Is it legal to sell company data to AI? UK law on licensing company records

Can a UK company legally license its records to AI developers?

Usually yes, for records it owns, once personal data and confidential material are dealt with. We found no UK law that prohibits a company from licensing its own business records, but each area of law below sets conditions, and they apply together.

The order matters. Ownership and confidentiality decide which records are even candidates; data protection then decides how they must be prepared; the licence fixes what the buyer may do with them.

Selling or licensing: what is the difference?

Selling (assigning) transfers ownership of rights; licensing grants permission to use something on stated terms while you keep it. For company records, a licence of a defined, de-identified copy is the normal and safer structure.

Copyright law allows an assignment to be partial, for example limited to some acts or part of the copyright period²³, and a licence binds later owners of the copyright except a good-faith purchaser without notice²³. Buyers describe their own deals as licences: micro1 says companies retain ownership of their underlying data³³, and Polyshares calls its deal a licence to defined operational data that is "defined and bounded"³⁶.

Personal data is different. It cannot simply be sold on as a product. In 2020 the FCA, ICO and FSCS warned insolvency practitioners and firms that selling clients' personal data to claims management companies may be unlawful²⁷. That is why licensing routes in this market are built around taking personal data out.

What does UK GDPR require?

UK GDPR applies to every step that touches personal data, including the step of removing it. You need a lawful basis, a defined purpose, transparency, extra care with sensitive data and a valid route for any transfer abroad.

Anonymisation is processing. The ICO says applying anonymisation techniques "counts as processing personal data", so you need a lawful basis for it, must define your purpose and must give people information about it. It adds that applying anonymisation techniques to data you hold is, in general, likely to be fair and lawful¹.

Anonymous means effectively anonymous. Data protection law does not apply to anonymous information, but anything below the legal threshold "is not anonymous information, and you must treat it as personal data"¹. The test looks at "the means reasonably likely to be used" to identify someone, and the ICO recommends a "motivated intruder" test as a starting point². Pseudonymised data, where names are swapped for codes, remains personal data¹. The ICO's anonymisation guidance was published on 28 March 2025 and is under review following the Data (Use and Access) Act³.

Lawful basis. The usual candidate for the de-identification step is legitimate interests, which requires a balance against the interests and rights of the people concerned⁸. People can object to processing based on legitimate interests, and the controller must then stop unless it shows compelling legitimate grounds¹². Consent rarely works between employer and employee: the ICO says consent will not usually be appropriate where there is a clear imbalance of power, and that employers should look for another basis⁵.

Purpose. Licensing records for AI training is a new purpose. Since the Data (Use and Access) Act, Article 8A sets out how to judge whether a new purpose is compatible with the original one, and the law now says expressly that compatibility alone does not make processing lawful¹⁷.

Special category data. Processing data about health, ethnic origin, religious beliefs, trade union membership, genetics, biometrics used for identification, sex life or sexual orientation is prohibited unless a specific condition applies⁹. For a licensing project, the practical answer is to exclude these records.

Impact assessment. The ICO requires a data protection impact assessment for innovative technology, including AI, when combined with another high-risk criterion, and for "invisible processing" where people are not told because doing so would involve disproportionate effort⁶. Many licensing projects will meet one of these; ask your solicitor.

Transfers abroad. Since 5 February 2026, UK GDPR allows a transfer of personal data abroad only if it is approved by regulations, made subject to appropriate safeguards or covered by a narrow derogation¹³. For the US, the 2023 data bridge covers only recipients certified to the UK Extension of the Data Privacy Framework and on the DPF List; otherwise the international data transfer agreement or UK Addendum is needed, and HR data needs a certification that covers it^28,29. The 2023 US regulations were made under section 17A of the Data Protection Act 2018²⁹, and the 2025 Act treats regulations of that kind, in force before its new transfer rules began, as if made under the new Article 45A³⁷. Some buyers take raw data and de-identify it themselves: micro1 says companies do not need to anonymise before transfer³³, while Scale AI says it anonymises inside the client's environment before extraction³⁴. The second pattern avoids a transfer of personal data altogether. Sleeping Asset prefers it; where a buyer removes personal data after transfer, we tell you in writing first and your solicitor confirms the transfer route before anything moves.

The step-by-step standard Sleeping Asset applies is on the anonymisation page.

What changed with the Data (Use and Access) Act 2025?

The Act received Royal Assent on 19 June 2025 and most of its data protection changes came into force on 5 February 2026¹⁹. Three changes matter for licensing, and the regulator itself changed on 30 September 2026.

Who owns the records?

Your company generally owns copyright in documents its employees write in the course of their employment, unless agreed otherwise²¹. It does not own what customers, suppliers and other outsiders write, and owning a record never removes the rights of the people it describes.

Three practical consequences follow:

1. Staff emails, chats and documents written for work usually belong to the company²¹. Messages employees write for their own purposes are a different matter; see Slack, Teams and email archives.
2. Third-party documents such as customer emails, supplier contracts and attachments are owned by whoever wrote them²¹. Exclude them, or get permission.
3. Contracts and NDAs may restrict what you can do with information you received, whatever the copyright position. Read them before a system goes into scope.

Rights problems are real in this market. IBTimes UK reported that someone working on AI training environments at Surge AI was offered a large company's codebase for millions of dollars and concluded the sellers did not have the rights to sell it³⁵. A credible buyer will ask you to warrant ownership in the licence.

Does copyright let AI developers train without a licence in the UK?

