Under GDPR, if you process personal data, you are required to have a clear scope: which data, why, for how long is it retained, under which legal basis (articles 5 and 6), etc. Selling data later would be a misappropriation of legal basis.

More info here: https://commission.europa.eu/law/law-topic/data-protection/r...