# Who is liable if the data buyer is hacked?

> Who is liable if the data buyer is hacked? No company-data deal publishes the answer. Published terms put indemnity on the owner and cap buyer liability.

By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/who-is-liable-if-the-data-buyer-is-hacked  
Published: 2026-09-19  
Updated: 2026-10-14

## The short answer

No public source says who is liable if a data buyer is hacked in a company-data deal. SimpleClosure's terms have the owner indemnify the buyer. All 50 states have breach-notification laws, and who must notify depends on the contract. Insurers are adding AI exclusions.

A breach at a buyer is a live question. In March 2026 a poisoned open-source release exposed [Mercor](/buyers/mercor), an AI data company. The story is in [Mercor data breach](/answers/mercor-data-breach).

## What do published buyer terms say about breach liability?

Very little, and what they say favors the buyer. [SimpleClosure's terms](https://simpleclosure.com/tos/) make the owner indemnify [SimpleClosure](/buyers/simpleclosure), which means cover its losses. That covers three things:

- breach of warranties
- privacy-law violations
- claims tied to personal information in the owner's data

They cap SimpleClosure's own liability at the greater of the amount paid in the prior six months or $100.

## Who has to notify people after a breach?

All 50 states, the District of Columbia and several territories have breach-notification laws ([National Conference of State Legislatures](https://www.ncsl.org/technology-and-communication/security-breach-notification-laws)).

Who must notify after a breach at a licensee depends on the contract. It also depends on whether the data was licensed or sold. That is a question for counsel before the deal. After an incident it is late.

California adds a duty on the seller side. A business that sells personal information has to keep reasonable security in place alongside the sale contract ([California Civil Code 1798.100(d) to (e)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf)).

## Does insurance cover it?

Don't assume so.

[Fenwick's](https://www.fenwick.com/insights/publications/end-silent-ai-emerging-ai-exclusions-coverage-fragmentation-and-practical-implications) review sorts the policy types:

- Cyber policies are relatively stable.
- Tech errors and omissions forms face growing scrutiny.
- Directors and officers and employment practices forms show the biggest change. Broad "absolute" AI exclusions are appearing.

ISO introduced generative-AI exclusions for general liability forms in January 2026.

Fenwick's advice is to read insuring agreements, definitions and exclusions together. Ask your buyer or insurer in writing whether a claim from an AI data license would be covered.

If someone says the deal itself is insured, [what to ask for when a deal is called insured](/answers/can-you-insure-an-ai-data-licensing-deal) has the checklist.

## What should you ask before you sign?

Ask who holds the data and where. Ask who must notify after a breach, who pays for the loss and which policy responds. Get each answer in writing.

The [rights check](/rights-check) covers your own side: contracts, personal data and who can sign. The [risks page](/risks) tracks what buyers publish about security.

Figure: steps Who holds and who notifies -> Who pays for the loss -> Which policy responds. A breach question gets written answers before you sign.

Talk to a privacy or commercial lawyer in your state before you sign.

_Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._

## Sources

- [SimpleClosure's terms](https://simpleclosure.com/tos/)
- [National Conference of State Legislatures](https://www.ncsl.org/technology-and-communication/security-breach-notification-laws)
- [California Civil Code 1798.100(d) to (e)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf)
- [Fenwick's](https://www.fenwick.com/insights/publications/end-silent-ai-emerging-ai-exclusions-coverage-fragmentation-and-practical-implications)

Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure)