Business records are rarely just business information. They contain names, email addresses, notes about customers, staff details and commercially sensitive material that other people trusted the business to keep private. Before licensing any of it to an AI data buyer, a business needs to understand its legal position. This article sets out the main questions to work through with your own advisers.
This is general information, not legal advice. Data protection and contract law depend on the facts. Take advice from a solicitor or data protection specialist about your own records before agreeing anything.
Find the personal data first
Under the UK GDPR, personal data is any information relating to an identified or identifiable living person. In business records it turns up almost everywhere:
- names and contact details in emails, tickets and contracts;
- employee records, rotas and performance notes;
- customer histories, case notes and complaints;
- free text that mentions people, even in passing.
Some of it may be special category data, such as information about health, which has extra protection. Information about criminal convictions and offences has its own rules too.
Start with an inventory: which systems hold which record types, what personal data they contain and whose it is. The ICO’s guidance on data sharing is a useful starting point.
Work out who is responsible for what
Data protection law assigns responsibility by role. A controller decides why and how personal data is used. A processor acts only on a controller’s instructions. When a business licenses records to an AI developer for the developer’s own purposes, the business is likely to remain a controller for the disclosure, and the buyer is likely to be a controller in its own right for what it does with the data afterwards. The contract should reflect the real roles, not just label them.
The ICO explains the difference in its guidance on controllers and processors.
Check the new purpose and lawful basis
The personal data in your records was collected to run the business: to serve customers, employ staff or deliver projects. Licensing it to train AI is a different purpose. Under the purpose limitation principle, a new purpose must be compatible with the original one, or have its own lawful basis. Questions to ask:
- What lawful basis would apply to disclosing the data? If it is legitimate interests, has a legitimate interests assessment been done?
- Would the people concerned reasonably expect their information to be used in this way?
- What do your existing privacy notices say, and do they need updating?
- Is a data protection impact assessment needed? One is required where processing is likely to result in a high risk to individuals.
The Data (Use and Access) Act 2025 amended parts of the UK data protection framework, so check that any guidance you rely on is current. The ICO also publishes guidance on AI and data protection.
Share less
The safest personal data is the data you never share. Before any transfer, ask whether the buyer actually needs it. Options include leaving out records that are not needed, removing or masking names and other identifiers, and anonymising data where that is genuinely achievable.
Be realistic about anonymisation. Removing names does not always make data anonymous, because people can sometimes be identified from context or by combining details. Data that is only pseudonymised, for example with names replaced by codes, is still personal data.
The licence should say who is responsible for this preparation work, to what standard, and what happens if personal data is found later.
Check confidentiality and contracts
Data protection is only half of the picture. Contracts and duties of confidence can restrict what a business may do with information even where no personal data is involved. Review:
- Customer and supplier contracts. Many contain confidentiality clauses that limit how the other party’s information can be used or disclosed.
- Non-disclosure agreements. NDAs often cover information received during negotiations, tenders or joint projects.
- Employment contracts and policies. These may set expectations about how staff information and communications are used.
- Third-party material. Documents, reports or data the business licensed from others may not be the business’s to license onwards.
- Professional duties. Firms such as solicitors, accountants and healthcare providers hold client information under professional duties of confidentiality, and law firms may hold material covered by legal professional privilege, which belongs to the client.
Where a contract restricts use, the options are usually to leave the affected records out, to ask the other party for consent, or not to proceed.
Ask where the data will go
Many AI developers are based outside the UK. Sending personal data abroad is a restricted transfer under the UK GDPR. It needs UK adequacy regulations covering the destination, or appropriate safeguards such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Ask where the buyer will store and process the data, and read the ICO’s guidance on international transfers.
Put it in the licence
A well-drafted licence should deal with:
- the exact records in scope, and those excluded;
- each party’s data protection role and responsibilities;
- preparation standards for personal data, such as removal, masking or anonymisation;
- confidentiality and security obligations;
- where the data may be stored and transferred;
- limits on onward sharing;
- retention, deletion and what happens when the licence ends;
- warranties and indemnities, and exactly what they cover.
Do not give warranties about your right to license the data until the checks above are done. If a warranty turns out to be wrong, your business carries the risk.
How ADP handles information
ADP never receives the records. For an introduction we hold contact details, basic eligibility information, consent records and the status of the introduction, and we have no facility for uploading datasets. Records go directly from your business to the buyer under the licence you agree. See our safeguards and the guide for business owners, or read about what buyers look for.
Frequently asked questions
Can we license records that contain personal data?
Possibly, but only with a lawful basis, a compatible purpose, appropriate transparency and safeguards. Many businesses remove or mask personal data first. Take advice on your own records.
Is removing names enough to make data anonymous?
Not always. People can sometimes be identified from context or by combining information. Pseudonymised data is still personal data under the UK GDPR.
Does an NDA stop us from licensing records?
It may, for the information it covers. Review each NDA and contract, and leave restricted material out or get the other party’s consent.
Who is responsible for the data after it is transferred?
That depends on the facts and the contract. A buyer using the data for its own purposes is likely to be a controller in its own right, but your business remains responsible for its decision to disclose.