The alternative data market is estimated at between $4 billion and $12 billion for 2026. Buyer budgets are growing, appetite for new datasets is high, and the tools to work with data are more accessible than ever. For organisations with data to sell, the opportunity is real.

But the bar has risen. Buyers are more sophisticated than they were five years ago, and regulators are more active. The datasets that attract the most commercial interest are often the ones that carry the most compliance complexity. That is not a reason to step back — it is a reason to prepare properly.

This is the second webinar in Neudata's three-part Data for Sale series. Where part one focused on how to assess the commercial value of a dataset and build a go-to-market strategy, this session goes deeper into the regulatory and compliance considerations that determine whether a dataset can actually reach the market — and stay there.

The regulatory picture is more fragmented than most people realise

There is no single rulebook. In the US, the absence of a federal privacy law means that 21 states have enacted their own, each with different provisions, different enforcement mechanisms and different priorities. California's CCPA and Texas's TDPSA are among the most important, and they differ in significant ways — California does not allow violations to be remedied after the fact, while Texas gives businesses 30 days to fix an issue. A common assumption is that California compliance covers everything. It does not.

Geolocation data is a case in point. California has strict rules around its sale. Virginia has banned it outright. Being compliant in one state does not mean being compliant in another, and the regulatory picture is changing quickly — 13% of all global compliance alerts published by Neudata's compliance research team this year have been focused at the US state level alone.

Outside the US, the EU operates under GDPR, which is well established but evolving. China's framework is a system of overlapping layers — the Cybersecurity Law, the Data Security Law and the Personal Information Protection Law — each governing a different dimension of data. China also uses negative lists: explicit categories of data that cannot leave the country under any circumstances. A recent enforcement action against individuals transferring weather data overseas illustrates how broad that scope can be. Data that appears entirely innocuous can trigger serious regulatory consequences.

The practical implication for data sellers is not that you need to master every jurisdiction before going to market. It is that you need to know which jurisdictions are relevant to your data, understand the consent basis for the panels you are sourcing from, and stay current with how the rules are changing.

Consent and ownership are not the same thing — and buyers will test both

Two questions sit at the heart of every serious buyer's due diligence process. First: does this provider own the data, or are they processing it on behalf of someone else? Second: do they have the right to sell it, or just to use it internally?

These are different questions, and the answer to one does not determine the answer to the other. A company may have full access to a dataset and no right to commercialise it. Usage rights granted through a third-party partnership may not extend to external sale. Customer agreements and privacy notices may restrict what can be done with data that a company legitimately holds.

The General Motors case is a direct illustration of what happens when this is ignored. GM's OnStar system collected driver behaviour data and sold it to data companies, who resold it to insurers. Customers had not consented to their data being shared with any third party. GM lost a federal lawsuit and were prohibited from sharing data for several years. More recently, a California court fined them $12 million and imposed further restrictions. The data had commercial value. The absence of proper consent and ownership clarity turned that value into liability.

The constructive lesson is that these questions are answerable, and the process of answering them — properly, in advance — is what separates providers who move through buyer procurement smoothly from those who stall at the compliance stage.

A completed DDQ is one of the most practical steps you can take

A Due Diligence Questionnaire, or DDQ, is the standard document buyers use to assess the compliance profile of a dataset before purchasing it. Every institutional buyer will require one. Completing it is not a formality — it is an active signal of how seriously a provider takes their own compliance obligations.

Neudata's DDQ covers ten sections: company details, product information, data sourcing and distribution, dataset characteristics, privacy and personal data, MNPI considerations and supporting documentation. Working through it forces a degree of rigour about your own product that most providers have not applied until a buyer asks them to.

The commercial effect of having one completed is measurable. Profiles on Neudata's platform with a completed DDQ receive 43% more engagement from buyers. That is a significant difference, and it reflects something straightforward: buyers favour providers who have already done the work of making their compliance position clear.

Anwaar Baseer from Neudata's consulting team puts the most common failure plainly. Buyers are often not rejecting datasets because of quality or usefulness. They reject them because they are not comfortable with the documentation or the compliance position. The data may be good. The paperwork is what loses the deal.

Compliance is not a cost — it is a competitive position

The firms winning institutional business today are not simply the ones with the most interesting data. They are the ones who can answer a DDQ clearly, show clean data provenance and move through a buyer's procurement process without delays. Compliance, handled well, makes all of that possible.

This reframes the question. Rather than asking how much compliance work costs, the more useful question is what it is worth to close deals faster, attract more qualified buyer attention and build a reputation that institutional buyers trust enough to renew year after year. The data providers winning in this market have answered that question and acted on it.