GDPR and AI Training Data: What Companies Need to Know

When GDPR applies

GDPR applies to the processing of personal data, meaning any information relating to an identified or identifiable natural person. It covers organisations established in the EU, and also organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour. The UK has its own version, the UK GDPR, which is very similar.

In company data, personal data appears in more places than people expect: names and emails in tickets, author fields in commits, signatures in documents, voices in call recordings, and free-text notes about customers. If any of your data sources contain such information and GDPR applies to you, you need to think about it before sharing.

Your role matters too. For most of its own records, your company is the controller: it decides why and how the data is processed and carries primary responsibility for compliance. Where you hold data on behalf of business customers, for example as a software provider, you may be acting as their processor, in which case you can generally only use that data on their instructions. Data you hold as a processor is usually not yours to share for a new purpose without your customer's agreement, so it is often simplest to leave it out of scope.

Anonymous data falls outside GDPR

Recital 26 of the GDPR states that its principles do not apply to anonymous information, meaning information that does not relate to an identifiable person, or personal data rendered anonymous so that the person is no longer identifiable. To decide whether someone is identifiable, account should be taken of all the means reasonably likely to be used, considering factors such as cost, time and available technology.

The same recital makes clear that pseudonymized data, where identities could be restored using additional information, is still personal data. This distinction is central. Properly anonymized data can generally be shared without GDPR obligations attaching to it. Pseudonymized data cannot.

You still need a lawful basis to anonymize

Anonymizing personal data is itself a form of processing. That means you need a lawful basis under Article 6 to do it, and the processing must comply with the GDPR principles. The six lawful bases are consent, contract, legal obligation, vital interests, public task and legitimate interests.

For most businesses, the relevant basis will be legitimate interests or, less often, consent. Legitimate interests requires a balancing test: your interest must be legitimate, the processing necessary, and not overridden by the rights and interests of the individuals. You should also consider purpose limitation under Article 5: the data was collected for one purpose, and you need to assess whether the new purpose is compatible, taking into account the factors in Article 6(4), such as the link between purposes, the context, the nature of the data and the safeguards in place, including anonymization.

Special categories and higher-risk data

Article 9 sets stricter rules for special categories of personal data: health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic and biometric data, and data about sex life or sexual orientation. Processing these requires both an Article 6 basis and an Article 9 condition. Data about criminal convictions has its own rules under Article 10.

For high-risk processing, a Data Protection Impact Assessment under Article 35 may be required. If your data sources are likely to contain special category data, the simplest approach may be to exclude those sources or to apply especially careful anonymization and take specialist advice.

A practical GDPR checklist

Before sharing data that may contain personal information about people in the EU or UK, work through these points with your data protection officer or legal adviser.

• Map which data sources contain personal data and of whom
• Identify your lawful basis for anonymizing and sharing, and record your reasoning
• Assess compatibility with the original purpose of collection
• Check privacy notices and consider whether transparency obligations apply
• Exclude or treat special category data with particular care
• Consider whether a DPIA is needed
• If personal data will be processed by a partner before anonymization, put a processing agreement in place under Article 28
• If personal data will leave the EU or UK, address international transfer rules under Chapter V
• Make sure the agreement prohibits re-identification

How this fits into a data partnership

Momentra's process gives you room to address these questions before any data moves. Initial conversations require no data. An NDA covering confidentiality, permitted use, retention and security is signed before any sample is reviewed. The contract then governs scope, permitted use, transfer and processing, and professional anonymization with purpose-built tools detects and removes or replaces sensitive information before further use. You decide what is in scope, so sources that would be hard to handle under GDPR can be left out.

This guide is general information, not legal advice. GDPR compliance depends on your specific facts, and regulators' views on anonymization and AI continue to develop. Consult a qualified data protection lawyer before sharing personal data or data derived from it.