The Buckingham Data Clearance Standard

Buyers of AI training data now ask where a dataset came from, who has the right to license it and whether anyone in it can be identified. The standard turns those questions into six requirements with a fixed record for each, so that every party reads the same thing.

On this page

• What the standard covers
• The six requirements
• The clearance record
• Requirement 1: authority
• Requirement 2: rights
• Requirement 3: exclusions
• Requirement 4: de-identification
• Requirement 5: documentation
• Requirement 6: licence terms
• The three results
• How the standard reflects the law
• Versions and review
• Questions
• Sources

The company licensing the data must own or control it, and the person who signs must be authorised to bind the company.

• Ownership or control: the records were created by the company or are held by it under terms that allow licensing.
• Signatory: a director or officer with authority over the records. For a large dataset, board approval is recorded.
• Companies that are closing or being sold: the person with legal control of the records signs, such as the administrator, the liquidator or the buyer of the business.

Holding a file is not the same as holding the right to license it. Each of the following is checked for the use the buyer has stated.

• Copyright: in the UK, a work made by an employee in the course of employment belongs to the employer unless they agreed otherwise. Material written by contractors, suppliers and customers usually belongs to them, and needs their licence or is left out.
• Database right: in the UK and the EU, the maker of a database can stop others taking a substantial part of it. The licence must come from that maker.
• Contracts and confidentiality: customer, supplier and employment terms that limit how information may be used or shared.
• Software terms: the terms of the systems the records are exported from, where they restrict export or use for AI training.
• Earlier licences: any existing licence, exclusivity or sale that would conflict with a new one.

A direct licence also removes reliance on copyright exceptions. In the EU, commercial text and data mining (automated analysis of text and data to find patterns) is allowed only where the rights holder has not opted out. In the UK, the exception covers non-commercial research only.

Some information never enters a cleared dataset, whatever the specification. It is removed inside the company's systems before any record is extracted.

• Special category data: information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data used to identify a person, health, and sex life or sexual orientation.
• Criminal offence data: information about criminal convictions and offences.
• Identity and account details: government identity numbers, passport and driving licence numbers, account log-ins and payment card or bank account numbers.
• Children and vulnerable people: information about children and about people in vulnerable circumstances.
• Third-party material: confidential information belonging to others, and content the company is not entitled to license.

De-identification means removing or replacing the details that identify a person, such as names, addresses, email addresses and reference numbers. Under the standard it is done inside the company's own systems, so identifiable records do not leave the company.

The result is then tested against the motivated intruder test in UK guidance: could a reasonably competent person, using the internet, public records and ordinary investigative methods, identify anyone?

• Sampling: samples from every source are reviewed by hand.
• Linking: records are checked against public information to see whether they can be matched to a person.
• Outliers: records that stand out, such as a rare job title in a small town, are generalised or removed.
• The buyer: risk is judged in the hands of the specific buyer, taking account of other information it holds.
• Re-testing: the test is repeated when the data, the buyer or the public information available changes.

Every cleared dataset has a data sheet: a plain description that a person outside the company can read.

• Contents: record types, structure and formats.
• Origin: the systems the records came from and how they were extracted.
• Coverage: date range, languages, countries and volumes.
• Processing: what was removed, replaced or generalised.
• Known limits: gaps, duplicates and anything a model team should allow for.

The licence carries the commitments that keep the dataset within the law after delivery.

• Permitted uses: training, fine-tuning, evaluation, retrieval and commercial deployment, each named separately.
• Re-identification: a ban on any attempt to identify people. In the UK, re-identifying de-identified data without consent is a criminal offence.
• Onward rights: whether the buyer may pass the data on, and on what terms.
• Retention and deletion: how long copies may be kept and what happens at the end of the term.
• Exclusivity: whether the licence is exclusive, and for which field of use or period.

An assessment against the standard ends in one of three results.

The standard is a professional standard, not a legal requirement. Each requirement reflects the law in the UK, the EU and the US.

This is version 1.0, published on 11 November 2026. The standard is reviewed when the law or regulatory guidance it reflects changes, and each change is listed here with its date.

The standard may be quoted and referenced with attribution to Buckingham Capital Consulting. A dataset may be described as cleared against the standard only where a clearance record has been issued for it.