Start with the proposed use
A UK supplier should describe the exact training activity before choosing transfer paperwork. A customer-support archive collected to resolve enquiries is different from a corpus collected specifically for model development. Prepare a record of the original purposes, notices, lawful-basis analysis, retention limits, and any special-category information. Copyright and contractual authority need separate examination; compliance with privacy rules does not prove ownership of the text.
Map access, not just hosting
The ICO explains that a restricted transfer can include making personal information accessible to a separate organisation outside the UK. A UK-hosted evaluation room therefore needs the same entity-and-access map as a downloadable sample. Identify the contracting laboratory, overseas reviewers, annotation vendors, and infrastructure providers. Ask counsel whether UK adequacy regulations, an IDTA, or the UK Addendum and an associated assessment fit the particular arrangement. Do not assume EU clauses alone resolve the UK position.
Build an evidence pack
Keep the buyer-facing pack practical: a synthetic sample, field dictionary, provenance summary, and list of excluded records let a lab evaluate fit before receiving sensitive material. State whether the offer covers evaluation, training, redistribution, or only a limited internal experiment. Keep sample approval separate from approval of the production delivery.
- Name every separate legal recipient and access location.
- Record the transfer assessment and safeguards selected by counsel.
- Make deletion, onward sharing, and incident responsibilities explicit.
Review before release
Sources reviewed on 19 October 2026. This is a preparation checklist, not legal clearance, tax advice, or confirmation that an AI lab accepts suppliers from this jurisdiction. Ask qualified local counsel to review the actual dataset, collection history, proposed training purpose, recipient, and current rules before releasing personal data.