# Can a UK company license its data to AI companies under UK GDPR?

> Can a UK company license its data to AI companies? Lawful basis, the ICO anonymisation test, the UK-US data bridge, professional rules and US tax on the fee.

Canonical: https://origindatapartners.com/guides/uk-gdpr-licensing-company-data-ai
By: Origin Data Partners
Status: Published
Published: 2026-11-02
Updated: 2026-11-02
Sources checked: 2026-11-02

## Quick answer

Yes, for records the company owns, if personal data is anonymised or handled under UK GDPR. Procedures, templates and job histories can be licensed to an AI company. Personal data in them needs a lawful basis for the new use, usually legitimate interests backed by a written assessment, and people must be told about the new purpose before it starts. Data that is effectively anonymised under the ICO's test falls outside UK GDPR, which is why most licences start there. A US buyer can receive personal data under the UK-US data bridge if it is certified. Solicitors and accountants also owe client confidentiality. US tax withheld on the fee is generally 0% with a W-8BEN-E treaty form.

## Key points

- Anonymise first: effectively anonymised data is outside UK GDPR; pseudonymised data is not.
- For any personal data, record a legitimate interests assessment and tell people before the new use.
- Solicitors' and accountants' client files need client consent; firm-authored know-how does not.

## What a UK company can realistically license

AI buyers want records that show how work gets done. How much UK GDPR work each kind of record needs varies widely.

| Record | UK GDPR position |
| --- | --- |
| Procedures, templates and checklists | Usually no personal data; licensable as they are |
| Tickets, job histories and CRM notes | Contain personal data; anonymise or rely on legitimate interests |
| Slack, Teams and email | Staff personal data throughout; anonymise and exclude HR channels |
| Call recordings | A voice is personal data and hard to anonymise; check what callers were told |
| Health or other special category data | Exclude unless an Article 9 condition applies |
| Solicitors' and accountants' client files | Client consent under professional confidentiality rules |


## A lawful basis for the new use

Licensing personal data to an AI company is a new purpose, so it needs its own lawful basis. Most companies use legitimate interests. The ICO expects a written assessment covering three tests: a legitimate purpose, whether the processing is necessary for it, and whether people's interests override yours. Licensing an anonymised copy instead usually passes the necessity test more easily, because the buyer rarely needs the identities.

- Tell people about the new purpose before it starts, through your privacy notice and directly where you can.
- Honour objections: people can object to processing based on legitimate interests.
- Leave out special category data such as health, biometric or union information.
- Check customer contracts and earlier privacy promises for limits on new uses.

Source: [ICO: What is the legitimate interests basis?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/legitimate-interests/what-is-the-legitimate-interests-basis/)

## Anonymise before anything leaves

The ICO published its anonymisation guidance on 28 March 2025. Data is anonymous when the chance of identifying anyone is sufficiently remote, judged by what is reasonably likely rather than merely possible. A motivated-intruder test is the usual starting point. Pseudonymised data, where names are replaced but a key exists, is still personal data. Free text, recordings and images need particular care. See [how to de-identify company data](https://origindatapartners.com/guides/de-identify-company-data-before-licensing).

Source: [ICO: How do we ensure anonymisation is effective?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/how-do-we-ensure-anonymisation-is-effective/)

## Sending personal data to a US buyer

Since 12 October 2023, UK organisations can send personal data to US companies that are certified under the EU-US Data Privacy Framework and have opted into its UK Extension, without a separate transfer agreement. Check the buyer on the Data Privacy Framework List. For other buyers, use the ICO's International Data Transfer Agreement or the UK Addendum with a transfer risk assessment. Sensitive data must be flagged to the US recipient.

Source: [GOV.UK: UK-US data bridge factsheet for UK organisations](https://www.gov.uk/government/publications/uk-us-data-bridge-supporting-documents/uk-us-data-bridge-factsheet-for-uk-organisations)

## Professional and sector rules

- Solicitors: SRA Code paragraph 6.3 requires keeping current and former clients' affairs confidential unless disclosure is required or permitted by law, or the client consents.
- Accountants: the ICAEW and ACCA codes treat confidentiality as a fundamental principle; client information needs client consent.
- Healthcare: patient information is also covered by the common law duty of confidentiality, on top of UK GDPR.
- Firm-authored templates, precedents and procedures with client details removed are the realistic starting point. See [UK accounting firms](https://origindatapartners.com/sell-company-data/united-kingdom/accounting-firms).

