Can email, Slack and source code be sold as training data on winding-up or bankruptcy?

On 13 October 2026 MIT Technology Review reported on a growing market in which brokers acquire source code, email, Slack history and calendars from failed start-ups and resell the material to AI companies as training data (MIT Technology Review). The report concerns the United States, but the same datasets exist in Norwegian companies that are wound up or go bankrupt, and for boards and bankruptcy trustees working data may appear to be one of the few remaining assets with any sale value.

Under Norwegian law each category of data must be assessed separately. Personal data in email and chat is governed by the General Data Protection Regulation (GDPR), which applies in Norway through the Personal Data Act (personopplysningsloven). Employees’ mailboxes are in addition subject to separate regulations, source code to the Copyright Act (åndsverkloven), and information from customers and partners to contract and the Trade Secrets Act (forretningshemmelighetsloven). This article examines those rules and the question of who bears responsibility when the company is being wound up or is in bankruptcy. Further articles on legal basis and controllership are collected on the data protection topic page.

Which rules apply to the different types of training data?

The obstacles to a sale vary with the type of data. The table gives an overview before the individual questions are discussed.

May the company sell email and Slack as training data under the GDPR?

A sale of email and chat logs is processing of personal data in the form of disclosure, and the seller must have a legal basis for the disclosure under GDPR Art. 6(1). The data was collected in order to run the business, and under the principle of purpose limitation in GDPR Art. 5(1)(b) it may not be further processed in a manner incompatible with that purpose. Training AI models at an unknown third party is a new purpose.

Compatibility is assessed under GDPR Art. 6(4). The relevant factors include the link between the purposes and the context in which the data was collected, in particular the relationship between the data subjects and the controller. Account must also be taken of the nature of the data, the possible consequences for the data subjects and the existence of safeguards such as encryption or pseudonymisation. In our assessment a sale of internal communications for AI training will rarely be compatible with the original purpose. Employees, customers and business contacts wrote in a work context and have no reasonable expectation that their messages will become training material for an unknown buyer.

Consent is not a realistic basis in practice. It would have to be obtained from everyone who appears in the material, including external senders, and consent from employees is normally not freely given because of their dependence on the employer. Legitimate interests under GDPR Art. 6(1)(f) therefore remain the relevant basis. The creditors’ interest in a dividend is a legitimate interest, although the balancing test must take into account that the material is extensive, that it contains private information, and that the data subjects permanently lose control over the data once it has been used to train a model.

What about health data and other special categories?

Email and chat almost always contain special categories of personal data under GDPR Art. 9(1), such as sick notes, information about pregnancy, trade union membership and the health of family members. Processing of such data is prohibited unless one of the exceptions in GDPR Art. 9(2) applies, and none of the exceptions covers a sale for AI training. The seller must therefore filter out such data before any sale, which is difficult to do reliably in free text.

What duty to inform applies on a sale?

The seller must inform the data subjects before the data is processed for a new purpose, see GDPR Art. 13(3) and GDPR Art. 14(4). The buyer obtains the data from someone other than the data subjects and must provide information under GDPR Art. 14 within a reasonable period and at the latest within one month. The exception in GDPR Art. 14(5)(b) for cases where the provision of information proves impossible or would involve a disproportionate effort cannot be used as a general exemption for large datasets. How far the exception extends to purchases of training data has not been settled by the Court of Justice or the Norwegian Privacy Appeals Board.

If the data is genuinely anonymised before the sale, the GDPR does not apply to the buyer’s use. The anonymisation is itself processing that requires a legal basis, and free text is difficult to anonymise. The requirements are discussed in the article on anonymisation under the EDPB guidelines.

Does the Council mandate on the Digital Omnibus change the assessment of training data?

On 21 October 2026 the Permanent Representatives Committee (Coreper) agreed the Council’s negotiating mandate on the Commission’s proposal for a Digital Omnibus, COM(2025) 837. The mandate is set out in Council document ST 14756/26 and retains a dedicated provision on AI in the GDPR, now numbered Art. 88 bis (Art. 88c in the Commission proposal). Under paragraph 1, personal data may be processed in the context of the development and operation of an AI system or AI model for a legitimate interest of the controller or a third party under GDPR Art. 6(1)(f). The Council has added that the provision does not affect the obligation to identify the appropriate legal basis, and that technical and organisational measures and the right to object under GDPR Art. 21 apply whatever the legal basis. The proposed exception for special categories in a new GDPR Art. 9(2)(k) is confined in the Council text to incidental processing of residual data not intended by the controller. Under a new GDPR Art. 9(5) such data must be erased without undue delay once identified.

