Step 1: confirm you have the right
Start with ownership. Records your company created in the course of its own work are usually licensable. Records you hold for clients, supplier drawings under NDA, and content licensed from others usually aren’t without consent. Review customer contracts, NDAs, employment terms and software licences for clauses on data use.
Step 2: deal with personal information
| Jurisdiction | Key point | Source |
|---|---|---|
| EU / UK (GDPR) | Pseudonymised data remains personal data; truly anonymous data is outside the GDPR. Regulators set a high bar for anonymity in AI models. | Recital 26; EDPB Opinion 28/2024 |
| Japan (APPI) | Pseudonymously processed information generally can’t go to third parties; anonymously processed information can, with public disclosure of categories and method. | DLA Piper |
| Hong Kong (PDPO) | Using personal data for a new purpose needs prescribed consent; the regulator treats selling data as a new purpose. | PCPD, DPP3 |
| Taiwan (PDPA) | Use beyond the original purpose needs a legal basis or consent; de-identification standards are less precise. | Commentary |
| Mainland China (PIPL) | Anonymised information is excluded from personal information; cross-border transfers trigger consent and assessment duties. | Jones Day |
| Singapore (PDPA) | The PDPC’s 2024 guidelines cover consent, exceptions and anonymisation in AI systems. | PDPC |
This is general information, not legal advice. Take advice from a lawyer in your jurisdiction before you sign.
Step 3: plan de-identification
Decide who removes personal information, when, and to what standard. Practices differ: Google required Spirit Airlines’ records to be scrubbed of personal information; other buyers say they remove or transform it themselves after transfer. If raw personal data leaving your company is a problem under your law, require de-identification before anything is delivered.
Step 4: write down the scope
- Systems, teams and date ranges included.
- Customers, projects, people or record types excluded.
- The format and volume of the copy.
- Who extracts it, and where it is processed.
Step 5: line up internal approval
Identify who can authorize a licence: owners, directors, and sometimes a parent company or lender. Brief IT and whoever manages customer contracts. In the Calto Data check we ask whether your business can authorize use of its records, so we can flag permissions early.
Frequently asked questions
Do we have to anonymise data before licensing it?
Not always by law, but it is the safest approach. Where personal data stays in, you need a lawful basis and often consent, depending on the jurisdiction.
Is pseudonymised data enough under GDPR?
No. Pseudonymised data is still personal data under the GDPR. Only data that can no longer identify a person falls outside it.
Can a Japanese company license data to a US AI company?
Yes, but personal information must be handled under the APPI, including its rules on third-party and cross-border provision. Anonymously processed information has lighter rules.
Do we need customer consent?
If the records contain customers’ personal or confidential information, usually yes, unless it is removed or your contracts already allow the use.