Can a UK company sell its data to AI companies?

Yes: a UK company can license its own records to an AI buyer, and buyers ask for UK companies by name, but UK GDPR decides how the people in those records are treated. The Data (Use and Access) Act 2025 did not create a shortcut for it: its new fast-track basis is limited to the conditions in Annex 1, and none of them is a commercial licence. The regulator's own reading is that a very different, unexpected new use means you're likely to need to ask for specific consent. So the records that sell leave de-identified, to the point where they are anonymous in the hands of the buyer. Sent to a US buyer, they go under the UK-US data bridge or a UK transfer agreement.

This guide is for founders, directors and advisers of a UK company, operating or closing, that has been asked about its data or wants to know what it is worth. It covers what the company can sell, what UK GDPR and the 2025 Act require, de-identification to the ICO's tests, sending records to a US buyer, what the company owns besides personal data, tax, who buys from the UK and the steps. It is research from public sources, not legal advice.

Contents

1. What the company can sell
2. The lawful basis after the 2025 Act
3. The research route, and why it rarely fits a sale
4. De-identification: the ICO's tests
5. Sending records to a buyer in the United States
6. What the company owns besides personal data
7. Tax on the licence fee
8. Who buys from the UK, and what they pay
9. A UK company that is closing or has closed
10. The steps
11. Questions people ask

What the company can sell

The company owns its working records: the email, chat and documents its staff wrote in the course of their work, its tickets, project files and code. Those are what buyers of company records pay for, because they show how the work was done. Three kinds of record need sorting first:

• Records about customers, contacts and staff. UK GDPR governs everything in the records that identifies a person, whoever they are. Personnel files, financial records about people and the special category files of Article 9 (health among them) are cut out whole, not scrubbed.
• Records that belong to someone else. Client files under contracts that give the work to the client, material the company received in confidence, and data it licensed from a supplier stay out unless that party agrees.
• Records the company built as a dataset. A corpus the company collected, checked and organised may carry a database right of its own (see below), which a working archive usually does not.

The lawful basis after the 2025 Act

The parts of the 2025 Act that matter for a sale (the meaning of research, the lawful bases, purpose limitation, telling people and the research safeguards) have applied since 5 February 2026, so a licence agreed now is judged under the new wording. Three of them decide most cases:

• Recognised legitimate interests do not cover it. The new basis applies only to the conditions in Annex 1: public-task requests, national security, emergencies, crime and safeguarding.
• The compatibility test now sits in Article 8A. Before records collected for one purpose are used for another, the company weighs any link between the original purpose and the new purpose, the context they were collected in, how sensitive they are and the consequences for the people. AI training is not an Annex 2 condition; a new purpose is also compatible where the data subject consents or as scientific research under Article 84B, and whether model training qualifies as research is untested.
• Ordinary legitimate interests still apply, with a necessity test. The ICO accepts commercial interests, but adds that if the same result can be reached in another less intrusive way, legitimate interests doesn't apply.

A buyer can be licensed de-identified records, which is the less intrusive way, so identifiable records rarely pass that test without consent. That settles it for most companies: the records are de-identified before any buyer sees them.

The research route, and why it rarely fits a sale

The 2025 Act widened "scientific research" to work whether publicly or privately funded and whether carried out as a commercial or non-commercial activity, including technological development. Whether training a commercial model counts has not been tested, and the route has conditions: the safeguards of Article 84B, and an exemption from telling people that applies only where providing the information is impossible or would involve a disproportionate effort. A company that holds its customers' email addresses will struggle to show that. The safeguards themselves list turning records into non-identifying form as a purpose, which points the same way as the rest of the law: de-identify first.

De-identification: the ICO's tests

The ICO treats identifiability as relative: the same information may be personal data for the company that keeps the originals and anonymous in the hands of other parties that cannot reasonably identify anyone. Its starting test is whether a motivated intruder with reasonable means could find a person again. And the anonymising step is itself processing, which the ICO says needs a lawful basis and a stated purpose but is likely to be fair and lawful. In practice a de-identified lot for an AI buyer:

• replaces the names of people and companies, addresses, phone numbers, account and customer numbers, consistently across the records so they still read as one company's work;
• cuts out whole the special category files (health among them) and the files about people's finances and employment;
• is checked by a person against the original before it leaves, with the method and the motivated intruder test written down.

Our de-identification standard sets out each step and what is removed.

Sending records to a buyer in the United States

Personal data can go to a US buyer without further paperwork only if the buyer is indicated on the Data Privacy Framework List as participating in the UK Extension. A buyer certified for EU data alone does not cover UK data. For any other US buyer, the company picks the International data transfer agreement (IDTA) or the Addendum to the EU clauses and completes a written transfer risk assessment; without either, only Article 49's narrow derogations remain, such as each person's explicit consent to the transfer. A lot that is properly de-identified before it leaves, and anonymous in the buyer's hands, avoids most of this.

