GDPR and company data before AI licensing

Short answer

Every piece of personal data in the dataset either comes out, is made genuinely anonymous, or stays in with a lawful basis for the new purpose, prior information to the people concerned and, usually, a prior impact assessment. Anonymous data falls outside data protection law; pseudonymised data, where names are replaced by codes and the company keeps the key, does not. For most licences the sensible aim is anonymisation, tested against the means reasonably likely to be used to identify people, backed by a contractual ban on re-identification.

Where personal data hides in a company archive

Owners usually think of the customer list. In a technical or commercial archive personal data turns up in many more places: names and signatures in email threads and in the title blocks of drawings, crew and inspector names in survey and incident reports, call recordings and ticketing systems, free-text comments in quality files, author names in code comments and commit histories, timesheets, CCTV stills, and the metadata of almost every document. In pharmaceutical and health-related files there may be health data, which is a special category whose processing is prohibited unless one of the narrow exceptions in the GDPR applies.

The first task is therefore a survey, field by field and folder by folder, of what kind of personal data each source contains and whose it is: clients' staff, the company's own employees, patients, consumers, or the public.

Anonymous or pseudonymised: where the legal line runs

The GDPR does not apply to anonymous information, meaning information that does not relate to an identified or identifiable person, or data rendered anonymous so that the person is no longer identifiable. Data that has been pseudonymised but could still be attributed to a person with additional information remains personal data. Whether someone is identifiable is judged by all the means reasonably likely to be used, by the company or by anyone else, taking into account cost, time and the technology available.

Removing names and ID numbers is rarely enough. The European data protection authorities' long-standing guidance on anonymisation asks three questions: can one still single out an individual, link records about the same person across datasets, or infer information about them? A maintenance log with a technician's shift pattern, or a sales file with rare postcode and age combinations, can fail all three.

In September 2025 the Court of Justice, ruling under the parallel rules that apply to EU institutions, held that pseudonymised data is not necessarily personal data for a recipient who has no reasonable means of re-identifying people. The same judgment held that, for the controller's duty to inform people about the recipients of their data, identifiability is assessed at the time of collection and from the controller's point of view, so that the duty applied before the transfer, whatever the data became in the recipient's hands. For a company selling data, the practical reading is that pseudonymisation may help the buyer, but does not relieve the seller of its own obligations.

If personal data stays in the dataset

Licensing data to an AI developer is a new purpose, different from the one for which the data was collected. Unless the company has consent or a specific legal provision, it must assess whether the new purpose is compatible with the original one, taking into account the link between the two purposes, the context of collection and the relationship with the people concerned, the nature of the data (special categories weigh heavily), the possible consequences for them and the safeguards in place, such as encryption or pseudonymisation. Where the company relies on legitimate interests, it has to identify the interest, show that the disclosure is necessary for it, and balance it against the rights of the people concerned; their reasonable expectations at the time of collection carry real weight in that balance.

Before any further processing for a new purpose, the people concerned must be informed of that purpose. Where processing, in particular using new technologies, is likely to result in a high risk to people's rights and freedoms, a data protection impact assessment must be carried out before the processing starts. Licensing personal data for AI training will often meet that test.

Employee data deserves particular caution. Greek law allows employee data to be processed for the employment contract where this is strictly necessary for it, and consent given by an employee is judged in light of the dependency inherent in the employment relationship. HR files, performance records and internal communications are, in practice, material to exclude rather than to license.

What the EDPB said about AI models

In Opinion 28/2024, adopted on 17 December 2024, the European Data Protection Board considered AI models trained on personal data. Its main points matter to anyone supplying data to such models.

A model trained on personal data cannot in all cases be considered anonymous. It is anonymous only if the likelihood of extracting personal data from it, and of obtaining such data through queries, is insignificant.
Legitimate interest can be a legal basis for developing a model, but only after the three-step test, in which the reasonable expectations of the people concerned play a central part.
A company that deploys a model developed by someone else should check that the model was not developed by unlawfully processing personal data, looking among other things at the source of the data. That check reaches back, through the developer, to whoever supplied the training data.

A workable sequence

In practice the work runs in a fairly fixed order. The survey comes first. Then, source by source, a decision: exclude, anonymise, or keep with a documented legal basis. Anonymisation should be tested, not assumed; a re-identification attempt on a sample, by someone who did not do the cleaning, is a useful discipline. Where any personal data remains, the impact assessment and the updated privacy notices come before delivery, not after.

The contract then carries the remaining risk: a ban on any attempt to re-identify, a ban on linking the dataset with other data in order to identify people, deletion obligations, and audit rights. It should also state each party's role. A buyer that receives personal data and decides how to use it is usually a separate controller in its own right; where the parties decide purposes and means together, they are joint controllers and must allocate their responsibilities between them in a transparent way.

Questions clients ask

Is pseudonymised data enough if the buyer never sees the key?

It may reduce the buyer's exposure, but for the company that holds the key the data remains personal data, and its duties, including informing people about the disclosure, still apply. True anonymisation is the safer target for a licence.

Isn't the GDPR about to change?

The Commission proposed amendments to the GDPR as part of the ‘Digital Omnibus’ on 19 November 2025. As of 28 October 2026 the European Parliament's procedure file shows the proposal awaiting committee decision. It is not law; plan on the current text.

Do we need consent from every person in the dataset?

Not necessarily. Consent is one possible basis among several, and in an employment context it is rarely reliable. Removing or anonymising the personal data is often simpler than building a legal basis for it.

Sources

This page is general information, not legal advice; the answer in any real case depends on its facts and documents.

L+A advises Greek companies on data protection, data licensing and the regulation of artificial intelligence.

Send us your question

Tell us about your case. A lawyer of the firm will reply by email.

Your message goes only to the lawyers of the firm and is used only to reply to you. You may write in Greek or English.