Source: [SRA Code of Conduct for Solicitors, RELs, RFLs and RSLs](https://www.sra.org.uk/solicitors/standards-regulations/code-conduct-solicitors/)

## The Data (Use and Access) Act 2025

The Act received Royal Assent on 19 June 2025 and amends UK GDPR in stages. It adds a short list of "recognised legitimate interests" that skip the balancing test. Licensing records for AI training is not one of them. Check the ICO's guidance for the version in force when you license.

Source: [Data (Use and Access) Act 2025](https://www.legislation.gov.uk/ukpga/2025/18/contents)

## Legal questions by situation

The rules that decide what can be licensed, by situation and country:

- [Is it legal to sell company data for AI training?](https://origindatapartners.com/guides/sell-company-data-ai-training-legal)
- [De-identifying records before licensing](https://origindatapartners.com/guides/de-identify-company-data-before-licensing)
- [GDPR, CCPA and licensing company data](https://origindatapartners.com/guides/data-licensing-gdpr-ccpa)
- [Selling your business or practice](https://origindatapartners.com/guides/license-company-data-when-selling-business)
- [Tax practices and IRC Section 7216](https://origindatapartners.com/guides/section-7216-ai-data-licensing)
- [Law firms and ABA Rule 1.6](https://origindatapartners.com/guides/law-firm-ai-data-licensing-ethics)
- [Australian businesses and the Privacy Act](https://origindatapartners.com/guides/australia-privacy-act-ai-data-licensing)


## Next step

See which buyers accept UK companies in the [UK country guide](https://origindatapartners.com/sell-company-data/united-kingdom) and compare the rules elsewhere in [selling company data from outside the US](https://origindatapartners.com/guides/sell-company-data-outside-us).

Origin Data Partners is independent and is not affiliated with any AI data buyer. We help owners compare buyers and find the best fit for their records. [See what your data is worth](https://origindatapartners.com/check-fit).


## Questions and answers

### Is it legal for a UK company to sell its data to AI companies?

Yes, for records the company owns, provided personal data in them is anonymised or handled under UK GDPR: a lawful basis for the new use, notice to the people concerned and a lawful route for sending it abroad. Client contracts and professional rules can restrict what is licensable.

### Do we need consent from customers or employees?

Not always. Consent is one lawful basis, but most companies rely on legitimate interests with a written three-part assessment. People must be told about the new purpose before it starts and can object. Special category data, such as health information, needs an extra Article 9 condition, so leave it out.

### Does anonymising the data take it outside UK GDPR?

Yes, if it is effectively anonymised. The ICO's test is whether identification is reasonably likely, judged with a motivated-intruder check. Replacing names with codes while keeping the key is pseudonymisation, which is still personal data. Free text, call recordings and images are the hardest to anonymise.

### Can we send the data to a US AI company?

Anonymised data is not a restricted transfer. For personal data, a US buyer certified under the EU-US Data Privacy Framework that has opted into the UK Extension can receive it under the UK-US data bridge, in force since 12 October 2023. Otherwise use the ICO's International Data Transfer Agreement or the UK Addendum.

### Is US tax withheld when a UK company licenses data to a US buyer?

Under the UK-US tax treaty, withholding on royalties is generally 0% if you give the buyer a W-8BEN-E. Ask a tax adviser how your fee is characterised.

### Did the Data (Use and Access) Act 2025 change this?

It amends UK GDPR in stages from 2025 and adds a list of "recognised legitimate interests" that need no balancing test, such as crime prevention and emergencies. Licensing records for AI training is not on that list, so the ordinary legitimate interests assessment still applies. The ICO is updating its guidance.

## Sources

- [ICO: What is the legitimate interests basis?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/legitimate-interests/what-is-the-legitimate-interests-basis/)
- [ICO: How do we ensure anonymisation is effective?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/how-do-we-ensure-anonymisation-is-effective/)
- [GOV.UK: UK-US data bridge factsheet for UK organisations](https://www.gov.uk/government/publications/uk-us-data-bridge-supporting-documents/uk-us-data-bridge-factsheet-for-uk-organisations)
- [SRA Code of Conduct for Solicitors, RELs, RFLs and RSLs](https://www.sra.org.uk/solicitors/standards-regulations/code-conduct-solicitors/)
- [Data (Use and Access) Act 2025](https://www.legislation.gov.uk/ukpga/2025/18/contents)

## Related reading

- [/sell-company-data/united-kingdom](https://origindatapartners.com/sell-company-data/united-kingdom)
- [/sell-company-data/united-kingdom/accounting-firms](https://origindatapartners.com/sell-company-data/united-kingdom/accounting-firms)
- [Selling company data to AI labs from outside the US](https://origindatapartners.com/guides/sell-company-data-outside-us)
- [How to de-identify company data before licensing it](https://origindatapartners.com/guides/de-identify-company-data-before-licensing)