How to sell your company's data to AI developers: a UK guide for 2026

Not long ago, a company's old emails and chat logs were a storage cost. In 2026 they are an asset. AI developers are paying companies for de-identified copies of their records, because those records show something the public internet cannot: how real work gets done.

This guide explains who is buying, what they want, how a deal works and what UK law requires. It is written for owners and directors of UK companies, whether the company is trading, winding down or closed. If you are an insolvency practitioner, read our guide for office-holders as well.

Why AI developers now pay for company records

AI models learned to write by reading public text. To do useful work, the next generation of models and AI agents needs to learn how tasks are actually done: how a quote is priced, how a design is revised, how a problem gets solved between colleagues over weeks. That knowledge sits inside company systems, not on the web.

Some buyers use records to build simulated workplaces, often called reinforcement learning environments, where AI agents practise real tasks. Nick Heiner of Surge AI, which builds these environments, told MIT Technology Review that one company's Slack history can be worth more than another company's Slack, email and calendars combined, if its conversations show enough variety and depth.

The money behind this is now large:

• On 9 October 2026, the AI data company micro1 committed to spend $1bn over 12 months buying and licensing company data, with Citi and Hercules Capital providing the capital.
• In August 2026, Google won a US bankruptcy auction for Spirit Airlines' corporate records with a $10m bid. The records included about 100 million emails, 500 million Microsoft Teams messages and about 30 million lines of code.
• SimpleClosure, a US firm that helps startups shut down, added data sales in April 2026. By October it had handled more than 150 deals, and 47% of its deals now include code or data sales.

Who is buying

Buyers fall into four groups:

1. AI labs that build large models.
2. Firms that build training environments for AI agents, such as Surge AI.
3. Large technology companies building their own models, as Google did with Spirit.
4. AI data companies that license data on to labs, such as micro1 and Mercor.

The UK is firmly on their radar. On its partnerships page, micro1 says demand is strongest in the US, the UK and Canada. It looks for companies with 30 or more employees, established documentation and records in English.

What buyers want, and what they leave out

Buyers want the everyday record of skilled people doing real work, step by step. More years and more systems usually mean a stronger offer.

Some records should stay out of every deal: HR and payroll files, health details, client personal data, legally privileged material and anything a contract says cannot be shared. Good buyers expect these exclusions. In the Spirit Airlines sale, passenger databases, booking and transaction records, refunds, inflight purchases and WiFi sales were all excluded from the deal ahead of the court hearing.

For a full breakdown of what moves the price, read what your company's data is worth to AI developers.

What a deal looks like

Most deals are licences, not sales. The buyer receives a de-identified copy of agreed records and uses it for agreed purposes. You keep your originals and your ownership. A typical deal runs like this:

1. Valuation from facts. A buyer or broker sizes the opportunity from basic facts: sector, headcount, years of records and the systems used. No files change hands at this stage.
2. Buyer review. Interested buyers look at a description of the records, and later a de-identified sample.
3. Written offer. The offer sets out the price, the scope, what the buyer may use the records for, any exclusivity and the payment schedule.
4. Contract. The contract fixes the exclusions, the de-identification standard, a promise not to re-identify anyone and what happens if the buyer passes the data on.
5. Export and delivery. The agreed copy is exported, de-identified and delivered.
6. Payment on the agreed schedule.

Prices vary widely. In the year to April 2026, SimpleClosure reported payouts of $10,000 to $100,000 per deal for closed startups. micro1 lists tiers from $100,000 for qualified partnerships to more than $1m for highly unique data. Our valuation guide sets out the reported prices and what drives them.

The UK rules

UK GDPR applies whenever records contain personal data, and almost every business record does: names in email headers, signatures, phone numbers. The rules changed recently. Most of the data protection changes in the Data (Use and Access) Act 2025 came into force on 5 February 2026, and the ICO updated its guidance on legitimate interests and on reusing personal data on 23 March 2026.

This section is general information, not legal advice. Take advice on your own case.

A lawful basis

For a commercial deal, the realistic lawful basis is legitimate interests. The ICO's guidance sets a three-part test:

1. Do you have a legitimate interest?
2. Is the processing necessary for that interest?
3. Do the interests and rights of the people in the records override it?

Write your answers down in a legitimate interests assessment. The 2025 Act added a list of "recognised" legitimate interests, but it covers areas such as crime prevention, safeguarding and emergencies. Licensing records to AI developers is not on it, so the full test still applies.

