Rights clearance
We check client contracts, supplier terms and staff policies so you only license what you have the right to.
Compliance
UK GDPR compliance, built in from the first call
Compliance is the core of what we do, not a box at the end. Every licence is rights-cleared, de-identified and documented before any data leaves your systems.
How do we keep your data safe and compliant?
With six safeguards on every licence: rights clearance, data minimisation, de-identification, a documented lawful basis, safe international transfer and buyer restrictions. Each one is checked and verified before anything moves. You see the paperwork and keep a copy. See how the process works.
Data minimisation
Only the sources and date ranges you agree to. HR files and other excluded material never leave your systems.
De-identification
Names, contact details and other identifiers are removed or replaced consistently, so workflows still read naturally.
Documented lawful basis
A legitimate interests assessment and DPIA specific to your data, written by us and kept on file for you.
Safe international transfer
Transfers to US buyers rely on the UK–US data bridge or the UK IDTA, with a transfer risk assessment.
Buyer restrictions
Every licence bans re-identification, limits use to training and evaluation, and sets deletion terms.
What does de-identification look like?
Names, email addresses, phone numbers, client names and other identifiers are replaced with consistent placeholders, so a person or client is the same token throughout. The work still makes sense to a model learning how the business operates, but the people are no longer identifiable from the dataset.
BeforeIllustrative example
Sarah Jenkins · Teams · 09:14
Hi Tom, can you send the Hartley & Sons valuation to j.hartley@hartleysons.co.uk before Friday? Copy in Priya on 07700 900123 if the variation isn’t signed.
AfterDe-identified
PERSON_1 · Teams · 09:14
Hi PERSON_2, can you send the CLIENT_1 valuation to EMAIL_1 before Friday? Copy in PERSON_3 on PHONE_1 if the variation isn’t signed.
Names and details in this example are fictional. Our method combines automated detection of names, contact details, addresses, account numbers and other identifiers with human review, replacing each one with a consistent token. Before any dataset is released, a reviewer manually checks a random sample of at least 5% of records. If an identifier is found, the dataset is corrected and the sample is checked again.
What data is never included?
Some data stays out of every licence, whatever the buyer offers: HR and payroll files, special category data such as health information, payment and bank details, credentials, and client material you don’t have the right to license. You can add to this list for your company before anything is extracted.
- HR files, payroll and personnel records
- Special category data, such as health information
- Payment card and bank account details
- Passwords, keys and other credentials
- Client material you don’t have the right to license
What paperwork do you receive?
Six documents, written for your company and yours to keep: a scope schedule and NDA, a legitimate interests assessment, a data protection impact assessment, a de-identification certificate, a transfer risk assessment and the licence agreement. If the ICO or a client ever asks, you have the answer on file.
Scope schedule and NDA
What’s included, what’s excluded and who can see what.
Legitimate interests assessment
The purpose, necessity and balancing tests, specific to your data.
Data protection impact assessment
Risks identified, the safeguards in place and the residual risk.
De-identification certificate
The method used and the results of quality checks on the dataset.
Transfer risk assessment
How the transfer to a US buyer is covered by the data bridge or the IDTA.
Licence agreement
Non-exclusive terms, permitted uses, re-identification ban and deletion terms.
Which UK laws apply to licensing company data?
As of October 2026: UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, ICO guidance, the rules on international transfers, and your contracts with clients, suppliers and staff. We keep our process under review as the law develops. Read the full answer.
- UK GDPR
- Lawful basis, data minimisation, transparency and security.
- Data Protection Act 2018
- As amended by the Data (Use and Access) Act 2025.
- International transfers
- UK–US data bridge, or the International Data Transfer Agreement.
- ICO guidance
- Including guidance on legitimate interests, anonymisation and AI.
- Contract and confidentiality
- Client, supplier and employment terms checked for every source.
Who stands behind Sterling Data?
Sterling Data is operated by Hetherington Projects, registered in England and Wales (no. 17513005) and registered with the Information Commissioner’s Office (C2062607). We hold Cyber Essentials and ISO 27001, process data in UK and EU data centres, and are based at 45 Albemarle Street, Mayfair, London. About us.
ICO registered
Registration number C2062607.
Cyber Essentials
Certified under the UK government’s Cyber Essentials scheme.
ISO 27001
Information security management to the international standard.
UK and EU data processing
Data processed in UK/EU data centres.
Compliance questions
Is it legal to license company data to AI companies in the UK?
It can be, if your company has the right to license the data and any personal data is either removed or processed on a documented lawful basis under UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.
We handle the rights checks, de-identification, legitimate interests assessment, DPIA and the safeguards for transfer to US buyers.
Will our customers’ or employees’ personal data be shared?
No. Names, contact details and other identifiers are removed or replaced before anything is packaged. HR files are excluded, and buyers only see redacted samples before a licence is signed.
Do we need to tell our staff or clients?
Often, yes, through an update to your privacy notice. We’ll draft the wording for you.
Last reviewed by Kier Hetherington, Director.
Questions about compliance?
Speak to our data protection lead before you share anything. Email info@sterlingdata.ai.