Selling company data to AI labs in the United Kingdom
Before company data goes to an AI lab, the privacy law where the people in it live asks one question: can anyone still be identified from it? This page explains the main laws in the United Kingdom, what counts as no longer personal, and what to check first. General information as of 2026-10-27, not legal advice: your counsel confirms what applies to your company.
At a glance
| Main laws | The UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025, which changed parts of both. The ICO says all the data protection provisions of the 2025 Act are now in force. |
|---|---|
| What counts as de-identified | Data is no longer personal data only if people are not identified or identifiable. The ICO asks whether that is reasonably likely, and tells organisations to use the motivated intruder test to check. Pseudonymised data is still personal data for whoever holds the extra information that can reverse it. |
| Who enforces | The Information Commissioner's Office, known as the ICO. The 2025 Act provides for the ICO to become a body called the Information Commission, so check the regulator's current name. |
| Moving data abroad | Sending personal data to a separate organisation outside the UK is a restricted transfer. It needs UK adequacy regulations, an appropriate safeguard such as the IDTA or the Addendum, or a narrow exception. The 2025 Act rewords the test that applies. |
The main laws, and what each means for selling data
UK GDPR
Personal data about identified or identifiable people, whenever an organisation in the UK, or an organisation targeting people in the UK, handles it. It sets the lawful basis, transparency, security and accountability rules.
If a support ticket archive holds customer names, email addresses or account numbers, handing it to an AI lab is processing personal data. The seller needs a lawful basis for the disclosure and has to tell people what happens to their data. If the data is properly anonymised first, the UK GDPR does not apply to the anonymous result, but the anonymising step is itself processing.
Source: ICO, pseudonymisation guidance (explains personal data and Recital 26)
Data Protection Act 2018
The UK law that sits beside the UK GDPR. It adds conditions for special category data, sets out ICO powers, and creates criminal offences.
Section 171 makes it an offence to knowingly or recklessly re-identify de-identified personal data without the consent of the controller who de-identified it. A company that removes names from a dataset and sells it can therefore set a contract term that bans re-identification. The offence does not replace that contract term, and it has defences, such as crime prevention and some public interest cases.
Source: legislation.gov.uk, Data Protection Act 2018 section 171
Data (Use and Access) Act 2025
An Act that amends the UK GDPR and the Data Protection Act 2018. It added a recognised legitimate interests basis, clarified scientific research including commercial research, changed the information duties to people, and moved the regulator to a new Information Commission.
A seller who collected customer data years ago may find the notice rules easier in some research cases, because the Act allows an exception when giving notice is impossible or takes disproportionate effort. The seller must still protect people's rights in other ways and publish the notice. The ICO says all the data protection provisions are now in force, so a seller should check current wording of the UK GDPR, not a version from before 2026.
Data (Use and Access) Act 2025, Schedule 7 (the data protection test for transfers)
It rewrote the test for sending personal data outside the UK. Under adequacy regulations, the Secretary of State must consider protection is not materially lower than UK standards. Under appropriate safeguards, the sender must reasonably and proportionately consider the same test is met.
A UK company licensing data to an AI lab in another country that has no adequacy regulations has to put a safeguard in place, such as a contract, and judge whether protection after the transfer would be materially lower. The judgement depends on the nature and volume of the data. A large archive of customer emails calls for a closer look than a small set of product records.
Source: legislation.gov.uk, Data (Use and Access) Act 2025 Schedule 7
UK GDPR Article 9 (special category data)
Extra protection for data about health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data used to identify someone, sex life and sexual orientation.
A clinic selling appointment records, or an employer selling HR tickets that mention sick leave, is dealing with health data, even if the file does not look medical. The ICO says special category data needs a valid Article 9 condition. Each such record has to be removed or anonymised before the rest of the data is shared.
How the UK decides data is no longer personal
The UK GDPR protects information about a person who is identified or identifiable. Anonymous information falls outside it. The ICO's anonymisation guidance, published on 28 March 2025, says the key question is what is reasonably likely, given the circumstances, not every theoretical possibility. The ICO page says the guidance is under review because of the Data (Use and Access) Act 2025, and it is not a statutory code. Treat it as the regulator's advice, and note it can change.
The ICO tells organisations they must use the motivated intruder test to assess the risk. The test asks whether a reasonably competent person, with ordinary resources such as the internet, libraries and public records, and who is determined to identify people, could succeed. The organisation can run the test itself, use a third party, or combine both. For complex datasets that could be matched with public data, the ICO says specialist expertise may be needed.
Pseudonymised data, where names are swapped for codes, stays personal data for whoever holds the key or the additional information. If the key is kept back, the data may be anonymous in the recipient's hands, but that has to be assessed. A re-identification check is not a one-off. The ICO says to reassess when new attacks appear, when new datasets are released, before access is given to new recipients, and when the purpose of the data changes. Controls such as contracts and access limits also count in the assessment, because identifiability depends on who receives the data and under what conditions.
Sources: ICO, anonymisation guidance, about this guidance, ICO, how do we ensure anonymisation is effective, ICO, pseudonymisation
Records that carry extra rules
Health records
Health data covers past, current or future physical or mental health, including diagnoses, test results and device data. Some records, such as appointment lists or invoices, can count if they reveal something about health. It needs a valid Article 9 condition.
Other special category data
Racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify someone, sex life and sexual orientation also need an Article 9 condition. Free text in tickets and emails can reveal these.
NHS patient data and the national data opt-out
The Health Research Authority describes a national data opt-out for patients, and says studies using anonymised data are unaffected. NHS sources say the opt-out applies to confidential patient information shared outside an organisation, not to anonymised data. Check current NHS England guidance for your case.
Guessed or inferred sensitive details
The ICO says inferences about special category data can themselves be special category data. A model or a rule that guesses a health condition from purchase history in a dataset can create such data.
Sending data to an AI lab in another country
A transfer is restricted when the UK GDPR applies to the data, the sender starts the transfer to an organisation outside the UK, and the receiver is a separate legal entity. The ICO says that making data accessible to an overseas organisation counts, not only sending it, and small or rare transfers are covered too. Every restricted transfer needs one of three routes. These are UK adequacy regulations, an appropriate safeguard (the International Data Transfer Agreement, the Addendum to the EU standard clauses, or binding corporate rules), or a narrow exception that must be necessary and proportionate. The ICO says that when a safeguard is used, a transfer risk assessment confirms protection is not materially lower after the transfer.
The Data (Use and Access) Act 2025 rewrote the test to a data protection test of 'not materially lower' protection. For adequacy it is applied by the Secretary of State. For safeguards the sender applies it, acting reasonably and proportionately. The ICO's January 2026 brief guide on transfers does not describe this change, so check the ICO's detailed transfer guidance for the current wording. Fully anonymous data is not personal data, so these transfer rules would not apply to it, but that depends on the anonymisation holding up in the lab's hands.
Sources: ICO, international transfers: a guide, legislation.gov.uk, Data (Use and Access) Act 2025 Schedule 7, ICO, what the Data (Use and Access) Act means for organisations
Who enforces it
Questions about selling data from the United Kingdom
Is it legal to sell company data to an AI company in the United Kingdom?
It can be, but it depends on what is in the data. If the data holds no information about identifiable people, the UK GDPR does not apply to it, though contracts, confidentiality and trade secrets still matter. If it does hold personal data, the seller needs a lawful basis and must meet transparency, security and transfer rules. This is general information, not legal advice, and it does not promise compliance.
What does anonymisation mean under UK data protection law?
Anonymous data is information from which people cannot be identified, taking into account what is reasonably likely in the circumstances. The ICO says to use the motivated intruder test to check this. Replacing names with codes is pseudonymisation, and the ICO says that is still personal data for anyone holding the key. This is general information, not legal advice.
What is the motivated intruder test?
It is a check described in ICO guidance. You ask whether a reasonably competent person with ordinary resources, such as the internet and public records, who is determined to identify people, could do so from the data. You can run it yourself or ask a third party. This is general information, not legal advice.
Can I send UK company data to an AI lab in another country?
If the data is personal data, sending it to a separate organisation outside the UK is a restricted transfer. It needs adequacy regulations, an appropriate safeguard such as the IDTA or the Addendum with a transfer risk assessment, or a narrow exception. The Data (Use and Access) Act 2025 rewords the test to one of protection that is not materially lower. This is general information, not legal advice.
Does the Data (Use and Access) Act 2025 change what a company must do before selling data?
It changed parts of the UK GDPR and the Data Protection Act 2018, including the transfer test, the notice rules for some research uses, and the structure of the regulator. The ICO says all the data protection provisions are now in force. A company should check the current text before relying on older advice. This is general information, not legal advice.
Didn't find your question? Ask us directly.
What we do about it
We find and remove the personal information in your company data, test whether anyone could still be identified, and write down how it was done for your counsel. If you license the data through us, the AI lab usually pays for that work, and the AI lab pays our broker fee, only after the deal closes. See how de-identification works and how licensing your data works.
Rules in other regions
- United States: HIPAA, California and other state laws, the FTC, and the records that carry extra rules.
- Canada: PIPEDA, Quebec Law 25, the provincial acts, and health information laws.
- European Union: The GDPR, the EDPB on anonymisation and AI models, and the EU AI Act.
- Australia: The Privacy Act 1988, the Australian Privacy Principles, OAIC guidance and health records laws.