Published 13 November 2026.
Everyday business records are rarely “clean” in the sense a buyer of training data would want. Names sit in email headers. Phone numbers sit in signatures. A job file can include a customer address, a site contact, a subcontractor, and a photograph. Passwords and API keys sometimes sit in places nobody meant to leave them.
None of that is a reason to panic, and none of it is a reason to email us the files. A first look starts with a description. How personal and confidential information is handled is then agreed, in writing, between you and the buyer, before anything is shared. McKays introduces the two sides. We don’t take the archive, we don’t run a clean-up on your systems, and we don’t promise that any archive can be made anonymous.
Agree it before anything leaves
The useful conversation is a practical one: which folders and years are in scope, which categories stay out, who prepares a copy, how that preparation is checked, and who pays for it. Those points belong in the agreement, not in a handshake. Our outline of how licensing works lists the other things a written agreement usually covers.
Categories that are usually left out altogether include HR and payroll, health information, payment-card details, records about children, and anything that looks like a password, key or access token. That is a usual starting point, not a standard process we apply to every archive. There is no one-size method. Our trust page sets out the same position.
Removing names is often not enough
The ICO’s anonymisation guidance (published 28 March 2025, and noted by the ICO as under review following the Data (Use and Access) Act) explains that identifiability exists on a spectrum. A person can be identifiable from many factors, not only a name. The ICO’s starting point for assessing that risk is a “motivated intruder” test: what a reasonably competent, motivated person could do with the information and other resources they could reasonably obtain. See How do we ensure anonymisation is effective?.
Pseudonymisation — replacing a name with a code, for example — is not the same as anonymisation. If someone can re-identify people with additional information, the UK GDPR may still apply. We are not going to tell you that a particular technique will be enough for your archive, because we cannot know that from a webpage, and because we don’t do the work.
Who does the work
Preparation is decided for each archive. It might be done by the owner, by the buyer under agreed controls, or by a specialist the two of you appoint. Who pays for it is also agreed between you. That is one reason we don’t quote a “cleaning fee”: it isn’t our fee, and it isn’t a fixed product.
UK law also makes it an offence, in defined circumstances, to re-identify de-identified personal data. That sits alongside whatever contractual limits you agree. See re-identification and UK law.
Sources and further reading
- ICO: Anonymisation guidance
- ICO: How do we ensure anonymisation is effective?
- On this site: how personal details come out of business records, anonymising data before a sale or licence, and UK data protection and your records.
This page is general information, not legal advice. It isn’t a ruling on any case. Please speak to your own adviser about your situation.
Sellers pay nothing. The first look is free. How we’re paid.