GDPR and AI training data: what companies need to know before licensing

When GDPR applies to AI training data

GDPR applies as soon as data relates to an identified or identifiable person. Company records are full of such data: names in emails, authors of tickets, people mentioned in chat threads. The question is therefore rarely whether GDPR applies, but how the data can be lawfully prepared so that, at the end, no personal data is licensed.

Legal basis: using data for a new purpose

Your records were collected for running the business, not for AI training. Using them for a new purpose requires either a compatibility assessment (Art. 6(4) GDPR) or a separate legal basis, typically legitimate interest (Art. 6(1)(f) GDPR) with a documented balancing of interests. Because anonymisation is itself processing of personal data, it needs this basis too.

In practice, the balancing of interests weighs the company's interest in licensing against the interests of the people in the data. Strong anonymisation, processing only in the EU, excluding sensitive sources and informing employees all tip the balance.

Anonymisation versus pseudonymisation

Consistent replacement, where the same person always becomes "Person A", is useful because relationships in the data survive. On its own, though, it is pseudonymisation. Anonymisation additionally requires generalising details that could single someone out (job titles, locations, dates, rare events), removing direct contact data and checking the result against re-identification risks. European data protection authorities describe these techniques in their guidance on anonymisation and pseudonymisation.

Customer data and data processing agreements

If you process data on behalf of customers (for example as a software provider or service company), you act as a processor under a data processing agreement. You may only use that data for your customers' purposes. It can't be licensed for AI training without their permission. Your own operational records, where you are the controller, are a different matter.

Employee data and the works council

Chat threads, emails and tickets often say something about how individual employees work. In Germany, the works council has co-determination rights over technical systems that can monitor behaviour or performance (Section 87(1) No. 6 Works Constitution Act). Where such data is used, a works agreement may be required. Involving the works council early, and excluding sensitive sources, makes the process faster and more robust.

Processing in the EU and transfers to non-EU labs

Many buyers are outside the EU. Raw data containing personal data should therefore be processed only in the EU. What leaves Europe should be the anonymised dataset only, which is no longer personal data and therefore not subject to GDPR transfer rules.

The EU AI Act: provenance for buyers

Providers of general-purpose AI models have to publish a sufficiently detailed summary of the content used for training (Art. 53(1)(d) AI Act). Buyers therefore want datasets with documented provenance and rights. Clean documentation of where data comes from and which rights were granted makes European data more attractive, not less.

Checklist before licensing

1. List the data sources and separate your own data from data processed for customers.
2. Document the legal basis and the balancing of interests for the new purpose.
3. Involve the works council where employee data is concerned.
4. Define what is excluded: sources, time periods, sensitive content.
5. Anonymise in the EU: replace, generalise, remove, then check the result.
6. Review a sample before anything is delivered.
7. Agree permitted uses and provenance documentation in the licence.

This guide gives a general overview and isn't legal advice. Whether a specific data source can be licensed is reviewed case by case. The eligibility check is a first step.