# Can I license EU employee data to AI? > Want to sell EU employee data to AI? A license still needs a GDPR lawful basis, a compatible purpose, advance notice and any Article 88 national rules. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/can-i-sell-eu-employee-data-to-ai Published: 2026-08-04 Updated: 2026-10-14 ## The short answer The GDPR sets four checks: lawful basis, compatible purpose, notice of the new purpose, and national employee rules under Article 88. The EDPB says trained models cannot be considered anonymous in all cases. Fines reach EUR 20 million or 4% of turnover. Employee data in the EU falls under the same regulation as customer data. National employment law adds a second layer on top. That layer differs by country, and it is the one that catches people. ## Does the GDPR apply to my company? That is an [Article 3](https://gdpr-info.eu/art-3-gdpr/) question. The [GDPR](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) applies to processing done in the context of an EU establishment. It also reaches a company outside the EU that offers goods or services to people in the Union, or monitors their behaviour there. If you have staff in the EU, a lawyer should settle this. ## What does purpose compatibility ask? [Article 6(4)](https://gdpr-info.eu/art-6-gdpr/) lists five factors. They test whether a new purpose fits the one the data was collected for. - The link between the two purposes. - The context, and the relationship between the people and the controller. The controller is the company that decides how the data is used. - The nature of the data. - The possible consequences for the people. - The safeguards in place. Licensing workplace messages to an AI lab is far from running a payroll or a project. A lawyer has to judge whether it is compatible on your facts. ## What notice does the GDPR require before employee data is reused? [GDPR Article 14(4)](https://gdpr-info.eu/art-14-gdpr/) covers a controller that plans to use data for another purpose. It must tell the person about that purpose before it begins. [Article 13(3)](https://gdpr-info.eu/art-13-gdpr/) says the same for data collected from the person. ## What does Article 88 add? [Article 88(1)](https://gdpr-info.eu/art-88-gdpr/) lets member states set more specific rules for employee data, by law or by collective agreement. Article 88(2) says those rules must include suitable measures to protect dignity and fundamental rights. So a national law or collective agreement can add duties beyond the general text. ## What has the EDPB said about training AI on employee and other personal data? The European Data Protection Board adopted [Opinion 28/2024](https://www.edpb.europa.eu/system/files/2024-12/edpb_opinion_202428_ai-models_en.pdf). It says models trained on personal data cannot, in all cases, be considered anonymous. It also says that meeting transparency duties does not, by itself, show that people reasonably expect the processing. The opinion addresses AI models. Raw dataset licensing falls outside it, so it applies to an owner only by analogy. The [privacy policy page](/answers/do-i-need-to-update-my-privacy-policy-before-licensing-data-to-ai) covers notice in the US. The [rights check](/rights-check) asks whether GDPR or UK GDPR data subjects are in the records. Figure: steps Lawful basis, compatible purpose -> Notice of the new purpose -> National employee rules. The GDPR text puts these checks in front of an employee-data license, and national rules under Article 88 come on top. Talk to a privacy or commercial lawyer in your state before you sign. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Article 3](https://gdpr-info.eu/art-3-gdpr/) - [GDPR](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) - [Article 6(4)](https://gdpr-info.eu/art-6-gdpr/) - [GDPR Article 14(4)](https://gdpr-info.eu/art-14-gdpr/) - [Article 13(3)](https://gdpr-info.eu/art-13-gdpr/) - [Article 88(1)](https://gdpr-info.eu/art-88-gdpr/) - [Opinion 28/2024](https://www.edpb.europa.eu/system/files/2024-12/edpb_opinion_202428_ai-models_en.pdf)