Licensing company data to AI: the law in 9 countries
In every country here, truly anonymised data falls outside privacy law, but pseudonymised data usually does not, and each sets its own bar. The EU and UK ask what means are reasonably likely to be used to identify someone; Canada and Singapore ask whether there is a serious possibility of re-identification; Japan has a formal anonymous-processing route.
At a glance
| Country | Main law | The test | Worth knowing |
|---|---|---|---|
| United States | State privacy laws (California first) | Reasonable measures, a public commitment not to re-identify, and contracts binding recipients | California covers employees; most states don't |
| European Union | GDPR | Not identifiable by any means reasonably likely to be used | Pseudonymised data is still personal data for the holder of the key |
| United Kingdom | UK GDPR | Risk reduced to a sufficiently remote level; the motivated intruder test | Regulator guidance under review after the 2025 Data Act |
| Canada | PIPEDA; Quebec's law | No serious possibility of re-identification; Quebec requires irreversibility | Regulators faulted consent for training on licensed data in 2026 |
| Australia | Privacy Act 1988 | No longer about a reasonably identifiable person | De-identifying is itself a use of personal information |
| India | DPDP Act 2023 | Data about an identifiable individual is personal data; no separate anonymisation test | Main duties apply from about May 2027 |
| Singapore | PDPA | No serious possibility of re-identification | Regulator encourages anonymising AI training data |
| Japan | APPI | Anonymously processed information that can't identify or be restored | Producer must publish the categories shared |
| Brazil | LGPD | Not reversible with reasonable effort | Pseudonymised data stays personal data |
The rest of this guide gives the detail for each. It is general information, not legal advice: every licence needs advice in the countries involved.
United States
California's privacy law treats data as de-identified only if the business takes reasonable measures against re-identification, publicly commits not to re-identify it, and contractually binds every recipient. Virginia, Texas and Oregon set the same three duties. California's law has covered employee data since January 2023. Our US guide covers contracts, the FTC and sector laws.
European Union
GDPR does not apply to anonymous information, judged by all the means reasonably likely to be used to identify someone. Pseudonymised data, where a key can reverse the replacement, is still personal data: the European Data Protection Board's 2025 draft guidelines on pseudonymisation take that view.
In September 2025, the EU Court of Justice ruled in EDPS v SRB that pseudonymised data may not be personal data for a recipient with no reasonable means to re-identify it, while it stays personal data for the company holding the key, according to law firm summaries. So the company licensing the data still needs a lawful basis, a check that the new purpose is compatible, and usually a data protection impact assessment. Consent from employees is rarely valid, because of the imbalance of power.
United Kingdom
The Information Commissioner's Office says "Identifiability exists on a spectrum" and asks whether a motivated intruder, "someone who wishes to identify a person from the anonymous information", could succeed. Whether data is anonymous depends on whose hands it is in, so contracts and access controls count. The ICO's anonymisation guidance, published in March 2025, is under review following the Data (Use and Access) Act 2025.
Canada
The federal law, PIPEDA, has no definition of de-identified data. The privacy commissioner treats information as personal if there is a serious possibility it could be linked to someone. Quebec has a formal anonymisation regulation, in force since May 2024, that requires the result to be irreversible and a documented re-identification risk analysis.
In May 2026, Canada's federal and provincial regulators found that OpenAI had no valid implied consent to train its models on public web data and licensed data, though they accepted its tool for masking personal information as reducing risk. A federal bill that would define de-identified and anonymised data separately was before Parliament in 2026.
Australia
The Office of the Australian Information Commissioner's guidance on training generative AI, from October 2024, says "De-identifying personal information is a use of the personal information for a secondary purpose", so the step itself needs to be within people's reasonable expectations or consented to. It warns against relying on broad consent in a privacy policy, and suggests consent or a meaningful opt-out for disclosures to AI developers.
India
The Digital Personal Data Protection Act 2023 defines personal data as data about an individual "who is identifiable by or in relation to such data". It has no separate definition of anonymised data, so data that genuinely identifies no one falls outside it by implication. Employers may process employee data for employment purposes, which does not extend to licensing it. The Act's main duties apply from about May 2027.
Singapore
Singapore's regulator says data "would not be considered anonymised if there is a serious possibility that an individual could be re-identified", judged against what the recipient has and the safeguards in place. Its 2024 guidelines on personal data in AI systems encourage organisations "to anonymise their datasets as far as possible", while warning that anonymised data still carries risks that need legal, technical and process controls.
Japan
Japan's privacy law has a formal route: anonymously processed information, processed to the regulator's standard so that no individual can be identified and the original can't be restored, can go to third parties without consent. The producer must publish the categories of information shared and how, tell the recipient what it is, and neither side may try to re-identify it. Pseudonymously processed information can't be given to third parties, so it doesn't work for licensing.
Brazil
Under Brazil's data protection law, anonymised data is not personal data unless the anonymisation can be reversed with reasonable effort, judged by cost, time and the technology available. Pseudonymised data stays personal data, and anonymising is itself processing that needs a legal basis. The regulator suspended Meta's use of personal data to train AI in July 2024.
Not sure where to start? Take the free data check.
Questions
Is anonymised data covered by privacy law?
In all nine countries here, truly anonymised data falls outside privacy law. The bar for anonymous is high, and pseudonymised data usually stays covered.
Is pseudonymised data personal data under GDPR?
Yes, for the company holding the key. The EU Court of Justice has said it may not be for a recipient with no reasonable means to re-identify it.
Can a UK company license de-identified data to AI labs?
Possibly, if the data passes the ICO's identifiability tests in the buyer's hands and a lawful basis covers the new purpose. Get UK legal advice.
Does India's data protection law cover anonymised data?
The DPDP Act covers data about identifiable people and has no separate anonymisation rule, so genuinely anonymised data falls outside it by implication.
Which country has the clearest rules for sharing anonymised data?
Japan has a formal anonymous-processing route with set duties, and California's law spells out three specific steps for de-identified data.
Sources
- California Consumer Privacy Act text, section 1798.140(m) California Privacy Protection Agency
- Guidelines 01/2025 on pseudonymisation (public consultation) European Data Protection Board
- Pseudonymised data after EDPS v SRB (September 2025) Clifford Chance, law firm
- How do we ensure anonymisation is effective? UK Information Commissioner's Office
- Joint investigation of OpenAI, PIPEDA findings 2026-002 (6 May 2026) Office of the Privacy Commissioner of Canada
- Quebec adopts regulation on anonymization of personal information McCarthy Tétrault, law firm
- Guidance on privacy and developing and training generative AI models (21 October 2024) Office of the Australian Information Commissioner
- Digital Personal Data Protection Act, 2023 PRS Legislative Research (text of the Act)
- Advisory guidelines on the PDPA for selected topics, chapter 3: anonymisation (revised May 2024) Personal Data Protection Commission Singapore
- Advisory guidelines on use of personal data in AI recommendation and decision systems (1 March 2024) Personal Data Protection Commission Singapore
- Act on the Protection of Personal Information (tentative translation) Personal Information Protection Commission, Japan
- Processing of personal data for AI training in Brazil: the ANPD's decisions in the Meta case Future of Privacy Forum