Laws and data licensing
United Kingdom: privacy laws and AI data licensing
Short answer
If your records include people in United Kingdom, the main rules are: UK GDPR and the Data Protection Act 2018.
In short
- Country
- United Kingdom
- Main privacy laws
- UK GDPR and the Data Protection Act 2018.
- Note
- Records about people in the UK need a lawful basis for reuse unless truly anonymized.
- Last reviewed
- 2026-10-09
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
What to know#
Records about people in the UK need a lawful basis for reuse unless truly anonymized.
For suppliers#
- SourceX works with businesses based in United Kingdom when at least 90% of their records are in English
- Records tied to other countries are reviewed against their rules or excluded
- Personal details are removed before anything is shared
What did the Data (Use and Access) Act 2025 change for reusing UK records?#
It kept the UK GDPR and the Data Protection Act 2018 in place but amended them, so the core rules on lawful basis, purpose limitation and transfers still apply with some new routes and tests. The Act received Royal Assent on 19 June 2025, and the government's commencement plan brought most of its data protection changes into force on 5 February 2026.
The changes that matter most when records about people in the UK might be licensed for AI work are below. None of them removes the need for a lawful basis to share personal data with another company.
| Change | What the law now says | What it means for licensing records |
|---|---|---|
| Reuse for a new purpose | Data collected on consent needs new consent or another lawful basis for a new purpose; a new annex lists reuses that can be treated as compatible | Check how each record set was originally collected before treating licensing as a compatible reuse |
| Scientific research | The definition covers commercial scientific research | A buyer's research use may qualify, but the supplier still needs its own basis to disclose the data |
| Recognised legitimate interests | A new lawful basis covers listed activities such as crime prevention, safeguarding and emergencies, without the detailed legitimate interests assessment | Licensing is not one of the listed examples, so a normal legitimate interests assessment still applies |
| International transfers | Adequacy decisions and transfer clauses use a test that data protection must not be materially lower than in the UK | Exporters still assess the destination before personal data leaves the UK |
| Regulator | The Information Commissioner was replaced by the Information Commission on 30 September 2026, and the organisation continues to be referred to as the ICO | Keep calling the regulator the ICO and check the date on any guidance you rely on |
When is UK data anonymous enough to fall outside the UK GDPR?#
When re-identification is not reasonably likely, taking into account all the means someone motivated to identify people could reasonably use. Pseudonymised data, such as records with names swapped for codes, remains personal data.
The ICO's guidance treats this as a judgment in context, not an absolute: the same information can be personal data for one organisation and anonymous in the hands of another, and the risk is never zero. These checks follow from that test:
- Run a motivated intruder test: could a determined person with public sources and the released fields identify someone?
- Judge identifiability from the recipient's position, including what other data the recipient could combine with the release.
- Keep any re-identification key with the original holder, never with the dataset.
- Record the reasoning and recheck it before each new delivery, since added fields or outside data can change the answer.
- Treat anything that fails these checks as personal data that still needs a lawful basis and, if it leaves the UK, a transfer tool.
Which transfer tool covers sending UK records to a U.S. recipient?#
It depends on the recipient: the UK-US data bridge covers only U.S. organisations certified to the UK Extension of the EU-U.S. Data Privacy Framework, and other recipients need a different safeguard, such as the IDTA or the UK Addendum backed by a transfer risk assessment. The bridge took effect on 12 October 2023; the IDTA and the Addendum came into force on 21 March 2022.
Only U.S. organisations under the jurisdiction of the Federal Trade Commission or the Department of Transportation can join the UK Extension, and they must also participate in the EU-U.S. framework, so a U.S. recipient outside those two regulators cannot be reached through the bridge.
SourceX can consider companies in the UK when the data they offer is at least 90% English, confirmed on the actual dataset; every dataset still goes through rights, privacy, quality and buyer-fit review.
| Route | When it fits | What the exporter must check |
|---|---|---|
| UK-US data bridge | The U.S. recipient is certified to the UK Extension and appears on the Data Privacy Framework List | Certification is current; genetic, biometric and sexual orientation data are flagged to the recipient as sensitive |
| International data transfer agreement (IDTA) | Any recipient outside the UK without another valid route, such as the bridge | A transfer risk assessment is completed and the mandatory Part 4 is included |
| UK Addendum to the EU standard contractual clauses | Companies already using the EU clauses for European data flows | The mandatory Part 2 is included and a transfer risk assessment is completed |
| Anonymised release | The data passes the anonymisation test from the recipient's side | The anonymisation reasoning is documented, because the personal data rules fall away only if the test holds |
Sources for this section
- The Data (Use and Access) Act 2025 adds a recognised legitimate interests basis for listed activities such as crime prevention and safeguarding, defines scientific research to include commercial research, and applies a not materially lower test to international transfers. Source
- The government's commencement plan brought most of the Act's data protection provisions into force on 5 February 2026. Source
- Personal data collected on consent needs new consent or another lawful basis for a new purpose, a new annex lists compatible reuses, and other reuse needs a compatibility assessment. Source
- The Information Commissioner was replaced by the Information Commission on 30 September 2026, and the organisation continues to be referred to as the ICO. Source
- Identifiability is judged against the means reasonably likely to be used by a motivated intruder, and pseudonymised data remains personal data. Source
- The risk of re-identification from anonymised data will never be zero, and the same information can be personal data to one organisation but anonymous in the hands of another. Source
- The IDTA and the UK Addendum came into force on 21 March 2022 and include mandatory parts (Part 4 of the IDTA, Part 2 of the Addendum); the page also describes the transfer risk assessment. Source
- The UK-US data bridge took effect on 12 October 2023 and covers only U.S. organisations certified to the UK Extension of the Data Privacy Framework, which requires FTC or DoT jurisdiction and participation in the EU-U.S. framework. Source
Frequently asked questions
Which privacy laws apply to records about people in United Kingdom?
UK GDPR and the Data Protection Act 2018. Records about people in the UK need a lawful basis for reuse unless truly anonymized.
Can a company based in United Kingdom license its data through SourceX?
Yes, when at least 90% of the company's records are in English. U.S. companies are SourceX's priority, records are reviewed against the rules that apply, and personal details are removed before anything is shared.
Can a U.S. business license records that include customers in United Kingdom?
Records tied to United Kingdom are reviewed against its rules or excluded from the license, and personal details are removed before anything is shared.
What happens to records that cannot be cleared?
Records that can't be cleared under the rules that apply are excluded, and the company approves every release before data moves.
General information, not legal advice. Laws change and their application depends on your facts. SourceX assesses which rules apply deal by deal with your counsel. Last reviewed 2026-10-09.