At a glance
| Where cleaning happens (our approach) | Inside your own systems, before anything is copied |
|---|---|
| What a buyer receives | A tested, de-identified copy. No logins to your systems |
| Names and identifiers | Replaced with consistent stand-ins, so threads still read naturally |
| Left out entirely | HR and payroll, health, union, legally privileged and customer-confidential records |
| How it's tested | A motivated intruder test, as described in ICO guidance |
| Re-identification | Barred by the licence, and can be an offence (DPA 2018 s.171) |
What does "cleaning" company data mean?
Cleaning, or de-identification, means removing or replacing anything that identifies a person: names, email addresses, phone numbers, account numbers, and details that would let someone work out who is being discussed. Good cleaning keeps the structure of the work (who asked, what was decided, how it was resolved) while taking out who the people were.
The ICO is clear that pseudonymised data, where names are swapped for codes but could be linked back, is still personal data. Whether data counts as anonymous depends on how likely it is that someone could re-identify people from it, using means reasonably likely to be used. See why pseudonymised isn't anonymised.
Who cleans the data: the buyer or the seller?
There are two broad models in the market.
- Buyer-side cleaning. The buyer receives a raw copy, or connects to your systems with read-only access, and de-identifies the data on its own infrastructure. It's quick to start, because you do almost nothing.
- Seller-side cleaning. The data is de-identified inside your own environment, the result is tested, and only the cleaned copy is offered for licence. It takes more preparation, but your raw records never change hands.
We use the seller-side model. Both models can be done carefully. The difference is who holds identifiable personal data, and for how long.
Why does it matter where cleaning happens?
- Disclosure. Under buyer-side cleaning, identifiable personal data about your staff and customers is disclosed to another organisation. That disclosure needs its own lawful basis, transparency to the people concerned, and a contract governing it.
- Transfers abroad. Many AI buyers are based outside the UK. Sending identifiable personal data overseas brings in the UK GDPR's international transfer rules (Chapter V, starting at Article 44). A copy de-identified so that no one can reasonably be identified from it is no longer personal data in the buyer's hands, so those transfer rules don't apply to it. That's one reason testing matters.
- Control over exclusions. When you clean in-house, you decide what is left out and you can check it. When the buyer cleans, you rely on its process, and you usually can't see what it kept.
- What can't be undone. Once raw records have left, a deletion clause is a promise, not a guarantee. Data that never left can't leak from someone else's systems.
Is read-only access to our systems safe?
Read-only means the buyer can't change anything. It doesn't limit what the buyer can see. A read-only connection to email, chat or a ticketing system usually exposes everything in it, including HR conversations, health information and messages you'd never license. Access can also outlast the deal unless it's revoked.
If a buyer asks for access, ask exactly which systems, which accounts, for how long, what is logged, and what happens to anything copied. In our process, buyers don't get logins to a client's systems.
What is a motivated intruder test?
The ICO describes the motivated intruder as a person with no special access who wants to identify someone in the data, and who uses reasonably available resources: the internet, public records, and asking around. The test asks whether that person could identify anyone. It's run on a sample before the full copy is made, and repeated if the method changes.
What should the licence say?
- A ban on re-identifying anyone, or trying to. Re-identifying de-identified personal data without consent can also be a criminal offence under section 171 of the Data Protection Act 2018.
- Deletion at the end of the term, with confirmation.
- No onward sharing beyond the agreed purpose.
- The purposes allowed, such as training or evaluating models.
- What happens if the buyer finds personal data that should have been removed.
What should you ask any buyer or intermediary?
- Where will the data be de-identified, and by whom?
- Will you ever need access to our systems? If so, which, and for how long?
- What is excluded, and how is that checked?
- How is re-identification risk tested, and can we see the result?
- Where will the data be stored, and in which country?
- What does the licence say about re-identification, deletion and onward sharing?
Frequently asked questions
Is buyer-side de-identification illegal?
Not in itself. It means identifiable personal data is disclosed to the buyer, so that disclosure needs a lawful basis, transparency to the people concerned, a proper contract and, if the buyer is abroad, a lawful transfer mechanism. Seller-side cleaning avoids handing over identifiable data in the first place.
Is de-identified data the same as anonymous data?
Not necessarily. Data is only anonymous if people can't reasonably be identified from it. Pseudonymised data, where identifiers are replaced but could be linked back, is still personal data under UK GDPR. That's why the result is tested.
Who does the cleaning in your process?
It runs inside the client's own environment, and only a tested, de-identified copy is offered to buyers. We coordinate the work and don't hold copies of the raw records.
What gets left out completely?
HR and payroll files, health and union information, legally privileged material and customer-confidential records are excluded by default, before de-identification starts.
Related
Sources
- ICO, Anonymisation guidance
- ICO, Pseudonymisation (anonymisation guidance, chapter 3)
- UK GDPR, Article 44 (general principle for transfers)
- UK GDPR, Article 8A (purpose compatibility)
- UK GDPR, Article 13 (information to be provided)
- UK GDPR, Article 14 (information where data not obtained from the data subject)
- Data Protection Act 2018, section 171
Last reviewed 30 Oct 2026 by Record Yield. Provider terms and legislation were read on that date and can change. This page is general information, not legal advice.