UK GDPR and licensing company data for AI

01Does UK GDPR apply at all?

Only to the personal data in what you license: information about identifiable people, such as staff and customer names, email addresses, or notes about someone. A folder of SOPs and playbooks with no personal data in it is outside UK GDPR. A CRM export, an inbox or a Slack history almost certainly isn't.

The line that matters most is anonymised versus pseudonymised. The ICO's anonymisation guidance says properly anonymised data is no longer personal data. Pseudonymised data, with names swapped for codes, still is, because someone holding the key could re-identify people. Programmes say they de-identify data, but until it's anonymised, UK GDPR applies to what you hand over.

02The seven checks

If the records hold personal data, these are the questions to work through with your adviser.

1. A lawful basis

You need one of the six lawful bases. For licensing records you already hold, consent is rarely practical, so legitimate interests is the usual candidate. The ICO says it needs a three-part test: a legitimate purpose, processing that's necessary for it, and a balance that doesn't override people's interests. Write it down as a legitimate interests assessment. People can object to processing on this basis.

2. A compatible purpose

You collected the data to run your business, not to train AI. Using it for a new purpose has to be compatible with the original one, or have its own lawful basis. The Data (Use and Access) Act 2025 amends parts of UK GDPR, including the rules on further processing, and the ICO is updating its guidance, so check the current version with your adviser.

3. Privacy information

People have the right to be told what happens to their data. The ICO says that if you share personal data with, or sell it to, other organisations, your privacy information must say so. Check your staff and customer privacy notices before anything is shared.

4. A DPIA

A data protection impact assessment is required where processing is likely to be high risk. The ICO's examples include innovative technology and large-scale processing, and licensing records for AI training usually involves both. A DPIA also gives you a written record of the decisions you made.

5. Special category data

Health, ethnicity, religion, sexual orientation, trade union membership and similar data is special category data. It needs an extra condition on top of a lawful basis. For most companies the practical answer is to leave it out: HR, medical and occupational health records especially.

6. Sending it to the US

The programmes we track are US companies. Sending personal data there is a restricted transfer, so you need one of the mechanisms in the ICO's international transfers guidance: for example, the UK-US data bridge if the recipient is certified to it, or the ICO's international data transfer agreement. Ask the programme which it uses.

7. A written agreement

You and the programme will usually each be a controller for your own part. The ICO's data sharing code recommends a data sharing agreement that sets out the purpose, what's shared, security, retention and deletion. Your data licence can cover this, so read it with these points in mind.

03What makes it easier

• License process documents first
• Leave out HR and medical records
• Anonymise before transfer, not after
• Ask how the programme de-identifies
• Keep your DPIA and assessment on file

The more of your licence that's made of documents with no personal data in them, the fewer of these checks apply. Many companies start there.

04Where to go next

The ICO's AI guidance covers data protection in AI more broadly. For the wider picture (client contracts, NDAs, privilege, US state law), see is it legal to sell company data for AI training?