Data (Use and Access) Act 2025: what changes when a company licenses its data

The Data (Use and Access) Act 2025 changes parts of UK data protection law. If your company holds personal data in its records and you are thinking of licensing them to an AI lab, a few of those changes touch your plans. Most of them are small. None of them removes the questions you already had to answer.

This post uses one source: the government's own factsheet, "Data (Use and Access) Act factsheet: UK GDPR and DPA", published on GOV.UK on 27 June 2025. The factsheet says it is for reference only and is not regulatory guidance or legal advice.

Where the Act sits

The Act amends two existing laws: the UK GDPR and the Data Protection Act 2018. It does not replace them. The factsheet also says the Act comes into force in stages and that the exact dates are published separately on GOV.UK. It gives none of them.

So any statement about "what is in force today" needs a date on it. Our UK rules page keeps that current, and it covers the new test for sending data abroad, so this post leaves transfers out.

Four changes worth knowing

Change	What the factsheet says	Why a company licensing records cares
Further use of data (section 71)	Clarifies when further processing is compatible with the original purpose, including a change of controller	Licensing records to a lab is a new use, by a new organisation
Recognised legitimate interests (section 70, Schedule 4)	A new lawful ground for a limited set of interests. The necessity requirement stays. The detailed legitimate interests assessment is removed for them	Check the list before assuming it helps you
Research (section 67)	Sets out what counts as research and statistical purposes and says research includes commercial scientific research	A lab may call its work research. Whether a given use counts is a question for counsel
Subject access requests (sections 75 to 78)	Searches must be "reasonable and proportionate", and the response clock can pause while an organisation asks for clarification	People can still ask what you hold, so know what went where

Further use of data

Records are collected for a purpose: you took the order, answered the ticket, ran the payroll. Licensing them to an AI lab is a different purpose, and the lab becomes a different organisation holding them. The factsheet describes section 71 as a clarification of when that kind of further use is compatible with the original purpose, and says it covers a change of controller. A clarification is not a waiver. You still start from what people were told when their information was collected.

Recognised legitimate interests

The factsheet gives these examples: crime prevention, safeguarding vulnerable people, responding to emergencies, national security, and helping other bodies carry out legally sanctioned public tasks. None of the examples is about licensing data to a company. It would be a mistake to read the new ground as a shortcut for a data licence. Your usual questions about the lawful basis for disclosing the records stay in place.

Research

Section 67 sets out the meaning of research and statistical purposes, and the factsheet says research includes commercial scientific research. The factsheet does not say that training an AI model counts. If a lab describes training as research, ask which provision it relies on and have counsel read the answer.

Subject access requests

The factsheet says searches for requests must be "reasonable and proportionate", which codifies what case law already said, and that the response deadline can pause while you seek clarification. This does not change what a licence should do. It is a reason to keep a short log of which records went to which licensee, so that you can answer a request about your own records without guessing.

What the factsheet does not cover

It says nothing about anonymisation or re-identification, and it states no penalties or fine levels. For how data stops being personal data, see our page on de-identification. For the broader question of whether you may license company records at all, see is it legal to sell company data.

A short list before records leave

1. Write down which records you mean and the notice people saw when the information was collected.
2. Check whether the licence needs de-identified data, and who does the work.
3. Ask the lab how it will use the data and whether it is the only party that will hold it.
4. Keep a record of what went to whom.
5. Have counsel read the contract and the list before you sign.

This is general information, not legal advice. Ask your own counsel before records leave the company.

AITrainingDataBroker.com explains how these deals work, step by step, for company owners.