May I sell or transfer my email database?

Selling an accumulated email database to another business = separate processing with separate basis. Original consent ("I want your newsletter") does NOT cover "I want to be contacted by business X". Purpose limitation (Art. 5(1)(b)) + new-basis requirement (Art. 6) makes this nearly impossible legally. When can it happen? Theoretically only with: (a) Explicit new consent per person — which you must ask the whole database for the sale. Almost no one opts in. (b) Business takeover where buyer continues the same purpose limitation (see takeover article) — information + objection right for customers. (c) Sub-processor: not "sold" but delegated via DPA — strictly for execution, not own marketing. What if you do it anyway? AP fines 2023-2025 hundreds of thousands of euros for businesses that sold member lists. Examples: energy company €250k for giving customer data to partner without consent (2024), health insurer €180k for data to ad agency (2023). Buyer risk: data without basis = unlawful processing = also liable. AP investigates both seller and buyer.