Insights · 6 min read

Personal Data Lowers Data Value, and Removing It Has a Cost

Names in your chat history are a liability to a buyer. Taking them out is real work, and some context goes with them.

Bearish AI · October 21, 2026

Work data is full of people. Chat names colleagues, tickets name customers, commit history carries email addresses. To a buyer, each of those is a risk to remove before the data can be used. That risk is priced in. Here is how it works, and what you can do about it. This is general information, not legal advice; privacy law differs by country, and you should ask a qualified lawyer.

What counts as personal data

Under the European Union’s data protection regulation, personal data means any information relating to an identified or identifiable person, who can be identified directly or indirectly by a name, an identification number, location data or an online identifier. That is broader than most people expect. A username, an IP address in a log or a customer number in a ticket can all qualify.

The regulation also draws a line that matters here. Pseudonymisation means processing data so it can no longer be tied to a specific person without additional information kept separately. The regulation’s recitals add that pseudonymised data that could be attributed to a person with extra information should still be considered information on an identifiable person. Only truly anonymous information falls outside the rules. In practice, replacing names with stand-ins reduces risk and is a normal step, but it does not by itself make a dataset free of privacy obligations.

Why models make buyers cautious

Researchers have shown that language models can leak what they were trained on. In a well-known study of a public language model, the authors extracted hundreds of verbatim training sequences, including names, phone numbers and email addresses. Buyers know this. A model trained on raw chat is a model that could repeat it.

What the market already does

Reporting on the resale of startup data says suppliers employ data scientists to scrub personally identifiable information and leave out HR records, and that buyers scrub again. A lawyer quoted in the same report points out that emails and calendars still hold private details such as medical appointments and family plans.

The Spirit Airlines sale shows what scrutiny can look like. The privacy ombudsman in the bankruptcy recommended approval with conditions: booking and transaction records, refunds and similar customer data stay out entirely, a third party de-identifies the corporate email, that party files a certification with the court before every transfer, and the certification should state how many passengers’ details were found and removed. The buyer must publicly commit not to re-identify the data, and may not pass it on unless the recipient makes the same commitment. That is a high bar, set for a very large and public sale, but it shows what a careful process can look like.

What removal costs

The trade-off is real. Replacing every name with a blank would destroy the thread of who asked, who answered and who approved. Consistent stand-ins keep that structure. That is the approach we describe in /insights/linked-data-code-tickets-chat, and it needs care, because inconsistent scrubbing both leaks identities and breaks links.

What good looks like to a buyer

A careful buyer wants a record of the scrubbing, not only a claim that it happened: which categories were excluded, what method was used, how many items were changed and how the output was checked. The Spirit conditions point the same way, with a certification before each transfer that counts what was removed. A preparation log of that kind costs little to produce if you plan for it and a great deal to reconstruct later.

There is also an honest limit. If an archive is small and made mostly of personal conversations, the cost of cleaning it can exceed what the cleaned version is worth. In that case the right answer may be to exclude those parts, or not to sell. A good estimate will tell you so.

Mistakes to avoid

• Search and replace. Swapping a few known names misses nicknames, email handles, mentions and names inside free text.
• Assuming small means safe. A few hundred messages can still hold identifiable health or family details.
• Scrubbing the latest version only. Personal details and secrets often live in old commits, edited messages and attachments.
• Forgetting metadata. User IDs, IP addresses, device names and timestamps can identify people on their own.
• Treating scrubbing as approval. Removing names does not answer whether you may share the content at all.

If your company, your staff or your customers are in Europe, the regulation is likely to apply to this data, and other regions have their own rules. Which rules apply to you is a question for a lawyer.

Does the data you hold carry more risk than you think?

• Customer data in tickets. Support tickets often paste customer emails, names and screenshots.
• Employee data in chat. Chat covers health, family and pay conversations that nobody meant to share.
• Identifiers in code. Test fixtures and logs frequently hold real names and addresses.
• Contractors and outside parties. People who never worked for you may appear in shared channels.

Personal data also interacts with rights. Employees and customers may have expectations about how their words are used, which we cover in /insights/data-ownership-rights-before-selling-data-to-ai-companies. Pseudonymization and secret removal help, but they are a separate step from a review of rights, confidentiality and licensing, and one does not replace the other.

The free estimate at /estimate asks whether your data contains none, some or a lot of personal data, and lowers the figure accordingly. It also shows, in plain words, what a preparation step could change.