Using records for a new purpose

Your records were created to run the business, not to train AI. Using them for something new needs a compatibility assessment. Article 8A of UK GDPR sets five factors, and the ICO's March 2026 guidance explains them. As summarised by Freeths, they are:

• the link between the original purpose and the new one
• the context, including what people would reasonably expect
• the nature of the data, with extra care for sensitive data
• the likely consequences for the people involved
• the safeguards, such as pseudonymisation, encryption and access controls

The law lists some purposes that count as compatible automatically, such as preventing crime, safeguarding and meeting legal obligations. Licensing records to AI developers is not one of them. And compatibility alone is not enough: you still need a lawful basis.

Anonymisation is the core of the deal

The ICO's anonymisation guidance treats identifiability as a spectrum, from clearly personal to clearly anonymous. Four points matter most for a deal:

• The test is practical. Consider the means reasonably likely to be used to identify someone.
• Think like a "motivated intruder". Could someone determined to identify a person do it from the data?
• Pseudonymised data is still personal data. Swapping names for codes reduces risk, but UK GDPR still applies to the data.
• It depends on who holds it. The same data can be personal in one organisation's hands and anonymous in another's.

In practice, strong de-identification removes names, email addresses, phone numbers, account numbers and passwords, replaces them with consistent placeholders, and leaves out whole categories of sensitive records. You should see a de-identified sample before you sign. Spirit's flight attendants' union showed why this matters: it objected that keeping links between different types of data could let someone piece together anonymised information about its members.

Employees

Staff are the people most often named in business records. In the Spirit case, 119 US lawmakers asked for employee data to stay out of the deal until real safeguards were in place, citing medical information, disciplinary files and pay. The safest approach is simple: leave HR, health, disciplinary and pay records out completely, de-identify everything else, and, if the company is trading, tell staff in your privacy notice.

Sending records to US buyers

Many buyers are in the US. Personal data can go to a US organisation under the UK-US data bridge, in place since 12 October 2023, if the buyer is certified to the UK Extension of the EU-US Data Privacy Framework. Check the DPF List before any transfer. If the buyer is not certified, use the ICO's International Data Transfer Agreement or the UK Addendum instead.

The bridge depends on the EU-US Data Privacy Framework. The EU General Court upheld the framework on 3 September 2025, but an appeal to the Court of Justice is still pending. Write your contract so it can switch to the International Data Transfer Agreement if that changes.

Copyright and confidentiality

Under section 11 of the Copyright, Designs and Patents Act 1988, a company is normally the first owner of copyright in work its employees create in the course of their employment. Material written by people outside the company, such as clients and suppliers, is different. Its authors or their employers may own the copyright, and some of it will be covered by confidentiality terms.

Check your client contracts before you start, leave out anything they restrict, and ask each buyer how they handle third-party material. Law firms and other regulated professions should leave out privileged and client-confidential material entirely.

Timing: records have a shelf life

Value disappears when accounts close. When a Microsoft 365 business subscription ends, data stays available for a limited time before deletion. After cancellation, Microsoft says data might be deleted after 90 days and will be deleted no later than 180 days after. Other cloud services have their own deletion windows.

If your company is winding down, keep the accounts that hold your records alive until you know what they are worth. A company that is dissolved loses its property to the Crown, which our insolvency guide explains.

Step by step: how to sell your company's records

1. List what you have. The systems you use, how many years of history each holds, and how many people used them.
2. Keep the accounts alive. Do not cancel subscriptions that hold records you may license.
3. Get a valuation from facts. You should not need to hand over files to find out whether your records are worth something.
4. Check the buyers. Look for data transfer certification, security standards, a written de-identification standard, a no re-identification promise and a track record.
5. Do the paperwork. A legitimate interests assessment, a compatibility assessment and, where the risk is high, a data protection impact assessment. If you are trading, update your privacy notice.
6. Agree the terms in writing. Scope, exclusions, de-identification standard, sample review, permitted use, exclusivity, payment schedule and deletion.
7. Review a sample, sign, export and get paid.

TydeX runs this process for UK companies. We value your records from basic facts, present your company to vetted buyers, negotiate on your behalf and bring you written offers. You sign directly with the buyer you choose, and we never hold your records. Get a free valuation to see whether your company is a fit.