Laws and data licensing
UK GDPR and AI data licensing
Short answer
Records about people in the UK need a lawful basis to reuse. Truly anonymized data falls outside the law; pseudonymized data does not.
In short
- Law
- UK GDPR
- Jurisdiction
- United Kingdom
- Applies to
- The UK's general data protection law, alongside the Data Protection Act 2018.
- Last reviewed
- 2026-10-09
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
What it covers#
United Kingdom. The UK's general data protection law, alongside the Data Protection Act 2018.
Key points for licensing#
- Anonymization must make re-identification not reasonably likely
- Purpose limitation applies to reuse
- International transfers need safeguards
How SourceX handles it#
- Personal details are removed before anything is shared
- Rules that apply are assessed deal by deal with your counsel
- Records that can't be cleared are excluded
- Your company approves every release
What did the Data (Use and Access) Act 2025 change in UK GDPR?#
The Data (Use and Access) Act 2025 amended UK GDPR and the Data Protection Act 2018 rather than replacing them. Commencement regulations brought the research and recognised legitimate interests provisions into force on 5 February 2026; check the current commencement position for the transfer provisions before relying on them.
The table maps the changes most relevant to a company weighing whether records about people in the UK can be reused or licensed.
| Change | What the Act does | Why it matters for reuse or licensing |
|---|---|---|
| Scientific research definition | Research that can reasonably be described as scientific counts whether it is publicly or privately funded and whether it is commercial or non-commercial | Commercial research is not excluded by label, but the activity still has to be genuinely scientific |
| Broad consent for research | Researchers can ask for consent to a broad area of study instead of a fixed purpose, consistent with recognised ethical standards | Helps research programs; it does not convert old consents for other purposes into consent for licensing |
| Recognised legitimate interests | A new Article 6 basis for a short list of purposes such as crime prevention, safeguarding, emergencies and national security, set out in Annex 1 | Removes the balancing test only for those listed purposes; commercial data licensing is not on the list |
| International transfer test | Transfers under appropriate safeguards need protection that is not materially lower than UK law, judged reasonably and proportionately | Earlier transfer risk assessments can carry over if they concluded protection was sufficient |
| Transfer terminology | Adequacy regulations become transfers approved by regulations; other mechanisms become transfers subject to appropriate safeguards | Contracts and data maps that use the old terms are worth updating |
Does the new research definition or broad consent cover licensing records for AI training?#
Not automatically. The broader definition means a commercial project can count as scientific research, with the UK government giving a pharmaceutical company's vaccine research as an example, but ordinary model training for a product, or a sale of records to a third party, is not research simply because it is commercial or uses statistics.
Broad consent is also narrower than it sounds. It applies to consent collected for an area of scientific study under recognised ethical standards, not to customer, employee or support records collected for running the business. For those records the research route is unlikely to fit, so the lawful basis for the new use has to be settled separately. Counsel should confirm whether a specific project fits the research provisions before anyone relies on them.
Do recognised legitimate interests let a company license UK records?#
No. Recognised legitimate interests cover a fixed list of public-interest purposes, such as crime prevention, safeguarding vulnerable people, responding to emergencies and national security. For those purposes the detailed balancing assessment is removed, though the processing must still be necessary. The list sits in Annex 1 and the Secretary of State can amend it by regulation, so check the current text before relying on it.
Licensing business records to an AI developer is not on the list. A company that relies on legitimate interests for that use still needs the ordinary three-part assessment of purpose, necessity and balancing, documented before the data is shared, or another lawful basis.
What changed for sending UK records to a buyer outside the UK?#
The transfer test was reworded. When a UK company sends personal data abroad under appropriate safeguards, it must decide, acting reasonably and proportionately, that protection after the transfer will be not materially lower than under UK GDPR and the Data Protection Act 2018. The ICO calls this the data protection test and says it is what was previously called a transfer risk assessment; an assessment completed under the earlier guidance still counts if it concluded protection was sufficient.
SourceX can consider companies in the UK when the data they offer is at least 90% English, confirmed on the actual dataset; every dataset still goes through rights, privacy, quality and buyer-fit review.
- Confirm whether the destination is covered by transfers approved by regulations or needs appropriate safeguards
- If safeguards are needed, record the data protection test and the reasons it is met
- Check that older transfer assessments concluded protection was sufficient before reusing them
- Update contracts and data maps that still use the old terminology
Sources for this section
- The UK government's guidance explains the Act's scientific research definition (including commercial research), broad consent for research, and the recognised legitimate interests basis. Source
- Commencement regulations brought the research and recognised legitimate interests provisions into force on 5 February 2026. Source
- The ICO's summary of the Act's schedules describes the not materially lower transfer standard and the renamed transfer routes. Source
- The ICO explains the data protection test for transfers under appropriate safeguards and how earlier transfer risk assessments carry over. Source
Frequently asked questions
What does the UK GDPR cover?
United Kingdom. The UK's general data protection law, alongside the Data Protection Act 2018.
Does licensing company records to an AI developer fall under the UK GDPR?
Records about people in the UK need a lawful basis to reuse. Truly anonymized data falls outside the law; pseudonymized data does not.
What are the key points of the UK GDPR for data licensing?
Anonymization must make re-identification not reasonably likely. Purpose limitation applies to reuse. International transfers need safeguards.
General information, not legal advice. Laws change and their application depends on your facts. SourceX assesses which rules apply deal by deal with your counsel. Last reviewed 2026-10-09.