Selling company data to AI companies from the United Kingdom

This guide covers UK law for a UK company licensing records to an AI buyer, usually based in the US. Our guide to UK GDPR, EU GDPR and CCPA explains anonymization and lawful basis in detail, and our guide to whether you can legally sell company data covers ownership, client contracts and processor status under UK law.

Which data protection law and regulator apply in the UK?

The UK GDPR and the Data Protection Act 2018 apply to personal data in records a UK company licenses, and the Information Commissioner's Office regulates them. The Data (Use and Access) Act 2025 amended both, and A&O Shearman reports that most of its UK GDPR changes, including those on international transfers, recognized legitimate interests and further processing, came into force on February 5, 2026.

Truly anonymous data falls outside the UK GDPR. The ICO's anonymization guidance tests whether identification is reasonably likely, using the motivated intruder test, and treats anonymizing personal data as processing in its own right. Most UK sellers anonymize or exclude personal data before licensing, for that reason.

What has the ICO said about AI training?

The ICO has said that AI training and deployment are distinct purposes with different risks, and that organizations must identify the purpose and a lawful basis for each processing operation before it starts. Its guidance on AI and data protection says it may be appropriate to choose different lawful bases for development and deployment.

The ICO accepts that legitimate interests can support AI development, depending on the circumstances, but expects a documented assessment of purpose, necessity and balancing. It warns that the mere possibility that some data might be useful for a prediction is not by itself sufficient to show that processing is necessary to build a model.

In March 2026 the ICO consulted on draft guidance on automated decision-making and profiling following the Data (Use and Access) Act. Check for updated ICO guidance before you rely on any summary, including this one.

Do you need consent to license employee and customer records?

You do not always need consent to license employee and customer records, but you do need a lawful basis under Article 6 of the UK GDPR for any personal data that remains. Most commercial sellers consider legitimate interests, which requires the purpose, necessity and balancing tests the ICO describes.

Transparency limits you too. Articles 13 and 14 require you to tell people about recipients and about any new purpose before further processing. The privacy notices in force when you collected staff and customer data are the starting point, and special category data such as health information needs an Article 9 condition as well.

Staff records raise employment questions beyond data protection. Employment contracts, staff privacy notices and any collective agreements can limit what you share. Our guide to telling staff and clients about a data license covers how UK sellers handle this.

You transfer personal data to a US buyer under the UK-US data bridge if the buyer is certified, or under the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses if it is not. The government's factsheet says that from October 12, 2023 UK businesses can transfer personal data to certified US organizations under Article 45 of the UK GDPR without further safeguards.

• The buyer must be certified to the EU-US Data Privacy Framework, publicly listed and signed up to the UK Extension, which you can check on dataprivacyframework.gov
• Only organizations under the jurisdiction of the US Federal Trade Commission or Department of Transportation can join, so banks, insurers and telecoms firms are excluded
• Special category data must be identified as sensitive when transferred, and HR data needs a certification that covers it
• If the buyer is not certified, use the IDTA or the UK Addendum, with a transfer risk assessment where needed

The Data (Use and Access) Act 2025 rewrote the test for safeguards. Schedule 7 says a transfer under appropriate safeguards must meet the data protection test, meaning protection would not be materially lower than in the UK. Data that is anonymous before it leaves the UK is not a restricted transfer, which is another reason sellers anonymize first.

Does UK copyright or database right affect a license?

UK copyright and database right affect a license in two ways: they decide what you own, and they explain why buyers pay for licenses. Ownership under section 11 of the Copyright, Designs and Patents Act 1988 and database right under the Copyright and Rights in Databases Regulations 1997 are covered in our guide to legal ownership.

Section 29A of the 1988 Act allows a person with lawful access to copy a work for computational analysis only for non-commercial research. It does not cover commercial AI training, which is why AI companies license UK content.

In its report under section 136 of the Data (Use and Access) Act, published on March 18, 2026, the government said that a broad copyright exception with opt-out is no longer its preferred way forward. It said it would gather more evidence and keep watching the licensing market. For sellers, the current position supports licensing as the route for commercial training.

Does a US buyer withhold tax on payments to a UK seller?

A US buyer must generally withhold 30% US tax on US-source royalties paid to a foreign seller, unless a tax treaty reduces the rate. IRS Publication 515 says the source of royalties for patents, copyrights and similar property is where the property is used, so a license for use in the US usually produces US-source income.

The UK-US tax treaty reduces that rate. IRS Tax Treaty Table 1 shows 0% for royalties paid to UK residents under Article 12(1). Publication 515 says an entity claims treaty benefits on Form W-8BEN-E and must meet any limitation on benefits article. Whether a data license payment is a royalty, a business profit or something else depends on the contract.

For UK VAT, HMRC's Notice 741A says the general rule for business-to-business services is that the supply is made where the customer belongs, so services supplied to a business customer outside the UK are outside the scope of UK VAT. HMRC expects you to hold commercial evidence that the customer is in business abroad. Take tax advice, and see our guide to tax on AI data license payments.

Which buyers accept sellers from the UK?

Several buyers in our directory accept UK sellers. micro1 says demand is strongest in the US, UK and Canada. Endless Data prioritizes companies in the US, UK and Canada. AWS Data Exchange lists the UK as an eligible jurisdiction for paid sellers, and requires a Know Your Customer check for UK bank accounts.

What are the UK rules at a glance?

Our vetting standard checks each of these points before a buyer sees a sample. For a view of likely buyers, a realistic range and the rights issues to clear first, request a free data valuation.