Is licensing company records legal in the UK?

1. Copyright can cover more than polished publications

Section 3 of the Copyright, Designs and Patents Act 1988 defines literary works to include tables, compilations and databases, as well as written, spoken or sung works. Copyright in a literary, dramatic or musical work requires the work to be recorded in writing or otherwise.

That does not make every item in a company archive automatically protectable or automatically owned by the company. Review the originality, authorship and history of the relevant material, and separate the company's own contribution from client, supplier and other third-party content.

CDPA 1988, s 3(1): “literary work” includes a table or compilation and a database; s 3(2) addresses recording in writing or otherwise.

2. Check the restricted acts and the first owner

Section 16 lists restricted acts including copying, issuing copies to the public, communication to the public and making an adaptation. Preparing and transferring a licensed collection can therefore involve more than the act of signing an agreement.

Section 11 starts with the author as first owner. For a literary, dramatic, musical or artistic work made by an employee in the course of employment, the employer is first owner subject to any agreement to the contrary. That wording should not be extended automatically to contractors or material supplied by customers.

CDPA 1988, s 11(2): the employee rule applies where the work is made “in the course of his employment”, subject to any agreement to the contrary.

3. Database right is a separate question

The Copyright and Rights in Databases Regulations 1997 create a database right where there has been a substantial investment in obtaining, verifying or presenting the database contents. Regulation 13 says this applies whether or not the database or its contents are a copyright work.

A review should therefore ask both who owns any copyright and whether database right subsists, who made the relevant investment and what the proposed extraction or reutilisation involves. A spreadsheet or archive should not be assessed only as an ordinary document.

Regulation 13(2): it is immaterial whether the database or its contents are a copyright work for the database-right question.

4. The text-and-data-analysis exception is narrow

Section 29A permits a person with lawful access to make a copy for computational analysis for the sole purpose of non-commercial research, with a sufficient acknowledgement unless that is impossible for practical or other reasons. The provision also restricts transferring the copy and using it for another purpose without the copyright owner's authorisation.

It is not a general commercial AI-training permission. A proposed commercial licence should not be justified by describing commercial model development as research without reviewing the actual purpose and every statutory condition.

CDPA 1988, s 29A(1)(a): the computational analysis must be “for the sole purpose of research for a non-commercial purpose”.

5. Personal data requires its own lawful analysis

UK GDPR Article 5 requires lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability. Article 6 requires at least one lawful basis for processing. Consent is one possible basis, not the only one; the correct basis depends on the actual processing.

Article 9 adds a prohibition and specific exceptions for special-category data, and the Data Protection Act 2018 forms part of the UK framework. Health, biometric and certain employee records need particular attention. Removing names should not be treated as proof that information is anonymous or that the other legal questions disappear.

UK GDPR Article 5(1)(c): personal data must be “adequate, relevant and limited to what is necessary” for the purposes.

6. Check an overseas buyer or processor before transfer

The current Article 44A, inserted with effect from 5 February 2026, states that a controller or processor may transfer personal data to a third country or international organisation only when its conditions are met and the transfer complies with the rest of the UK GDPR.

Article 44A refers to regulations under Article 45A, appropriate safeguards under Article 46 and derogations under Article 49, subject to restrictions under Article 49A. Do not rely on the older Article 44 wording without checking the current text. The buyer's location, hosting, onward access and contractual safeguards all need to be mapped.

UK GDPR Article 44A(1): a third-country transfer requires the paragraph 2 condition and compliance with the Regulation's other provisions.

7. Review the licence and the authority to grant it

Record exactly which materials and rights are covered, the permitted uses, exclusivity, territory, duration, onward recipients, security, retention and end-of-licence treatment. Existing confidentiality, client and platform terms remain relevant even where the company owns copyright.

For closed and winding-down companies, the liquidator, administrator, trustee, receiver or other authorised officeholder should lead the review. Records may be a possible extra asset for creditors, but that is not clearance to disclose them. Personal data in insolvency estates needs its own lawful basis; your officeholder and the buyer decide.