AI Data Licensing UK: How It Works

The parties

The company that holds the records and grants the licence. For a company in insolvency, the office-holder acts for it.
The buyer: an AI developer, or a data company that supplies developers.
Advisers or platforms that sit between them. Some act for the seller, some for buyers, and some run marketplaces. Ask who they act for.

The licence terms that matter

Scope: which systems, teams and years are included.
Permitted use: for example, training and evaluating models, with no resale.
Exclusivity: some programmes are exclusive by default; Labelbox Prism says extra exclusivity is reflected in the price the buyer pays.
Term and deletion: when the licence ends, and a certificate that data was deleted.
Revocation: Prism describes a kill clause forcing deletion within 30 days in set circumstances. Deletion stops future use; it can't undo training already done.
No re-identification: the licence should bar it. Re-identifying de-identified data without consent can also be a criminal offence under section 171 of the Data Protection Act 2018.

How de-identification is tested

Names, email addresses, phone numbers and account numbers are replaced, ideally with consistent stand-ins so conversations still make sense. Then a motivated intruder test, described in the ICO's anonymisation guidance, checks whether a determined person using public sources could re-identify anyone. Doing this inside the company's own systems, before anything moves, keeps the originals under the company's control.

The UK law in brief

UK GDPR governs any personal data in the records, including the de-identification itself.
Article 8A, added by the Data (Use and Access) Act 2025, sets out how to assess whether a new use is compatible with the original purpose.
Transparency: people should be told about a new use before processing starts (Articles 13 and 14).
Sensitive categories, such as health data, are excluded in practice.

How buyers structure payment

Published programmes use three broad shapes: a single payment (Turing advertises up to $1m), an upfront fee plus a revenue share (Labelbox Prism), or payment on delivery of the cleaned data (Mercor says typically 2–4 weeks after signing). The exact terms are agreed in each contract.

Frequently asked questions

What's the difference between licensing and selling data?

A licence grants permission to use a copy for set purposes and a set term; the company keeps its records. An outright sale transfers ownership of the records and the rights in them. Most AI data deals are licences.

Is de-identified data still personal data?

It can be, depending on whether anyone could reasonably re-identify people from it. That's why the ICO describes testing with a motivated intruder test, and why licences bar re-identification.

Can a licence be cancelled?

Some licences include revocation and deletion clauses. Deletion stops future use, but a model already trained on the data can't be made to forget it, so decide exclusions before anything is shared.

Did the Data (Use and Access) Act 2025 change the rules?

It added Article 8A to UK GDPR, which sets out how to judge whether using data for a new purpose is compatible with why it was collected. A licence of old business records is a new purpose, so that assessment is part of the work.

Sell company data to AI →Who buys company data →Trust and privacy →Free estimate →

Sources

Figures are each buyer's own published wording, checked on 30 October 2026. Advertised ranges are not offers. Record Yield isn't affiliated with or endorsed by any of the companies named. This page is general information, not legal advice.

AI data licensing in the UK: how it works