Who actually owns your business data?

Who owns your business data? Usually nobody, in the way you mean

Ask an owner who owns the customer and sales data in their till, their CRM, their shop and their ad accounts, and the answer comes fast: I do, obviously. The law is less obliging. In the UK, as in Ireland, Germany and Austria, there is no general property right in data as such. Nobody holds a title deed to a row in a database the way they hold one to a van. What exists instead is a patchwork of narrower rights, each protecting something specific: the investment in building a database, the secrecy of valuable information, the privacy of the people in it, and above all whatever the contract with your software vendor says.

That sounds academic until the day you try to switch tools. Then each layer of the patchwork either works for you or against you. This article walks through the layers in the order they matter in practice, shows what the EU Data Act changed for switching (and why a UK business cannot rely on it), looks at who really controls an ad account, and ends with a checklist you can work through this week.

A short word before we start. This is a practical overview, not legal advice. Where a contract or a switch is worth real money, have a solicitor read it.

Five layers decide what you can actually do with your data

It helps to see the layers side by side, because owners tend to collapse them into one word, ownership, and then wonder why the word does not help.

Layer	What it protects	Who usually holds it	What it does for you on the day you leave
Database right	The investment in obtaining, verifying or presenting a database	Whoever made that investment	Stops others copying a substantial part, but may not cover data you simply generated
Trade secrets	Information kept secret that has value because it is secret	Whoever controls it and takes reasonable steps	Lets you stop misuse, but only if you treated it as secret
Data protection	The privacy of the people in the data	You as controller, your vendor as processor	Your vendor must return or delete personal data at your choice
Contract	Whatever the parties agreed	Whoever drafted it, usually the vendor	Decides export, format, fees, derived data and deletion
Platform terms	Accounts on Google, Meta, Shopify and the like	Whoever opened and owns the account	Decides whether the history and the account stay with you

The rest of the article takes these one at a time.

Database right protects the investment, not the data

The closest thing to an ownership right in a collection of data is the database right. In the UK it lives in the Copyright and Rights in Databases Regulations 1997, which say a property right called database right subsists in a database "if there has been a substantial investment in obtaining, verifying or presenting the contents of the database".¹ The rule comes from the EU Database Directive of 1996, which gives the maker of such a database a right to prevent extraction or reuse of all or a substantial part of its contents.²

The catch for an ordinary business is in the word obtaining. In the British Horseracing Board case of 9 November 2004, the Court of Justice held that the protected investment is the effort of seeking out existing materials and collecting them, and that it "does not cover the resources used for the creation of materials which make up the contents of a database".³ Your till does not seek out existing sales. It creates them. So a plain log of your own transactions may well fall outside the database right, while a carefully gathered and checked list of trade contacts may fall inside it. Either way the right protects the database against copying by others. It does not, on its own, force your vendor to hand anything back.

Trade secrets protect what you actually kept secret

Your customer list, your margins by product and your best performing audiences can be trade secrets. Under the Trade Secrets (Enforcement, etc.) Regulations 2018, information qualifies if it is secret, has commercial value because it is secret, and has been subject to "reasonable steps under the circumstances" to keep it secret by the person lawfully in control of it.⁴

That last condition is the practical one. If five former agencies still have admin access to your analytics, and your full customer export sits in a shared folder anyone with the link can open, it becomes hard to argue you took reasonable steps. Access hygiene is not just security. It is part of what keeps your data legally yours to protect.

Data protection decides who is responsible, not who owns

UK GDPR does not answer the ownership question, but it sets two rules that matter when you leave a supplier.

First, when a vendor processes personal data on your behalf, it is your processor, and the contract with it must say that the processor, "at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services".⁵ Return or deletion is your choice, not theirs. Read the clause and check that return comes before deletion in practice.

