Is it legal to sell company data to AI companies in the UK?
It can be. No UK law stops a company licensing its own business records to an AI developer. What matters is data protection law, the company’s contracts, confidentiality and intellectual property. If the company has the right to share each source and personal data is removed or handled lawfully under UK GDPR, licensing is generally permitted.
This page sets out the main rules as of October 2026. It is general information, not legal advice for your company.
Does UK GDPR apply to company data?
Only to the personal data inside it. Company records usually include personal data, such as names, email addresses and messages written by staff or clients. Properly anonymised data falls outside UK GDPR. Pseudonymised data, where identifiers are replaced with tokens, can still be personal data, so it still needs a lawful basis and safeguards.
The main rules are UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. See what de-identification looks like in practice.
What lawful basis allows company data to be licensed?
Usually legitimate interests. The company must show it has a genuine interest, that licensing is necessary for it, and that the interest isn’t overridden by the rights of the people in the data. That balancing test is written up in a legitimate interests assessment, and a data protection impact assessment records the risks and safeguards.
We write both documents for each licence, specific to your data, and you keep copies.
Do staff and clients need to be told?
Often, yes. UK GDPR requires people to be told how their personal data is used, which usually means updating the company’s privacy notice before data is licensed. The wording depends on what is included and how it is de-identified. We draft the update for you as part of the process.
Can company data be sent to AI labs in the US?
Yes, with a valid transfer mechanism. Transfers to US companies certified under the UK–US data bridge can rely on it. Otherwise, the UK International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses, is used with a transfer risk assessment. Every licence also bans the buyer from re-identifying anyone.
What about contracts, confidentiality and copyright?
These are checked for every source. Client contracts often include confidentiality clauses, software and supplier terms can limit how data is used, and some content belongs to third parties. Material the company has no right to license is excluded and the exclusions are written into the agreement, so the licence only covers what the company owns or controls.
What safeguards make licensing lawful in practice?
A documented process applied to every licence: rights clearance, data minimisation, de-identification, a lawful basis with an LIA and DPIA, a safe transfer mechanism and contractual restrictions on the buyer. Each safeguard produces a document the company keeps, so it can answer the ICO, a client or a member of staff if asked.
| Rights clearance | Client contracts, supplier terms and staff policies checked for each source |
|---|---|
| Data minimisation | Only agreed sources and date ranges; HR files never included |
| De-identification | Identifiers removed or replaced with consistent tokens |
| Lawful basis | Legitimate interests assessment and DPIA |
| International transfer | UK–US data bridge or IDTA, with a transfer risk assessment |
| Buyer restrictions | No re-identification, use limited to training and evaluation, deletion terms |
Common questions
Is this the same as selling customer lists?
No. Selling customer contact details for marketing is a different activity with different rules. We don’t sell contact lists. Names and contact details are removed or replaced before any operational data is licensed.
Does the ICO need to approve a licence?
Not usually. There is no general approval process. A company only needs to consult the ICO before processing if its DPIA shows a high risk that it cannot reduce.
Is Sterling Data registered with the ICO?
Yes. Sterling Data is operated by Hetherington Projects, ICO registration C2062607.
Is this legal advice?
No. This page is general information as of October 2026. Each licence is assessed on its own facts.