://www.legislation.gov.uk/eur/2016/679/article/6) (read)
- [UK GDPR art 14, information where data not obtained from the subject](https://www.legislation.gov.uk/eur/2016/679/article/14) (read)
- [Data Protection Act 2018 s 170, unlawful obtaining of personal data](https://www.legislation.gov.uk/ukpga/2018/12/section/170) (read)
- [PECR 2003 reg 22, unsolicited email marketing](https://www.legislation.gov.uk/uksi/2003/2426/regulation/22) (read)
- [ICO direct marketing guidance](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/) (read)
- [ICO guide to PECR: electronic mail marketing](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/) (read)
- [ICO legitimate interests guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/legitimate-interests/) (not-terms)
- [California Civil Code 1798.140, CCPA definitions](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140) (read)
- [California Civil Code 1798.120, right to opt out of sale](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.120) (read)
- [California Civil Code 1798.99.80, data broker definitions](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.99.80) (read)
- [California Privacy Protection Agency data broker registry](https://cppa.ca.gov/data_broker_registry/) (read)
- [15 U.S.C. 45, FTC Act section 5](https://www.law.cornell.edu/uscode/text/15/45) (read)
- [15 U.S.C. 7704, CAN-SPAM requirements](https://www.law.cornell.edu/uscode/text/15/7704) (read)
- [11 U.S.C. 363, use, sale or lease of property](https://www.law.cornell.edu/uscode/text/11/363) (read)
- [11 U.S.C. 332, consumer privacy ombudsman](https://www.law.cornell.edu/uscode/text/11/332) (read)
- [ICO: due diligence when sharing data following mergers and acquisitions](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/) (read)
- [ICO: sharing personal data in databases and lists](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/) (read)
- [ICO guide to PECR: using marketing lists](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/using-marketing-lists/) (read)

## Cite or embed

- 18 UK and US rules on the people in a CRM when the record is licensed or sold, read 28 October 2026.
- What the rule governs, by rule: a sale of personal information and its opt-out 5 of 18, marketing to the people in a list 4 of 18, selling personal information in bankruptcy 2 of 18, registering as a data broker 2 of 18, breaking a privacy promise 1 of 18, a lawful basis for using or disclosing personal data 1 of 18, a criminal offence for selling personal data 1 of 18, reusing personal data for a new purpose 1 of 18, telling people who holds their data 1 of 18 (18 rules, read 28 October 2026).
- What it asks before the data moves, by rule: no specific step stated 6 of 18, the person's consent 4 of 18, notice to the person 4 of 18, a court's approval or an ombudsman 2 of 18, a lawful basis 2 of 18 (18 rules, read 28 October 2026).
- Where it applies, by rule: the UK 10 of 18, California 4 of 18, US federal law 4 of 18 (18 rules, read 28 October 2026).
- The rule, in its words, by rule: stated 18 of 18 (18 rules, read 28 October 2026).

Cite as: "The law on the people in a CRM when the record changes hands", updated 2026-10-28, https://sellcrmdatatoai.com/datasets/crm-data-law/.

CSV: https://sellcrmdatatoai.com/datasets/crm-data-law.csv
JSON: https://sellcrmdatatoai.com/datasets/crm-data-law.json
Embed (plain HTML, static link back): see https://sellcrmdatatoai.com/datasets/crm-data-law/#lead