Short answer: Regulation S-P limits disclosure of customers' nonpublic personal information to nonaffiliated third parties, so an AI data license should exclude it unless counsel confirms an exception. Firm-level operating records without customer information are the realistic scope.
The rule
Section 248.10 limits disclosure of nonpublic personal information to nonaffiliated third parties; the subpart also covers privacy notices and safeguarding (Regulation S-P).
Practical scoping
- Exclude account records, statements and CRM notes about clients.
- Check email and chat archives you keep for recordkeeping; they are full of client information.
- Ask compliance whether licensing archives conflicts with retention or supervision obligations.
Program fit
Mode lists minimum team sizes of 10+ employees for legal, 15+ for accounting, medical and finance, and 50+ for all other businesses, for companies based in the US, Canada, the UK or Australia with several years of records they own (Mode).
This is general information, not legal advice. Talk to your own attorney or compliance advisor before you share or license any records.
What could your company's records be worth?
Answer 6 questions. See the published range for a company like yours and which program fits. Takes about a minute.
Frequently asked questions
Does de-identification take data out of Reg S-P?
Ask counsel. The safe course is to exclude customer information.
What about state privacy laws?
They can apply too. Check with counsel.
Sources
- 17 CFR Part 248, Subpart A (Regulation S-P) (Cornell LII)law.cornell.edu
- Mode / BizBuyData referral pagebizbuydata.com
Referral-fee disclosure: we may be paid by a program if your company signs with it after using this site. General information only, not legal advice.
Compare programs
Best AI data program for a company with 50+ employeesSide by side from each program's own pages. Rankings follow published rules, not referral fees.