# How fast should a buyer de-identify your data?

> De-identification timelines set the days a buyer has to remove names after extraction. Polyshares' Ryan Lock suggests about 14 days and a deletion certificate.

By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/data-deidentification-timeline-after-extraction  
Published: 2026-09-21  
Updated: 2026-10-14

## The short answer

A de-identification timeline says how many days a buyer has to take names out of your data. Ryan Lock of Polyshares suggests asking for about 14 days and a deletion certificate. That is one buyer's advice, not a rule. Until the names are out, the buyer holds your raw data.

De-identification means taking names and other details out of records. The timeline is how long the buyer takes to do it.

## Why does the gap matter?

Lock calls the time between extraction and finished de-identification the riskiest period for an owner ([X article](https://x.com/RyanLockAI/status/2107864069105389717)). Our page on [safety](/answers/is-it-safe-to-sell-company-data-to-ai) says that in most models a buyer handles raw data before names come out.

Mercor's breach in March 2026 is the dated test case. Reports put about four terabytes at risk. See the [breach page](/answers/mercor-data-breach).

1. **Extract** Data leaves your systems.
2. **Raw files held** Names still inside.
3. **De-identified** Names come out.
4. **Raw deleted** Ask for a certificate.

_The risk sits in steps one to three. A deadline shortens it._

## What does the article suggest?

Ask for de-identification to finish within about 14 days of extraction, scaled to the size of the data. Ask for a certificate of deletion once the raw files are transformed.

Lock also says most deals include no such terms. That is his view, and we found no survey to confirm it.

## Do the companies handle raw data the same way?

No. Lock says third-party firms do the work so [Polyshares](/buyers/polyshares) never touches raw files. Its data handling page says two Polyshares people can see an unmasked record ([page](https://polyshares.com/data-handling)).

[micro1](/buyers/micro1) staff said in an undated recorded forum talk that micro1 transforms data itself. micro1's David Revland described swapping names for consistent stand-ins. See [micro1 PII transformation](/answers/micro1-pii-transformation).

[Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes), a law firm, advises limiting access to raw data and requiring certification of the de-identification to your satisfaction.

## What belongs in the contract?

1. A completion date.
2. Who does the work.
3. A deletion certificate.
4. What happens if the date slips.

Read [data de-identification](/answers/data-de-identification) first. Talk to a privacy lawyer in your state before you sign.

micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure)

Have a lawyer read any contract before you sign. They like that.

[Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships)

_Paid link. [How we are paid](https://vaultfish.com/disclosure)_

_Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._

## Sources

- [X article](https://x.com/RyanLockAI/status/2107864069105389717)
- [polyshares.com](https://polyshares.com/data-handling)
- [Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)