In our assessment the mandate does not alter the principal conclusion of this article. Art. 88 bis confirms that legitimate interests may form the basis for the buyer’s training, as the article already assumes, but the balancing test under GDPR Art. 6(1)(f) must still be carried out. It is also doubtful whether the seller’s or the estate’s disclosure of a dataset is processing in the context of the development of an AI model within the meaning of the provision. The proposal does not touch the requirement of a compatible purpose, the duty to erase under the Email Regulations, the processor’s lack of a right of disposal, copyright or confidentiality. Nor would the exception in Art. 9(2)(k) cover the purchase of email archives known to contain health data and other special categories. The requirement to filter before a sale therefore stands, and the Council’s Art. 9(5) would make it an express obligation for the buyer to prevent the collection of such data and to erase it.

The mandate is the Council’s starting point for negotiations and not adopted law. The European Parliament has not adopted its position (Legislative Observatory), and trilogue negotiations will begin only once it has done so. The Commission has not marked the proposal as EEA-relevant, and whether and when the amendments will be incorporated into the EEA Agreement remains unsettled. The GDPR in its current form continues to apply in full in the meantime. The Council’s other amendments are discussed in the article on the Digital Omnibus and the GDPR.

What do the Email Regulations mean for a sale of employees’ email?

The Regulations on employers’ access to email accounts and other electronically stored material (e-postforskriften), issued under Working Environment Act § 9-5, apply to both current and former employees under Email Regulations § 1(3). They cover the mailbox and the employee’s personal areas on the undertaking’s network, including deleted material held on backups.

The most important provision on a winding-up is the duty to erase. Under Email Regulations § 4 the mailbox must be closed when the employment ends, and the data must be erased within a reasonable time. The provision reads as follows in unofficial translation.

“Information referred to in § 1 first paragraph (a) and (b) that is not necessary for the day-to-day operation of the undertaking shall be erased within a reasonable time after the employment relationship has ended.”

Once the business has ceased, there are no day-to-day operations that make the data necessary. In our assessment this means that employees’ mailboxes must as a rule be erased, and that a sale value for the creditors is not a need the Regulations recognise. Data required for the winding-up, for example documentation of wage claims, may be retained for as long as that need lasts. The review needed to separate out saleable material is itself an access that is permitted only on the conditions in Email Regulations § 2, and under Email Regulations § 5 the rules cannot be derogated from to the detriment of the employee.

It is unsettled whether the Regulations cover Slack channels and other collaboration tools. Direct messages resemble a mailbox and should in our assessment be treated in the same way, whereas open channels are to a greater extent the undertaking’s shared working material. The GDPR applies to both in any event. The conditions for access are discussed further in the article on employer access to employee email.

Who is the controller on a winding-up and in bankruptcy?

On a voluntary winding-up the company remains the controller, and the winding-up is the responsibility of the board under Companies Act § 16-2. Under Companies Act § 16-8 the board must convert the assets into money to the extent necessary to cover the company’s obligations, although that duty does not in itself provide a legal basis for processing personal data. The board is therefore responsible for ensuring that any sale of data complies with the GDPR.

In bankruptcy the debtor loses the right to dispose of the estate’s assets under Bankruptcy Act § 100, and under Creditors Recovery Act § 2-2 the creditors are entitled to recover from any asset belonging to the debtor that can be converted into money. The trustee represents the estate externally and must ensure that the assets are sold on the most advantageous terms possible under Bankruptcy Act § 85. Under Bankruptcy Act § 117 the assets must be realised within the limits set by legislation. It is thus the estate that in practice decides over the data, and under the functional concept of controller in GDPR Art. 4(7) the better view is that the estate is the controller of the personal data at its disposal. The question has nevertheless not been expressly settled in Norwegian law or in the case law of the Court of Justice, and it cannot be assumed that personal data may be sold as an ordinary asset.

Datatilsynet has held that there must always be a controller, including after a bankruptcy. In its decision against Timegrip AS of 16 January 2026 the supplier of a time-recording system had refused both the bankruptcy estate and former employees access to timesheets. The authority found that the supplier had become the controller because it in reality determined how the data was used, see GDPR Art. 28(10), and imposed an administrative fine of NOK 250,000 for breach of the right of access.

The closest authority in EU law concerns enforcement proceedings. In Case C-693/22 Advocate General Pikamäe took the view on 22 February 2024 that a database containing personal data may, under certain conditions, be sold in enforcement proceedings without the consent of the data subjects, provided that the sale is necessary and proportionate for the recovery of a civil claim. The Opinion does not bind the Court, and the case concerned a sale by a public enforcement officer rather than a sale for AI training. We have not been able to confirm whether the Court has delivered judgment in the case.

Can customer data processed by the company as a processor be sold?

Customer data that a SaaS company processes on behalf of its customers cannot be sold. A processor may only process personal data on documented instructions from the controller under GDPR Art. 28(3)(a), and on termination the data must be erased or returned under GDPR Art. 28(3)(g). A processor that itself determines the purposes of the processing is considered a controller under GDPR Art. 28(10) and is liable for the infringement.

The same applies to the bankruptcy estate, which cannot acquire a greater right to the customer data than the company held. The estate should instead offer the customers return of their data and then document the erasure. The requirements customers should impose on the supplier’s obligations on termination are discussed in the articles on the SaaS data processing agreement and on cloud exit.

Who owns the source code sold as training data?

Copyright in computer programs created by an employee in the performance of their work passes to the employer under Copyright Act § 71, unless otherwise agreed. The transfer also covers the right to modify the code and to assign it onwards. The provision applies only to employees. Code written by consultants, freelancers and founders without an employment contract belongs to the developer unless the rights have been assigned by agreement.

Under Copyright Act § 68(2) rights the company has acquired by agreement may not be assigned onwards without consent, unless they form part of a business or a division of a business and are transferred together with it. On its wording, a sale of code as a dataset, detached from the business, falls outside that exception. The company should therefore review its consultancy agreements before code from contracted developers is included in a sale.

Third-party code and open source code follow their licence terms. Commercial licences are often not assignable, and open source code may only be used in accordance with its licence, including by the buyer. Whether training AI models on code under copyleft licences triggers the obligations under those licences is unsettled. A database may in addition enjoy separate protection for its maker under Copyright Act § 24 where its compilation has required a substantial investment. Copyright in content produced by AI models is discussed in the article on copyright and AI.

Can trade secrets and information subject to confidentiality be sold?

The company’s own trade secrets may be sold, but protection under Trade Secrets Act § 2 presupposes that the information is kept secret. If it is used to train a model that reproduces it to other users, the protection may be lost. This is primarily the company’s own risk and is discussed in the article on trade secrets and AI.

Information that customers, suppliers and partners have provided under a non-disclosure agreement (NDA) is in a different position. The duty of confidentiality does not normally end on a winding-up or bankruptcy, and a sale for AI training will as a rule constitute a breach of contract. Under Trade Secrets Act § 3(2)(b) the unlawful disclosure of a trade secret received in a business relationship is an infringement. The buyer itself infringes under Trade Secrets Act § 3(3) if it knew or ought to have known that the information had been unlawfully disclosed. Whether a model trained on such information may be regarded as an infringing good under Trade Secrets Act § 4 is unsettled.

What should the board and the trustee do before data is sold?

The board of a company in winding-up and the trustee of a bankruptcy estate should review the datasets before working data is offered for sale. The measures below follow the order of the discussion above.

1. Map the datasets by type and role, and distinguish between data the company processes as controller and data it processes as processor for customers.
2. Return or erase customer data processed under a data processing agreement, and document the erasure.
3. Close employees’ mailboxes and erase their content in accordance with Email Regulations § 4, except for what is necessary for the winding-up.
4. Assess in writing the legal basis and compatibility for each dataset still being considered for sale, and filter out special categories of personal data.
5. Review non-disclosure agreements, customer agreements and consultancy agreements to establish which information and which code the company is in fact entitled to transfer.
6. Inform the data subjects before a sale, and agree with the buyer who is responsible for information, anonymisation and erasure.

What should a buyer of training data investigate?

The buyer itself becomes the controller of the personal data and bears the risk if the seller lacked a legal basis. In its Opinion 28/2024 on AI models the European Data Protection Board (EDPB) took the view that unlawful processing in the development of a model may affect the lawfulness of its subsequent use, unless the model is anonymous.

Providers of general-purpose AI models must under AI Act Art. 53(1)(c) and (d) put in place a policy to comply with copyright law and make publicly available a summary of the content used for training. The AI Act has not yet been implemented in Norwegian law, but Norwegian providers targeting the EU market must already comply with these requirements. Due diligence on the purchase of a dataset should therefore cover the seller’s documented rights and legal basis for each category of data, the compatibility assessment and the information given to data subjects. It should also cover the filtering of special categories, the documented anonymisation method, an overview of consultant code, third-party code and licences, and a review of the confidentiality obligations in the seller’s customer agreements. Warranties from a seller in winding-up or bankruptcy are of limited value because the seller ceases to exist, and the buyer should therefore require the documentation to be handed over and made the basis of the purchase agreement before the price is paid.

Questions and answers

Next legal review: 1 December 2026