Retailer data in wholesale AI: what contracts allow and what they do not
Order histories, sell-out figures and buyer contacts are valuable inputs for AI, but the right to use them depends on contracts, data protection law and, increasingly, the EU Data Act.
KEY TAKEAWAYS Summary by the editors
- Using a retail customer's order, sell-out or assortment data to train or run AI models is permitted only to the extent the wholesale contract, data protection law and any confidentiality terms allow it.
- A contract's data clause usually covers a defined purpose, and using data for a new purpose such as model training generally needs an express right or consent.
- Where wholesale data includes personal data, such as buyer or sales-contact details, GDPR applies alongside the AI Act, and a processor may only act on the controller's documented instructions.
- The EU Data Act, applicable since 12 September 2025, sets fairness rules for data-access terms and a protection against unfair contractual terms in business-to-business data agreements, mainly for data from connected products.
- Aggregated or anonymised data is not automatically free to use, since contract language on confidentiality and derived data decides what a supplier may do with it.
A wholesaler or brand may use retailer data in AI only to the extent that the wholesale contract, data protection law and confidentiality terms allow it. Order histories, sell-out data and assortment plans are commercial information that belongs, in contractual terms, to one party or the other or is shared under defined conditions. Using them to train or run a model is a new use that many existing agreements do not clearly cover.
What retailer data is used in wholesale AI?
Wholesale AI uses several data types. Order histories feed re-order suggestions and sales forecasts. Sell-out or point-of-sale data, where shared, shows what consumers bought. Stock levels, assortment plans and open-to-buy figures inform allocation. Buyer behaviour in digital showrooms or ordering portals, such as browsing and basket changes, feeds recommendation tools. Contact data of buyers and store staff supports communication and may be personal data.
Each type carries different rights. Commercial data is usually protected by confidentiality terms, personal data by GDPR, and some data by competition law considerations. The same field in a database can fall under more than one of these.
| Data type | Typical use in AI | Main limit |
|---|---|---|
| Order history | Re-order suggestions, forecasting | Contract purpose clause and confidentiality |
| Sell-out or POS data | Demand sensing, allocation | Data-sharing agreement terms |
| Assortment and open-to-buy plans | Range recommendations | Confidentiality and competition law caution |
| Portal behaviour logs | Personalised recommendations | Contract terms; personal data rules where individuals are identifiable |
| Buyer and store-staff contact details | Outreach, scoring | GDPR, including purpose limitation and processor terms |
What do wholesale contracts usually allow?
Standard terms vary, but a common pattern is that the supplier may use customer data to fulfil orders, provide services and meet legal obligations, and must keep non-public information confidential. Statements about using data to improve services can be broad or narrow. Whether such a clause covers training a model that serves other customers, or using one retailer's data to inform advice given to a competing retailer, depends on the wording and, if disputed, on how a court reads it.
Four clauses decide most questions: the definition of customer data, the permitted purposes, the treatment of aggregated or derived data, and the confidentiality and return or deletion terms. If aggregated data is expressly licensed to the supplier, model training on it may be covered. If the contract is silent, the safer reading is that no new purpose is permitted without agreement.
What does the contract not allow without further permission?
In the absence of an express right, the following uses are the ones most likely to need consent or an amendment:
- Training a general model on one retailer's data and using it to serve other retailers.
- Sharing a retailer's sell-out data with third-party AI vendors that are not covered by the contract.
- Using retailer data to benchmark or rank retailers against each other and showing results to third parties.
- Retaining data for model purposes after the commercial relationship ends.
- Feeding confidential plans into public or consumer AI tools.
How does data protection law affect the position?
Retailer data often includes personal data, such as the names and contact details of buyers, sales assistants and, in some set-ups, end customers. EU data protection law applies alongside the AI Act, which says in Article 2 that it does not displace it. Under Article 28 of the GDPR, a processor may process personal data only on documented instructions from the controller, needs prior authorisation for sub-processors and must be bound by a written contract with prescribed content. A processor that decides the purposes and means of processing itself is treated as a controller for that processing. A supplier that uses its customers' personal data to train its own models should therefore check whether it has stepped out of the processor role.
What does the EU Data Act add?
The Data Act has applied since 12 September 2025. It mainly concerns data generated by connected products and related services, giving users access rights to data they help generate, excluding inferred or derived data. For business-to-business data sharing where the law requires a data holder to share, terms must be fair, reasonable and non-discriminatory, and protections against unfair contractual terms apply, especially for small and medium-sized enterprises. Some terms are always considered unfair and others presumed so. It also lets parties agree measures to protect trade secrets, and a holder may refuse only where serious economic damage is highly likely from disclosure of trade secrets.
For apparel wholesale, the Data Act is less central than contract and GDPR rules, because most fashion order data does not come from connected products. It is still relevant to connected garments, smart retail fixtures and equipment, and it shapes expectations of fairness in data terms across the market.
How can wholesale teams update contracts for AI?
A practical contract update addresses AI use explicitly. Clauses worth considering include:
- A definition of customer data that names order, sell-out and portal-behaviour data.
- A list of permitted purposes that states whether model training, analytics and benchmarking are allowed.
- A rule for aggregated and anonymised data, including the standard of anonymisation and a ban on re-identification.
- A statement on whether data may leave the supplier's environment, and to which sub-processors.
- Retention, deletion and return terms that cover trained artefacts as far as technically possible.
- An audit or transparency right for the retailer.
- A route for the retailer to opt in or out of data-based features.
What should suppliers and retailers each do next?
Suppliers should inventory which retailer data is used in which AI features, compare each use against the contract, and flag gaps. Retailers should ask suppliers the same questions in procurement: what data is used, for what purposes, with which sub-processors, and what happens at exit. Both sides gain from clear terms, since disputes over data use are costly and tend to surface when a relationship is already strained.
Frequently asked questions
Can a wholesaler train AI on its retail customers' order data?
Only if the contract, confidentiality terms and data protection law permit it. If the agreement limits data use to fulfilling orders and providing services, training a model that benefits other customers generally needs an express right or the retailer's agreement.
Does GDPR apply to wholesale data?
To the extent it contains personal data, such as the contact details of buyers or store staff. Article 28 requires processors to act on documented instructions, and a processor deciding purposes and means itself is treated as a controller for that processing.
Does the EU Data Act cover retailer sales data?
Mostly not. The Data Act focuses on data generated by connected products and related services and on fair terms where data sharing is required. Ordinary order and sell-out data is governed mainly by contract and, where personal, by GDPR.
Is anonymised or aggregated data free to use?
Not automatically. Contract language on confidentiality and derived data decides whether a supplier may use aggregated retailer data, and the data must actually be anonymised if data protection law is to fall away.
One edition every weekday morning. Read in five minutes. Free for industry professionals.
