Yes, for records the company owns, if personal data is anonymised or handled under UK GDPR. Procedures, templates and job histories can be licensed to an AI company. Personal data in them needs a lawful basis for the new use, usually legitimate interests backed by a written assessment, and people must be told about the new purpose before it starts. Data that is effectively anonymised under the ICO's test falls outside UK GDPR, which is why most licences start there. A US buyer can receive personal data under the UK-US data bridge if it is certified. Solicitors and accountants also owe client confidentiality. US tax withheld on the fee is generally 0% with a W-8BEN-E treaty form.
- Anonymise first: effectively anonymised data is outside UK GDPR; pseudonymised data is not.
- For any personal data, record a legitimate interests assessment and tell people before the new use.
- Solicitors' and accountants' client files need client consent; firm-authored know-how does not.
What a UK company can realistically license
AI buyers want records that show how work gets done. How much UK GDPR work each kind of record needs varies widely.
| Record | UK GDPR position |
|---|---|
| Procedures, templates and checklists | Usually no personal data; licensable as they are |
| Tickets, job histories and CRM notes | Contain personal data; anonymise or rely on legitimate interests |
| Slack, Teams and email | Staff personal data throughout; anonymise and exclude HR channels |
| Call recordings | A voice is personal data and hard to anonymise; check what callers were told |
| Health or other special category data | Exclude unless an Article 9 condition applies |
| Solicitors' and accountants' client files | Client consent under professional confidentiality rules |
A lawful basis for the new use
Licensing personal data to an AI company is a new purpose, so it needs its own lawful basis. Most companies use legitimate interests. The ICO expects a written assessment covering three tests: a legitimate purpose, whether the processing is necessary for it, and whether people's interests override yours. Licensing an anonymised copy instead usually passes the necessity test more easily, because the buyer rarely needs the identities.
- Tell people about the new purpose before it starts, through your privacy notice and directly where you can.
- Honour objections: people can object to processing based on legitimate interests.
- Leave out special category data such as health, biometric or union information.
- Check customer contracts and earlier privacy promises for limits on new uses.
Anonymise before anything leaves
The ICO published its anonymisation guidance on 28 March 2025. Data is anonymous when the chance of identifying anyone is sufficiently remote, judged by what is reasonably likely rather than merely possible. A motivated-intruder test is the usual starting point. Pseudonymised data, where names are replaced but a key exists, is still personal data. Free text, recordings and images need particular care. See how to de-identify company data.
Sending personal data to a US buyer
Since 12 October 2023, UK organisations can send personal data to US companies that are certified under the EU-US Data Privacy Framework and have opted into its UK Extension, without a separate transfer agreement. Check the buyer on the Data Privacy Framework List. For other buyers, use the ICO's International Data Transfer Agreement or the UK Addendum with a transfer risk assessment. Sensitive data must be flagged to the US recipient.
Source: GOV.UK: UK-US data bridge factsheet for UK organisations
Professional and sector rules
- Solicitors: SRA Code paragraph 6.3 requires keeping current and former clients' affairs confidential unless disclosure is required or permitted by law, or the client consents.
- Accountants: the ICAEW and ACCA codes treat confidentiality as a fundamental principle; client information needs client consent.
- Healthcare: patient information is also covered by the common law duty of confidentiality, on top of UK GDPR.
- Firm-authored templates, precedents and procedures with client details removed are the realistic starting point. See UK accounting firms.
Source: SRA Code of Conduct for Solicitors, RELs, RFLs and RSLs
The Data (Use and Access) Act 2025
The Act received Royal Assent on 19 June 2025 and amends UK GDPR in stages. It adds a short list of "recognised legitimate interests" that skip the balancing test. Licensing records for AI training is not one of them. Check the ICO's guidance for the version in force when you license.
Source: Data (Use and Access) Act 2025
Legal questions by situation
The rules that decide what can be licensed, by situation and country:
Next step
See which buyers accept UK companies in the UK country guide and compare the rules elsewhere in selling company data from outside the US.
Origin Data Partners is independent and is not affiliated with any AI data buyer. We help owners compare buyers and find the best fit for their records. See what your data is worth.
Common questions
Is it legal for a UK company to sell its data to AI companies?
Yes, for records the company owns, provided personal data in them is anonymised or handled under UK GDPR: a lawful basis for the new use, notice to the people concerned and a lawful route for sending it abroad. Client contracts and professional rules can restrict what is licensable.
Do we need consent from customers or employees?
Not always. Consent is one lawful basis, but most companies rely on legitimate interests with a written three-part assessment. People must be told about the new purpose before it starts and can object. Special category data, such as health information, needs an extra Article 9 condition, so leave it out.
Does anonymising the data take it outside UK GDPR?
Yes, if it is effectively anonymised. The ICO's test is whether identification is reasonably likely, judged with a motivated-intruder check. Replacing names with codes while keeping the key is pseudonymisation, which is still personal data. Free text, call recordings and images are the hardest to anonymise.
Can we send the data to a US AI company?
Anonymised data is not a restricted transfer. For personal data, a US buyer certified under the EU-US Data Privacy Framework that has opted into the UK Extension can receive it under the UK-US data bridge, in force since 12 October 2023. Otherwise use the ICO's International Data Transfer Agreement or the UK Addendum.
Is US tax withheld when a UK company licenses data to a US buyer?
Under the UK-US tax treaty, withholding on royalties is generally 0% if you give the buyer a W-8BEN-E. Ask a tax adviser how your fee is characterised.
Did the Data (Use and Access) Act 2025 change this?
It amends UK GDPR in stages from 2025 and adds a list of "recognised legitimate interests" that need no balancing test, such as crime prevention and emergencies. Licensing records for AI training is not on that list, so the ordinary legitimate interests assessment still applies. The ICO is updating its guidance.
Sources and further reading
Origin Data Partners is independent and not affiliated with any buyer named on this page.