Laws and data licensing
EU GDPR and AI data licensing
Short answer
Reusing records about people in the EU needs a lawful basis and must fit the purpose they were collected for. Truly anonymized data falls outside GDPR; pseudonymized data, such as names swapped for codes, is still personal data.
In short
- Law
- EU GDPR
- Jurisdiction
- European Union
- Applies to
- The General Data Protection Regulation, the EU-wide law for personal data of people in the EU (and the EEA).
- Last reviewed
- 2026-10-09
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
What it covers#
European Union. The General Data Protection Regulation, the EU-wide law for personal data of people in the EU (and the EEA).
Key points for licensing#
- Lawful basis and purpose limitation apply to reuse
- Anonymization must make re-identification not reasonably likely
- Special categories (health, biometrics, union membership) need extra conditions
- Transfers outside the EU need safeguards such as standard contractual clauses
- Fines up to 4% of global annual turnover
How SourceX handles it#
- Personal details are removed before anything is shared
- Rules that apply are assessed deal by deal with your counsel
- Records that can't be cleared are excluded
- Your company approves every release
Which EU data privacy laws apply besides GDPR?#
GDPR is the main EU data privacy law, but it is not the only EU rule that touches business records reused for AI. The table lists the EU laws people usually mean when they search for EU or European data privacy laws, including the older directive that GDPR replaced.
Searches for the EU data privacy directive usually mean one of two texts: the 1995 Data Protection Directive, which GDPR replaced, or the 2002 ePrivacy Directive, which complements the data protection framework.
| Law | What it governs | Applies since | Why it matters for licensing records |
|---|---|---|---|
| GDPR, Regulation (EU) 2016/679 | Personal data of people in the EU and EEA | 25 May 2018 | Any reuse of records about people needs a lawful basis and a purpose check |
| Data Protection Directive 95/46/EC | Personal data, under the pre-2018 regime | Replaced by GDPR in 2018 | Older contracts and notices may still cite it; GDPR is the rule that now applies |
| ePrivacy Directive 2002/58/EC | Confidentiality and security of electronic communications | 2002 | Relevant when records include electronic communications such as calls or messages |
| Data Governance Act | Reuse of protected public sector data and data intermediation services | September 2023 | Sets neutrality rules for intermediaries that connect data holders with data users |
| Data Act, Regulation (EU) 2023/2854 | Data generated by connected products and related services | 12 September 2025 | Users of connected products gain access and sharing rights over device data |
| AI Act, general-purpose AI rules | Duties of providers of general-purpose AI models | 2 August 2025 | Model providers must publish a training content summary, which makes documented data sources useful |
How does GDPR apply to AI models?#
GDPR applies when personal data is used to develop or deploy an AI model, and a trained model is not automatically anonymous. In Opinion 28/2024, adopted in December 2024, the European Data Protection Board said data protection authorities should judge model anonymity case by case.
For a model to count as anonymous, the EDPB said it should be very unlikely both that individuals whose data was used to create it can be identified, directly or indirectly, and that their personal data can be extracted from the model through queries.
Where a developer relies on legitimate interest as the legal basis, the opinion recalls a three-step test: identify the legitimate interest, show the processing is necessary for it, and confirm the interest is not overridden by the rights and freedoms of the people in the data.
Can records collected for one purpose be reused for AI training?#
Sometimes, but only after a compatibility check under GDPR's purpose limitation principle. The European Commission's guidance says the check is made case by case and weighs five factors; if the new purpose is not compatible, a new legal basis is needed, which may involve requesting consent.
Further processing for scientific research or statistics is presumed compatible, but appropriate safeguards are still required. The table turns the five factors into questions a records owner can answer before any licensing discussion; the examples are illustrative.
| Factor | Question to answer | Illustrative example |
|---|---|---|
| Link between purposes | How close is AI training to why the records were collected? | Support tickets collected to resolve issues, now used to train a support model |
| Context of collection | What did people reasonably expect, given their relationship with the company? | Business customers versus individual consumers in a CRM |
| Nature of the data | Does the set include sensitive or special category data? | Free-text notes that mention health conditions |
| Consequences for individuals | What could happen to the people in the records? | Risk of a person being recognized from a rare job title and city |
| Safeguards | Which protections reduce that risk? | Pseudonymization or encryption before any further processing |
What GDPR governance records should exist before data is shared?#
Good GDPR data governance means the paperwork for a reuse exists before any record leaves the company. Two documents are central: the record of processing activities and, where the processing is likely to result in a high risk to people, a data protection impact assessment.
- Record of processing activities: kept in writing, including electronically, and available to the data protection authority on request; it describes purposes, data categories, recipients and transfers outside the EEA
- Data protection impact assessment: required where processing is likely to result in a high risk, and at least for large-scale sensitive data, systematic and extensive profiling, or large-scale monitoring of public areas
- Prior consultation: if residual high risk remains after safeguards, the data protection authority is consulted before processing starts
- Written compatibility assessment covering the five purpose factors above
- Legitimate interest assessment, if that is the legal basis, following the three steps the EDPB describes
- Anonymization assessment showing why re-identification and extraction are unlikely, if the data is meant to fall outside GDPR
- General information only: counsel reviews the specific facts before any release
Sources for this section
- GDPR (Regulation (EU) 2016/679) has applied since 25 May 2018 and repealed Directive 95/46/EC. Source
- GDPR replaced the 1995 Data Protection Directive. Source
- The ePrivacy Directive 2002/58/EC sets rules on the confidentiality and security of electronic communications and complements the data protection framework. Source
- The Data Governance Act has applied since September 2023 and covers reuse of protected public sector data and neutral data intermediation services. Source
- The Data Act has applied since 12 September 2025 and gives users of connected products rights to access and share the data those products generate. Source
- Obligations for providers of general-purpose AI models, including a public summary of training content, have applied since 2 August 2025. Source
- EDPB Opinion 28/2024 says model anonymity is assessed case by case and recalls the three-step legitimate interest test. Source
- The European Commission explains the case-by-case compatibility test for reusing personal data for a new purpose. Source
- The European Commission lists when a data protection impact assessment is required. Source
- The EDPB SME guide explains that records of processing must be kept in writing and made available to the data protection authority on request. Source
Frequently asked questions
What does the EU GDPR cover?
European Union. The General Data Protection Regulation, the EU-wide law for personal data of people in the EU (and the EEA).
Does licensing company records to an AI developer fall under the EU GDPR?
Reusing records about people in the EU needs a lawful basis and must fit the purpose they were collected for. Truly anonymized data falls outside GDPR; pseudonymized data, such as names swapped for codes, is still personal data.
What are the key points of the EU GDPR for data licensing?
Lawful basis and purpose limitation apply to reuse. Anonymization must make re-identification not reasonably likely. Special categories (health, biometrics, union membership) need extra conditions. Transfers outside the EU need safeguards such as standard contractual clauses. Fines up to 4% of global annual turnover.
General information, not legal advice. Laws change and their application depends on your facts. SourceX assesses which rules apply deal by deal with your counsel. Last reviewed 2026-10-09.