GDPR and company data for AI training
The short answer
Article 4 covers any information about an identifiable person, and work emails and customer contacts hold it. The EDPB describes a three-step test for a buyer citing legitimate interest, and says a model trained on personal data may not be anonymous. Ask counsel how it reaches your archive.
The GDPR says nothing about company archives or AI licensing. The opinion here is Opinion 28/2024 of the European Data Protection Board (EDPB). Below is what the text and the opinion say, and what a buyer is likely to ask.
In plain words
Personal data is any fact about a person you could identify.
Think of it like this
Think of your archive as an attic. Some boxes hold your own things. Others hold letters from other people. The GDPR cares about the letters.
Does the GDPR apply to company data?
It applies to the personal data inside. A price list is outside the regulation. A thread between named colleagues and customers is inside it. Article 4(1) says personal data is "any information relating to an identified or identifiable natural person."
Territory is a separate question under Article 3. The rules reach a company with an EU establishment. They also reach a company outside the EU that sells to people in the Union or monitors their behaviour there. Counsel settles it for any company with EU staff, customers or an EU establishment.
What legal basis could cover an AI license?
Article 6 lists the legal bases. The EDPB opinion recalls that no basis ranks above another. For legitimate interest, it describes a three-step test. Name the interest. Test whether the processing is necessary for it. Balance it against the rights of the people involved.
Reasonable expectations count in that balance. The opinion lists the relationship with the person, the context of collection and the source of the data as factors. It also says meeting transparency duties is not enough on its own to show people expect the processing.
What does the opinion say about buyers of data or models?
The opinion looks at one case. A different controller deploys a model that retains personal data. Regulators should check whether that controller made an appropriate assessment that the model was not built by unlawfully processing personal data. The assessment covers the source of the data and any finding of infringement.
The opinion addresses AI models and not raw dataset licensing, so it applies to an owner by analogy. A buyer in a similar spot has reason to ask where the data came from and on what basis. Our reps and warranties page shows how public terms for owners phrase it.
When is the data anonymous?
For a model to count as anonymous, the opinion says two chances should both be insignificant. One is the chance of pulling out personal data directly. The other is the chance of getting it from queries. The test counts all the means reasonably likely to be used.
That test is written for models. For a dataset, our pseudonymization page covers the UK ICO's position that pseudonymised data stays personal data for anyone holding the additional information.
What about employee records and next steps?
Employee records add national rules, covered on our EU employee data page. Run the rights check, which asks whether GDPR or UK GDPR data subjects are in the records. Read the risks page before a buyer call.
Have a lawyer read any contract before you sign. They like that.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
