Data brokers and national security: what the UK government is asking
The UK has no legal definition of a data broker, but in 2025 the government asked whether hostile states could simply buy UK data on the open market.
What the call for evidence covered
- Published by DSIT; responses closed on 16 May 2025, with 41 questions in four parts.
- A working definition: "obtaining and trading or licensing data, data products and services to third parties".
- Risks named: state-linked actors, cyber criminals and organised crime buying data for surveillance, targeting or building AI.
- Concern that risks grow "when data is collected and aggregated at scale".
What it means for company data deals
No new rules have been proposed yet, and the call didn't single out de-identified data or AI buyers. But it asked what processes ensure data is only accessed by trusted actors. Brokers who already vet buyers will be ready for whatever comes next.
See how we vet buyers.
- National security is now part of the data-broking debate.
- Buyer vetting goes beyond checking the signing company.
- Avoid aggregating sensitive data at scale.
What could your company's records earn?
A free, nine-question estimate. No files, no logins.
More in Privacy & law
Personal data that must never leave: a checklist
Special category data, criminal records, children's data and more: what to exclude before any data deal.
The motivated intruder test, step by step
The ICO's benchmark for whether de-identified data is safe: a determined, competent person with no special access.
The Data (Use and Access) Act 2025: what changed for UK businesses
The UK's 2025 data law reforms, in brief: recognised legitimate interests, complaints duties and more.