No. The UK text and data mining exception covers only computational analysis "for the sole purpose of research for a non-commercial purpose" by someone with lawful access to the work²². Commercial AI training needs permission, which is what a licence gives.

The exception has two limits that matter here. It is non-commercial only, and it requires lawful access²²; a developer has no lawful access to your private email or ticketing system. In its report of 18 March 2026 the government said a broad copyright exception with opt-out "is no longer the government's preferred way forward" and that it "will not introduce reforms to copyright law until we are confident" they meet its objectives²⁴. For now, licensing remains the route.

What about duties of confidence to clients and customers?

Information given to you in confidence may not be yours to license, even if the documents are. The ICO describes the common law duty of confidentiality as arising "when a person discloses information to you that they reasonably expect you to hold in confidence"⁷, and professional rules add stricter duties for some sectors.

• Solicitors must keep "the affairs of current and former clients confidential unless disclosure is required or permitted by law or the client consents" (SRA Code of Conduct, paragraph 6.3)²⁵. Client files are therefore out of scope without client consent; a firm's own know-how and operations may not be. See law firms.
• Accountants owe confidentiality as one of the five fundamental principles of the ICAEW Code of Ethics, and on 9 November 2026 ICAEW warned that entering client data into public AI tools can risk unauthorised disclosure²⁶.
• Healthcare providers hold patient data that is special category data⁹ and often confidential⁷. Treat it as out of scope.
• Regulated firms should note the 2020 joint statement: the FCA, ICO and FSCS said standard contract terms are "highly unlikely to constitute sufficient legal consent" for clients' personal data to be shared with claims management companies, and that they will act on breaches²⁷.

Buyers recognise this: Polyshares' licence does not cover what a company holds on behalf of its own clients³⁶.

Do staff and customers need to be told?

In most cases, yes. Where a controller intends to use personal data for a new purpose, UK GDPR requires it to tell people before that further processing starts^10,11, and the ICO says the anonymisation process itself should be explained to the people affected¹.

The ICO's data sharing code, which covers insolvency sales as well as mergers, tells controllers to "consider when and how you will inform data subjects about what is happening"⁴. For data you did not collect from the person (for example a customer named in a colleague's email), there is an exemption where telling them would be impossible or involve disproportionate effort, but you must then take appropriate measures, including making the information publicly available¹¹, and the ICO treats reliance on that exemption as a trigger for an impact assessment when combined with another risk factor⁶.

Telling staff is also good sense. UK coverage of this market has run under the headline that companies are selling employees' private Slack messages and emails, "often without workers' knowledge"³⁵. A staff notice template is on our Slack, Teams and email archives page.

Decision tree: can we license this record set?

Work through these questions for each system (email, chat, tickets, CRM, drives). Stop at the first "no" and fix it, or leave the system out.

1. Does the company own the records, or have the right to license them? Documents written by employees at work usually yes²¹; documents written by customers and suppliers usually no. If no: exclude them or get permission.
2. Was any of it given to you in confidence, or held for clients? If yes: exclude it or get the client's consent^7,25.
3. Do contracts or NDAs restrict use or disclosure? If yes: exclude the affected material or get consent.
4. Does it contain special category data (health, biometrics, trade union and similar)? If yes: exclude those records⁹.
5. Can the remaining personal data be removed so that the licensed copy is effectively anonymous, tested against a motivated intruder? If only pseudonymised: it is still personal data^1,2, and you would need a lawful basis, compatibility analysis and transfer route for licensing it as personal data. Most companies should not go down that path.
6. Do you have a lawful basis for the de-identification step, a written purpose and an impact assessment where needed?^1,6,8
7. Have staff and other affected people been told before processing starts?^10,11
8. Will any personal data leave the UK before it is de-identified? If yes: confirm the transfer route^13,28.
9. Has your own solicitor approved the licence? If yes: the record set is ready to license.

What about companies in administration or liquidation?

The same rules apply, but the office-holder makes the decisions. A liquidator has power to sell any of the company's property³¹, and an administrator has the powers in Schedule 1 to the Insolvency Act 1986³². The ICO's data sharing code says an insolvency practitioner may be "taking the role of controller for the time being"⁴. The full position for office-holders is in our office-holder guide; directors winding down a solvent company should read closing a company.

When to involve a solicitor, and what to ask them

Involve your solicitor before anything is exported, not just before signing. A short review of your record map and the buyer's process is cheaper than unpicking a licence later. If you are not yet sure your records are worth that cost, our guide to what company data is worth sets out what buyers publish.

Questions worth asking:

1. Which of our systems contain third-party, client or confidential material that must be excluded?
2. What is our lawful basis for de-identifying staff and customer data, and do we need an impact assessment?
3. What must our privacy notices and staff notice say, and when must they go out?
4. Does the buyer's de-identification route involve a transfer of personal data abroad, and is the route valid?
5. What warranties, indemnities and liability caps are we giving, and are they insured?
6. How do exclusivity, term, deletion and re-identification bans work in this licence? (See our licence terms checklist.)
7. How is our agent paid, and has every fee been disclosed?

The last question matters for any agent, including us. In Hopcraft v Close Brothers the Supreme Court said a fiduciary's liability to account for profits can be avoided "if full disclosure (of all material facts) is made and the principal gives his or her fully informed consent"³⁰. Sleeping Asset is paid by buyers, never by sellers, and shows every fee in writing before you sign; how we are paid sets out the detail. Unfamiliar terms are defined in the glossary.

Unsure about a record set? A 30-minute call is free, and we will tell you which questions to put to your solicitor.