Second, the right to data portability belongs to your customers, not to you. It gives an individual the right to receive the personal data they provided "in a structured, commonly used and machine readable format" where processing rests on consent or contract and is automated.⁶ It is a useful benchmark for what a fair export looks like, but a business cannot invoke it against its own vendor.

There is also a twist on the ad platforms. Google lists most Google Ads programmes under its controller terms, while Customer Match uploads, Enhanced Conversions, Google Analytics and Tag Manager run under its processor terms.⁷ In plain words: the customer list you upload stays yours to control, but much of what Google learns from the clicks on its own platform is Google's to control. You can export your reports. You cannot take Google's view of your audience with you.

The contract is where ownership is really decided

Because the statutes protect so little directly, the contract with each vendor does most of the work. The pattern to watch for is a clause that says you retain your data, next to another that says the vendor owns the platform, the database structure and any derived or aggregated data. Read together, they give you the rows and keep the shape, and the shape (which order belongs to which customer, which segment each customer sits in) is the part you need to rebuild somewhere else.

These are the clauses worth reading before you sign, with what good and bad tend to look like.

Clause	What good looks like	What bad looks like
Your data	You keep all rights in data you enter or generate	You get a licence to use your data, the vendor owns the structure
Export	Complete, self service, at any time	Only on written request, only at the end, or for a fee to be agreed
Format	Open and documented, such as CSV or JSON with a schema	A private format, or a PDF
Relationships	Links between customers, orders and history survive	Flat sheets with no shared keys
Derived data	Your segments and scores come out with the raw data	All derived and aggregated data belongs to the vendor
Exit timing	A retrieval window that starts after the export is ready	Automatic deletion a fixed number of days after notice
Cost to leave	Free, or a small named fee	Unspecified, set later

None of these clauses is exotic. Together they tell you whether a vendor expects you to stay because the product is good or because leaving is hard.

The EU Data Act made switching a right, inside the EU

The EU Data Act, Regulation (EU) 2023/2854, has applied since 12 September 2025.⁸ For this question its most useful part is Chapter VI on switching between data processing services, a definition its recitals say covers infrastructure, platform and software as a service. It applies to providers wherever they are established, when they serve customers in the Union.

The contract must now set out the switching rights in writing, including a notice period for starting a switch of no more than two months, a transition of at most 30 calendar days during which the provider must give reasonable assistance, an exhaustive list of the data and digital assets that can be ported, and a retrieval window of at least 30 calendar days after the transition. Since 12 January 2027, providers may no longer charge switching fees at all; before that date they could charge only the costs directly linked to the switch.⁸ Two limits matter: the strictest parts do not apply where most of the main features were custom built for one customer and are not offered at broad commercial scale, and none of the chapter applies to time limited test versions. In November 2025 the Commission also proposed targeted exemptions from some of the switching rules for small and mid sized providers, as part of its digital omnibus package.⁹ At the time of writing that was a proposal, so check the text in force before you rely on a detail.

The Act also makes unfair data terms that one business imposes on another unilaterally non binding. That rule applies to contracts concluded after 12 September 2025, and from 12 September 2027 to older contracts of indefinite duration or with at least ten years to run.⁸ Separately, users of connected products gain rights to the data those products generate, with a design duty for products placed on the market after 12 September 2026, and an exemption for micro and small manufacturers.⁸

For a UK business the honest summary is short. The Data Act protects customers in the Union. A company based in Britain, buying software for its British operations, cannot rely on it and has only its contract. If you trade from both sides, check which entity signed which contract.

Who owns the ad account

This is the question that causes the most grief, because the ad account carries years of conversion history, audiences and learning that a new account starts without.

Google's policy for third parties is fairly clear. An agency must set up a separate Google Ads account for each advertiser, and you have a right to know at least the clicks, impressions and cost of your ads.¹⁰ Agencies must give customers their Google Ads customer IDs and report costs that match what Google charged, without the agency's fees, or let customers sign in to see that data directly.¹¹ What the policy does not do is decide who controls the account. That depends on who created it and who holds admin access, so make sure the account sits in a manager structure you control and that your own login has admin rights.

