Selling company data to AI labs from the European Union
Before company data goes to an AI lab, the privacy law where the people in it live asks one question: can anyone still be identified from it? This page explains the main laws in the European Union, what counts as no longer personal, and what to check first. General information as of 2026-10-27, not legal advice: your counsel confirms what applies to your company.
At a glance
| Main laws | The General Data Protection Regulation (GDPR) governs personal data. The AI Act sets data and transparency duties around AI. The Data Act covers data from connected products. A Digital Omnibus package would change some of these rules, and its status differs by part. |
|---|---|
| What counts as de-identified | The GDPR does not apply to anonymous information, meaning information that does not relate to an identifiable person. Pseudonymised data is still personal data in general. The EDPB's draft Guidelines 02/2026 on anonymisation set out a test, and they are still open for comment. |
| Who enforces | National data protection authorities enforce the GDPR in each member state. The EDPB coordinates them, and the EDPS supervises EU institutions. The European Commission's AI Office oversees general-purpose AI model providers under the AI Act. |
| Moving data abroad | Personal data can only leave the EU or EEA if the GDPR's transfer rules in Chapter V are met, for example an adequacy decision or safeguards such as standard contractual clauses. Anonymous data is outside the GDPR, so these rules do not apply to it. |
The main laws, and what each means for selling data
General Data Protection Regulation (GDPR), Regulation (EU) 2016/679
It covers any handling of personal data, meaning information about an identified or identifiable person, by organisations in the EU and by some organisations outside it. Tickets, emails, records and documents often contain such data.
Handing a dataset to an AI lab is a new use of the data and usually a disclosure to another party. You need a lawful basis under Article 6, and an extra condition under Article 9 if it holds special categories such as health data. For example, a support ticket archive with customer names and order numbers is personal data unless it has been anonymised first.
EDPB Opinion 28/2024 on certain data protection aspects of AI models
It is an opinion adopted by the European Data Protection Board on 18 December 2024 about AI models, anonymity, legitimate interest and unlawfully processed data. It is guidance, not a statute.
The Opinion recalls that legitimate interest as a legal basis needs a three step check: the interest, the necessity, and a balance against people's rights. It also looks at how unlawfully processed data used to develop a model can affect later use. A company that sells data should therefore be able to show it had a lawful basis for its own handling of that data first.
Source: European Data Protection Board
EDPB draft Guidelines 02/2026 on anonymisation
These guidelines were adopted on 7 July 2026 as version 1 and explain how to judge whether data is anonymous under the GDPR. They are open for public consultation, so the text may change.
They propose a test with three criteria: no record isolation, no linkage and no inference. If all three are passed, the data can be treated as anonymous. For example, a company removing names from a customer email archive would still need to ask whether a person could be singled out from the remaining details.
Source: European Data Protection Board
Court of Justice judgment EDPS v SRB, Case C-413/23 P (4 September 2025)
It is a ruling by the EU's highest court on when pseudonymised data counts as personal data. Courts and regulators use it when they read the GDPR definitions.
The Court held that pseudonymised data is not automatically personal data for every recipient, and that this depends on the circumstances. The press release also says identifiability is assessed from the point of view of the controller at the time the data is collected, for the duty to inform people. A seller should not assume that a recipient who cannot re-identify people takes the seller outside the GDPR, because the seller may still hold the means to link the data back.
Source: Court of Justice of the European Union, press release 107/25
EU Artificial Intelligence Act, Regulation (EU) 2024/1689
It sets rules for AI systems and for providers of general-purpose AI models in the EU. Article 10 sets data governance duties for high-risk AI systems, and Article 53 sets duties for general-purpose model providers, including a public summary of training content.
These duties fall on the AI provider, not on the company supplying data. In practice a provider may ask a seller to describe where data came from and how it was handled, so that it can meet its own record and summary duties. A seller that keeps clear records of source and rights will find those questions easier to answer.
EU Data Act, Regulation (EU) 2023/2854
It has applied since 12 September 2025 and covers fair access to and use of data, especially data generated by connected products and related services.
It matters most if the data comes from connected devices or machinery, because users of those products have rights over that data and contracts about it must be fair. A manufacturer planning to license sensor data should check what its users and customers are entitled to before agreeing a deal. It does not replace the GDPR where personal data is involved.
Digital Omnibus proposals (AI Act changes, and GDPR and data changes)
The AI part was adopted in 2026 and mainly moved AI Act high-risk dates. A separate Commission proposal would change the GDPR, ePrivacy rules and the Data Act.
The proposal for the GDPR would make identifiability depend on the entity holding the data, which could affect when data counts as personal. The EDPB and EDPS have warned that it would narrow the concept of personal data. It is a proposal, so a seller should plan under the current GDPR text.
When data stops being personal data in the EU
The GDPR applies to information about an identified or identifiable person. Recital 26 says the rules do not apply to anonymous information, meaning information that does not relate to an identifiable person, or data made anonymous so the person can no longer be identified. To decide if someone is identifiable, you take account of all the means reasonably likely to be used to identify them. Pseudonymised data, where extra information can link it back to a person, is still treated as personal data in general under Article 4(5) and Recital 26.
The EDPB's draft Guidelines 02/2026 on anonymisation, adopted on 7 July 2026, turn this into a test with three criteria: no record isolation, no linkage and no inference. The guidelines say data that passes all three can be considered anonymous. They offer two ways to apply it. The contextual approach looks at what each possible recipient could actually do. The simplified approach ignores those differences and is more cautious. If a criterion fails, the guidelines call for further analysis, in particular whether any isolated records, with linked data, allow a person to be singled out.
The controller that anonymises the data carries the job of applying the test and checking the result. The guidelines give an example where a business partner could not re-identify people itself but could easily hire a third party to do it, and that still counts as a means reasonably likely to be used. The consultation runs from 8 July to 30 October 2026 (23:59 CET), so the final text may differ. The Court of Justice said in EDPS v SRB (4 September 2025) that pseudonymised data is not automatically personal data for every recipient, and the EDPB guidelines draw on that ruling.
Sources: EUR-Lex, GDPR (Recital 26, Article 4(5)), EDPB consultation page, Guidelines 02/2026 on anonymisation, EDPB, Guidelines 02/2026 text (version 1.0, adopted 7 July 2026), EDPB news, anonymisation and web scraping guidelines, Court of Justice press release 107/25, EDPS v SRB
Records that carry extra rules
Health records
GDPR Article 9 prohibits processing health data unless a listed condition applies, such as explicit consent. You need both an Article 6 basis and an Article 9 condition.
Other sensitive data
Article 9 also covers data revealing racial or ethnic origin, political opinions, religion, trade union membership, genetic and biometric data used to identify a person, and data about sex life or orientation. Free text such as emails and tickets can contain these details by accident.
Data from connected products
The Data Act gives users of connected products rights over the data those products generate. A company licensing such data should check what its users and customers are entitled to.
Sending data to an AI lab in another country
Under Chapter V of the GDPR, personal data may be sent outside the EU or EEA only if a transfer tool applies. Article 44 sets the general principle. The tools include an adequacy decision for the receiving country, or appropriate safeguards such as standard contractual clauses. Data that is truly anonymous is outside the GDPR, so these transfer rules do not apply to it, but that depends on passing the anonymisation test above.
If an AI lab is in the US or another non-EU country and the data is still personal, you would need to identify which tool covers that lab and check whether extra measures are needed. The EDPB publishes guidance on transfers on its website. The national data protection authority of your country can say how it applies the rules to your case.
Sources: EUR-Lex, GDPR (Chapter V, Articles 44 to 49), EDPB, international data transfers
Who enforces it
Questions about selling data from the European Union
Is it legal to sell company data to an AI company in the European Union?
It can be, depending on what the data is. If the data holds no personal data, or has been properly anonymised, the GDPR does not apply to it. If it still holds personal data, you need a lawful basis, clear purposes and a transfer tool if the buyer is outside the EU or EEA. Contracts, trade secrets and customer rights also matter. This is general information, not legal advice, and it does not promise compliance.
Is pseudonymised data the same as anonymous data under the GDPR?
No. Pseudonymised data can be linked back to a person with extra information, and the GDPR still treats it as personal data in general. The Court of Justice said in September 2025 that it is not automatically personal data for every recipient, but the answer depends on the circumstances. Treat it as personal data unless you have done the analysis. This is general information, not legal advice.
What is the EDPB test for anonymised data?
The EDPB's draft Guidelines 02/2026 propose three criteria: no record isolation, no linkage and no inference. Data that passes all three can be considered anonymous. The draft is open for comment until 30 October 2026, so it may change. This is general information, not legal advice.
Do I need consent from customers to sell data to an AI lab?
Not always, but you need a lawful basis for any personal data. Consent is one option, and legitimate interest is another, which needs a three step check of the interest, the necessity and a balance against people's rights. Special categories such as health data need an extra condition under Article 9. A national data protection authority can tell you how it reads this. This is general information, not legal advice.
Does the EU AI Act stop me from selling data to an AI lab?
The AI Act mostly places duties on AI providers, such as data governance for high-risk systems and a public summary of training content for general-purpose models. It does not by itself ban a company from licensing data. The lab may ask you about the source and rights of the data to meet its own duties. The GDPR still applies to any personal data. This is general information, not legal advice.
Didn't find your question? Ask us directly.
What we do about it
We find and remove the personal information in your company data, test whether anyone could still be identified, and write down how it was done for your counsel. If you license the data through us, the AI lab usually pays for that work, and the AI lab pays our broker fee, only after the deal closes. See how de-identification works and how licensing your data works.
Rules in other regions
- United States: HIPAA, California and other state laws, the FTC, and the records that carry extra rules.
- Canada: PIPEDA, Quebec Law 25, the provincial acts, and health information laws.
- United Kingdom: The UK GDPR, the Data Protection Act 2018, the 2025 Act and the ICO anonymisation guidance.
- Australia: The Privacy Act 1988, the Australian Privacy Principles, OAIC guidance and health records laws.