For the board or COO of a company with hundreds of staff
Can a large company license its internal records to AI? The UK rules
Updated
Yes, with conditions: the company owns its records, but they are full of staff and customer personal data, and the UK GDPR asks for an impact assessment and notice to staff before that data is put to a new use.
Ask about my company's record 4 of the 8 vendors we read leave title to the data with the customer. Tell us which systems hold yours and what stage the company is at, and a person will reply about your own case.
In two lines
A large UK company can license records it owns, such as workflows, tickets and project histories, once the personal data in them is removed or the new use passes the UK GDPR's compatibility test. Records that hold staff health or trade union details, private messages, or a client's confidential material stay out.
Is training an AI a compatible new purpose?
Article 8A sets how that is decided: among other things, any link between the original purpose and the new one, the context of collection including the relationship between the person and the controller, and whether special categories of data are involved. Records gathered to run the business and then licensed to a model developer are tested against that list.
The impact assessment and telling staff
Where processing using new technologies is likely to result in a high risk to people's rights and freedoms, the controller carries out a data protection impact assessment before the processing. And where it intends to further process personal data for another purpose, it gives the people concerned information on that purpose before it does, subject to the article's exceptions.
Source: UK GDPR, data protection impact assessments
The notice duty for data collected from the person directly is in the article on information to be provided.
Which records stay out
HR files: the UK GDPR prohibits processing data revealing trade union membership, data concerning health and the other special categories unless one of its listed conditions applies. Private channels and direct messages. Anything a client gave you in confidence. And anything exported through a vendor whose terms keep or bar it, which the vendor terms page sets out.
What buyers publish on deal and company size
micro1 says payments typically range from $150K to over $2M, though its enterprise partnership posting asks for companies with 30 to 200 employees. Polyshares says deals typically land between $100K and $2M paid to the company, and Nyne's floor is 20+ full-time U.S. W-2 employees.
Source: Enterprise data buyers
Three routes for a large company
A trading company licenses a scoped, anonymised copy and keeps the records. A company that is closing sells through its directors only until a liquidator or administrator is appointed or a winding-up petition is presented; after that the office-holder sells, a liquidator's appointment ends the directors' powers, and if the court then winds the company up, a sale made after the petition is void unless the court validates it. After dissolution what it owned passes to the Crown. An adviser or a group's own counsel can introduce a subsidiary or a company it advises.
For the person who will take it to the board
"Our internal records may be licensable to AI buyers once personal data is dealt with. This page sets out the UK GDPR steps (impact assessment, notice to staff, the compatibility test), what buyers publish and what stays out. Worth a conversation?"
Start a conversation
Describe the company, the systems and how many years of records it holds in the form on the home page, and a person will reply.