What the company owns besides personal data

A licence is worth more when the company can say what it owns and what the buyer may not do:

• Copyright. The UK's text and data analysis exception is for the sole purpose of research for a non-commercial purpose, so copying the company's records in the UK for a commercial AI buyer needs a licence; copying done abroad answers to the law where it happens, which is why the licence's own terms on use and confidentiality carry the protection. The High Court in Getty Images v Stability AI did not decide whether training infringes.
• Database right. A database right exists where there has been a substantial investment in obtaining, verifying or presenting the contents. A company that built and cleaned a corpus can rely on it; one that only exported what its business produced may not.
• Confidentiality. Using a trade secret is unlawful where the acquisition, use or disclosure constitutes a breach of confidence, which is why the licence names the uses allowed and keeps the records confidential.

What a data licensing agreement contains covers the terms that carry these rights.

Tax on the licence fee

Under the US-UK treaty, royalties paid to a UK company shall be taxable only in that other State, so a US buyer withholds nothing once it holds the company's treaty form, provided the company qualifies for the treaty's benefits (its limitation-on-benefits article) and the fee counts as a royalty. US withholding tax on data licence payments explains the form. For VAT, a service to a business customer is supplied where the customer belongs, so a licence to a business outside the UK falls outside UK VAT. The company's own accountant confirms both for its case.

Who buys from the UK, and what they pay

Several buyers name the UK on their own pages:

• micro1 says its demand is strongest for companies based in the United States, United Kingdom, and Canada.
• Turing takes companies from most regions, with strongest demand in the US, UK, Canada, and the EU.
• Mode's programme takes companies based in the United States, Canada, United Kingdom, or Australia.

Prices for one company's records run wide, and buyers' own estimators offer a company in the UK, Canada or Europe 0.71 times what they offer the same company in the US; our valuation applies that. The smallest sale we take on is $23,000, the weighted average of what a small company's records have sold or been offered for on record. The buyer board lists every buyer we track with its rules and terms, and the United Kingdom page gathers what applies to a UK holder.

A UK company that is closing or has closed

An administrator or a liquidator can sell the company's records and signs for it: selling a UK company's data in administration or liquidation covers who signs and what UK GDPR still asks. After dissolution the records belong to the Crown, which may deal with them; the company's former directors can license them again only once it is restored. Software vendors delete a cancelled company's data on their own schedule (Microsoft within 180 days at most, Atlassian within 60 days), so a closing company exports first.

The steps

1. Export each system that holds the company's records, with its structure, before any subscription lapses.
2. Value it first. A free valuation from the company's own answers, or from exports measured on its own computer, says whether a sale is worth the preparation: value your data.
3. Sort what the company owns from client files, licensed data and personnel files.
4. De-identify to the ICO's tests, and keep the record of how, the motivated intruder test included.
5. Check the transfer route for each US buyer: the UK Extension list, or the IDTA or the Addendum with a risk assessment.
6. Describe it to every buyer whose rules fit at once, without naming the company, and license non-exclusively, for named uses, with the company as licensor.

When we run the sale, our fee is a share of what the buyer pays ( 12% of the first $250,000, 10% up to $1 million, 8% up to $3 million and 6% above $3 million), due only out of a completed sale: how a sale works.

Questions people ask

Is it legal for a UK company to sell customer data to an AI company? Not as identifiable records without a lawful basis, and the regulator reads a very different new use as likely to need specific consent. Records de-identified so that they are anonymous in the hands of the buyer are how such sales are made.

Did the Data (Use and Access) Act 2025 make it easier? Not by itself: its recognised legitimate interests are limited to the conditions in Annex 1, and AI training is not an Annex 2 condition. A new purpose is compatible where the data subject consents or as research under Article 84B. It widened research to commercial activity, but whether model training fits is untested.

Can the records go to a US buyer? Yes. Without further paperwork if the buyer participates in the UK Extension of the Data Privacy Framework, otherwise under the IDTA or the Addendum with a transfer risk assessment, or, narrowly, one of Article 49's derogations such as each person's explicit consent.

Can an AI company use our records without a licence under the UK's data mining exception? No, not for commercial training: the exception is for the sole purpose of research for a non-commercial purpose.

Is the licence fee taxed in the US? Under the treaty, royalties to a UK company are taxable only in that other State, the UK, once the buyer holds the company's treaty form.

What this means for you

A UK company's records can sell to AI buyers, and buyers ask for UK companies by name. What decides the sale is preparation: the company's own records sorted from everyone else's, people removed to the ICO's tests, and the right transfer route for each US buyer. The valuation is free, needs no upload, and tells you whether that work is worth doing.

Value your data, read how a sale works, or see the rights a sale rests on and UK GDPR beside the EU's rules.