Information governance pack: licensing company data for AI training (UK)

The templates

Each is a Word document you can edit. Text in yellow brackets needs completing or confirming, and shaded guidance notes explain each section.

A suggested order of work

1. Ask micro1 first. Send the questions in the annex to the DPIA and wait for written answers. Much of the rest depends on them, especially who de-identifies the data, where, and who holds the key.
2. Agree a narrow first scope (04) and check your client contracts for confidentiality or data-use limits (06, part C).
3. Complete the compatibility and legitimate interests assessments (03 and 02).
4. Complete the DPIA and the transfer assessment (01 and 05).
5. Review micro1's contract against the checklist (06).
6. Tell people. Update notices, brief staff and run an objection window before export (07).
7. Test samples of the de-identified output (08).
8. Record the decision (09). If high risk remains after the measures, consult the ICO before going ahead.

Where the hard questions are

Sending the data to the US

Where the names are removed decides how much crosses the Atlantic. If micro1 de-identifies the data on its own systems, fully identifiable data leaves the UK first, and the key that links stand-ins back to real people stays in the US.

The safeguard. The UK-US data bridge only covers US companies certified to the Data Privacy Framework and its UK Extension. When I checked, micro1 Inc. didn't appear on that list. Data Privacy Framework list (US Department of Commerce), checked Nov 8, 2026 (opens in a new tab) So plan on the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard clauses, with a transfer risk assessment under the "not materially lower" test that has applied since 5 February 2026.

Why a fallback matters anyway. On 29 June 2026, the US Supreme Court ruled in Trump v Slaughter that the President can remove commissioners of the Federal Trade Commission, the body that enforces the framework, at will. NOYB, the group behind earlier successful challenges, has said it will challenge the EU-US framework at the EU's top court. Society for Computers and Law, Jul 2026, checked Nov 8, 2026 (opens in a new tab) The UK data bridge is a separate UK regulation and still in force, but the government can revoke it. Even with a certified recipient, have the IDTA agreed in advance.

The lower-risk option. Ask whether de-identification can run in the UK or EU, or in your own environment, with the key kept in the UK. Then only pseudonymised data crosses the Atlantic. For you it's still personal data, so treat it as a transfer, but the risk assessment becomes much simpler.

Questions to put to micro1 in writing:

1. Are you certified to the Data Privacy Framework and the UK Extension? If not, will you sign the IDTA or the UK Addendum?
2. Where does de-identification run, and on whose infrastructure?
3. Who holds the key, and when is it destroyed?
4. How long is the raw copy kept, and how is deletion confirmed?
5. Which labs receive the data, in which countries, and on what terms against re-identification and onward sharing?

Common questions from DPOs

Do we need a DPIA to license company data for AI training?

Almost certainly. It reuses large volumes of staff and customer communications for a purpose people wouldn't expect, involves new technology and sends data to the US. The pack's DPIA follows the ICO's sample structure and pre-fills the likely risks.

What lawful basis applies to licensing data for AI training?

Usually legitimate interests, with a legitimate interests assessment. The new recognised legitimate interests cover purposes such as security, crime prevention and safeguarding, not commercial licensing. Consent is rarely practical for years of past communications.

Is reusing work email for AI training a compatible purpose?

It has to be assessed source by source under Article 8A, looking at the link between purposes, the context, the nature of the data, the consequences and the safeguards. De-identification and an objection window help, but they don't decide it on their own.

Is de-identified data still personal data?

For your organisation, usually yes, because you hold the originals. For a recipient with no realistic means of re-identifying anyone, it may not be. Pseudonymisation vs anonymisation covers the ICO's approach and the 2025 EU court ruling.

Can we transfer the data to a US company?

Yes, with a valid safeguard. A recipient certified to the UK Extension to the EU-US Data Privacy Framework is covered by the UK-US data bridge, but micro1 Inc. didn't appear on that list when I checked. Use the IDTA or the UK Addendum, with a transfer risk assessment, and keep it as a fallback even for certified recipients. Template 05 covers both.

Is there a US or Canadian version?

Not yet. The pack is written for UK law. US and Canadian privacy law uses different tests, so the templates shouldn't be used there without adaptation.