How to remove personal information before you sell
Updated October 2026 · listmydata team
Before any data leaves your hands, remove everything that identifies a person: customers, employees, and anyone mentioned in passing. Some records need more than removal. They need consent, or they should be left out entirely.
What counts as personal information
This checklist is based on HIPAA's list of 18 identifiers, and it works outside health care too (HHS):
- Names, and initials that are easy to match to a name
- Street addresses, and any location smaller than a state
- All dates tied to a person except the year (birth dates, appointment dates)
- Phone and fax numbers, email addresses, web and IP addresses
- Social Security, driver's license, account, card, policy and medical record numbers
- Vehicle IDs and license plates, device serial numbers
- Photos of faces, signatures, voice recordings
- Any other code or detail that points to one person
Don't forget the hidden places: email headers and signatures, file metadata, comments in documents, attachments, and free text like "Maria's surgery is Tuesday."
Leave these out unless you meet the conditions noted
| Record | Why |
|---|---|
| Client tax returns and tax-prep files | A tax preparer needs each client's signed, written consent before using or disclosing return information (IRC 7216). Even anonymous statistics built from returns can't be sold, except as part of selling the practice (Treas. Reg. 301.7216-2). |
| Patient and health records | HIPAA requires patients' written authorization to sell health information, unless it's properly de-identified (HHS). |
| Consumers' financial information | Tax preparers, lenders and other financial businesses need privacy and opt-out notices before sharing it (FTC). |
| Children's data collected online | COPPA covers personal information collected online from children under 13 (FTC). |
| HR, payroll, medical and benefits files | Sensitive, and buyers don't want them. |
| Customer and consumer contact lists | Not allowed on listmydata. In California, selling data about consumers may make you a "data broker" under the state's rules, possibly including data on customers you haven't dealt with in 3 years (CPPA). |
| Law firm client files | Lawyers can't reveal client information without informed consent (ABA Rule 1.6). |
Step by step
- Work on a copy. Export to a separate drive and never edit the originals.
- Narrow the scope. Pick the folders, mailboxes and years worth selling, and drop everything in the table above.
- Replace names consistently. In spreadsheets, swap names for codes (Customer 0412, Tech 07) so the records still make sense. Never give the key to a buyer, and destroy it once the deal is done if you can. Codes alone don't make data anonymous, because details in the text can still point to a person.
- Clean the email. Remove addresses from headers, strip signatures, and leave out personal folders and private messages.
- Search the free text. Search for patterns (phone numbers, emails, Social Security and card numbers) and for every name on your customer and employee lists.
- Redact images and scans. Cover faces, signatures and house numbers.
- Check by hand. Read a random sample, and have someone else read one too.
- Write down what you did. Buyers will ask, and it's your record if questions come up later.
For large or sensitive sets, get help selling connects you with an independent broker. Ask in writing who will remove personal information and how. We may receive a referral fee. For health data, a qualified statistician can certify that people can't reasonably be identified (HIPAA's "expert determination").
Your promises still count
- Privacy policies are promises. The FTC enforces them, and it warned in 2024 that quietly changing your terms to allow AI training may be unfair or deceptive (FTC). If you told customers you wouldn't share their data, remove it completely.
- State privacy laws. About two dozen states now have privacy laws, and most apply only to larger businesses. California's covers businesses with about $26.6 million or more in revenue, data on 100,000+ Californians, or half or more of their revenue from selling or sharing personal information. A closing business that sells data could meet that last test. It treats a paid transfer of personal information, including about employees, as a "sale" unless the data is properly de-identified (CPPA). Texas bars even small businesses from selling sensitive data without consent.
- Your employees. Clear workplace policies shape what employees can expect about work email, but private conversations still deserve care. Remove personal messages. If employees' messages are included, tell them, and leave out messages about pay or working conditions unless they agree.
This guide is general information, not legal advice. For health, financial or large datasets, get legal advice first.
next steps
- List your data: owners always post free.
- Read what buyers want in the wanted ads.
- Get help selling from an independent data broker.
- Get an email when something new is posted.
- Ask other owners in the forums.