Glossary of company data licensing terms

Research

The terms you will meet when licensing company records, in plain English.

Search terms

Administration

An insolvency procedure in which a licensed insolvency practitioner, the administrator, takes control of a company with the aim of rescuing it as a going concern, getting a better result for its creditors than an immediate liquidation would, or realising property to pay secured or preferential creditors. The procedure is in Schedule B1 to the Insolvency Act 1986, and the administrator's specific powers are listed in Schedule 1.

Source: Insolvency Act 1986, Schedule B1

Anonymisation

Turning personal data into information that can no longer be linked to an identifiable person, taking into account the means reasonably likely to be used to identify someone. Data that is truly anonymous is outside UK GDPR.

Source: ICO guidance: how do we ensure anonymisation is effective?

Bona vacantia

When a UK company is dissolved, anything it still owns, including copyright in its records, passes to the Crown as bona vacantia, meaning ownerless property (in some areas, it passes to the Duchy of Lancaster or the Duchy of Cornwall). Property the company held on trust for someone else is not included. The company can get its property back by being restored, if the Crown has not already sold it, or the Crown may agree to sell it.

Source: Bona vacantia: dissolved companies (BVC1, Government Legal Department)

Compatibility assessment

A check under Article 8A of UK GDPR on whether personal data collected for one purpose can be used for a new one. It takes into account any link between the purposes, the context in which the data was collected (including the relationship with the people it is about), the nature of the processing, the possible consequences for those people and the safeguards in place.

Controller

The organisation that decides why and how personal data is used. A company that licenses its records is a controller of the personal data in them, and is responsible for having a lawful basis and the right safeguards before it shares them. A buyer that decides how it uses the data is usually a controller too.

Creditors' voluntary liquidation

A liquidation of an insolvent company started by its directors and shareholders. A licensed insolvency practitioner is appointed as liquidator to realise the company's assets for its creditors. Often shortened to CVL.

Data (Use and Access) Act 2025

UK law that changed parts of UK GDPR, the Data Protection Act 2018 and the electronic marketing rules. Most of its data protection changes came into force on 5 February 2026.

Data protection impact assessment

A documented assessment of the risks of a use of personal data and how they will be reduced. UK GDPR requires one where the processing is likely to result in a high risk to people. Often shortened to DPIA.

De-identification

Removing or replacing names, contact details, account numbers and other identifiers in records before anyone else sees them. Depending on how thorough it is, the result may be pseudonymised data or anonymous data.

See also: Anonymisation · Pseudonymisation

Dissolution

The end of a company's legal existence, when it is removed from the Companies House register. Anything the company still owns on that day passes to the Crown as bona vacantia (in some areas, to the Duchy of Lancaster or the Duchy of Cornwall).

Exclusive licence

A licence that stops the owner from licensing the same records to anyone else for its term. Under UK copyright law, an exclusive licence can also exclude the owner's own use, so check the wording. Because it rules out other buyers, an exclusive licence should cost the buyer more.

International Data Transfer Agreement

The ICO's standard contract for sending personal data from the UK to a country without UK adequacy regulations. Often shortened to IDTA.

Legitimate interests

One of the six lawful bases for using personal data, and one that commercial uses often rely on. The ICO sets a three-part test: is there a legitimate interest, is the processing necessary for it, and do the interests and rights of the people involved override it?

Source: ICO guidance: legitimate interests

Legitimate interests assessment

A written record of how you applied the three-part legitimate interests test to a particular use of personal data. Often shortened to LIA.

Licence

Permission to use a copy of records for agreed purposes, on agreed terms, while the owner keeps ownership. Many deals for company records are licences rather than sales.

Liquidation

The process of closing a company in which a liquidator realises its assets and pays them out to creditors, and then to shareholders if anything is left. The company is dissolved at the end.

Source: Insolvency Act 1986, Schedule 4

Members' voluntary liquidation

A liquidation of a solvent company, usually chosen when its owners want to close it and take out what is left. The directors make a statutory declaration that the company can pay its debts in full, with interest, within 12 months. A licensed insolvency practitioner is appointed as liquidator, pays the creditors and distributes what is left to the shareholders. Often shortened to MVL.

Motivated intruder test

A test the ICO uses to judge anonymisation: could a reasonably competent person, determined to identify someone, do it from the data using means reasonably available to them? For high-value data, such as confidential files and financial records, the ICO says to assume an intruder may use specialist knowledge or equipment.

Non-exclusive licence

A licence that leaves the owner free to license the same records to other buyers. It usually earns less per licence than an exclusive one, but can be repeated.

Office-holder

An insolvency practitioner, or the official receiver, appointed to a company as administrator, liquidator or a similar role. While in office, they control the company's property and decide whether to sell or license it.

PECR

The Privacy and Electronic Communications Regulations 2003. They set UK rules on electronic marketing, such as emails and texts, and on cookies and similar storage on people's devices.

Personal data

Any information relating to an identified or identifiable living person. Almost every business record contains some, such as names in email headers, signatures and phone numbers.

Pseudonymisation

Replacing names and other identifiers with codes or placeholders, while the information needed to reverse it is kept separately. Pseudonymised data is still personal data under UK GDPR.

Reinforcement learning environment

A simulated workplace where AI agents practise real tasks and learn from the results. Some buyers use company records to build these environments.

Source: AI labs are buying data from dead startups to train their models (MIT Technology Review)

Restoration

Bringing a dissolved company back onto the register, so that its property belongs to it again. If the Crown has already sold the property, the company gets the sale price instead. Companies House can restore some companies it struck off itself; otherwise the court can, and applications must usually be made within six years of dissolution.

Sample review

Seeing a de-identified sample of what a buyer would receive before you agree to a deal, so you can check the de-identification and the scope.

Secret commission

A payment or other benefit that an agent receives from the other side of a deal without its client's fully informed consent. Under English law, an agent that owes its client a duty of loyalty must disclose such a payment in full and obtain the client's informed consent. If it does not, the agent holds the payment on trust for the client (FHR European Ventures v Cedar Capital Partners [2014] UKSC 45), and the payer can also be liable to the client for it (Hopcraft v Close Brothers [2025] UKSC 33).

Special category data

Personal data that UK GDPR protects more strictly, such as health, ethnic origin, religious beliefs, sexual orientation and trade union membership. It should be left out of any licence of company records.

Strike-off

Removing a company from the Companies House register, after which it is dissolved. A company's directors can apply for a voluntary strike-off if, among other conditions, it has not traded or sold off any stock in the last 3 months and is not threatened with liquidation.

Source: Strike off your limited company from the Companies Register (GOV.UK)

Training data

The data an AI model learns from. Company records are valuable training data because they show how skilled people actually do their work, which public text on the internet rarely does.

UK-US data bridge

The UK extension to the EU-US Data Privacy Framework, in place since 12 October 2023. It lets personal data go from the UK to US organisations certified to the UK Extension without a separate transfer agreement.

Source: UK-US data bridge: factsheet for UK organisations (GOV.UK)