Meta works through business portfolios. Meta's own documentation distinguishes a business that owns an ad account from one that has agency access, notes that most marketing companies do not need to claim their clients' ad accounts, and says a business cannot remove an ad account it owns once the ownership is confirmed.¹² The practical consequence: if an agency creates the ad account inside its own portfolio, you are asking for a favour on the day you part ways. Create it in yours and give the agency partner access.

Shopify has the same shape. A store a partner builds as a client transfer store sits in the partner's organisation until ownership is transferred, after which the merchant owns it and it leaves the partner's organisation. A collaboration, by contrast, gives a partner access to a store the merchant already owns.¹³ Owning the store from day one, and inviting your developer in, is the cleaner route.

Worked example: what a bad exit costs a Bristol homeware shop

Harbourside Homeware (harbourside.example) is an invented shop in Bristol with a till, a webshop and an email platform, all from one vendor. The owner wants to switch. The contract gives the vendor the database structure and all aggregated data, the export is a flat file without customer keys, and the customer segments stay behind.

A rough way to price this is to add the cost of rebuilding to the overpayment while you stay because leaving is hard (the Foundations on discounting show how to weigh future months more carefully):

$L = C_{m} + (P_{p} - P_{f}) \times T$

Here $L$ is the cost of lock in, $C_{m}$ the one off cost of migrating and rebuilding the relationships, $P_{p}$ the monthly price paid, $P_{f}$ a fair market price for the same service, and $T$ the number of months you stay longer than you would like.

Say rebuilding the order history and the segments by hand costs £6,000, and the owner pays £180 a month above a fair price for 18 extra months because the switch kept being postponed:

$L = 6000 + 180 \times 18 = 9240$

So $L$ comes to £9,240, a cost that appears on no invoice. The figures are invented, but the structure is the point: the second term keeps growing for as long as leaving feels too hard, which is exactly why the exit terms deserve attention while you still have the bargaining power of an unsigned contract.

What happens to data, code and models when you work with me

The same questions apply to me, so here is where I stand.

Your raw data stays yours, and the terms for code and models are in the analytics and data science terms. In short, those terms say that all raw data remains the client's property, that the models, dashboards, scripts and code I create remain my intellectual property unless agreed otherwise, that licensing can be arranged for deployment you own, and that access to deployed dashboards ends with the engagement unless a transfer is agreed. You should know that before we start, not after.

Bespoke code on a Solidus or Rails shop is different. Bespoke code and design paid for in full become yours on payment. Rails, Solidus and any hosting underneath stay under their own licences, as they would with anyone. And ad accounts, analytics properties and the shop itself are set up in your name from the start, with me invited in.

A checklist for this week

Most of this needs an afternoon, not a lawyer. A list is the clearest form here.

Open Google Ads, Meta and your shop platform and check who is listed as owner or admin. Your own business and your own login should be at the top, agencies and developers as partners or collaborators.
Remove access for anyone who no longer works with you, and write down who has access and why. That record is part of your reasonable steps for trade secrets.
For your two most important tools, find the clauses on data rights, export, format, derived data, exit timing and cost. If they are missing, that is your answer.
Run a full export and open it with a spreadsheet. Check that you can tell which customer each order belongs to.
Schedule a regular export, monthly is enough for most small businesses, and store it somewhere you control.
Check each processor contract for the return or deletion clause, and that return comes first.
If you trade in the EU, check whether your cloud and software contracts now carry the Data Act switching terms. If you are UK only, put the terms you want into the renewal.

Not legal advice, but a good start

This article is a general overview of UK law with pointers to EU rules, current when it was published in May 2027. It is not legal advice, and the outcome in a real dispute depends on the facts and the contract. What it should give you is the right questions to ask before you sign, while the vendor still wants your signature.