Published 13 November 2026.
When a copy of business records is prepared for a buyer, names and other identifiers are often removed or replaced. The hope is that the useful work remains and the people do not. UK law does two related things here: data protection law still applies if people can be identified, and, separately, the Data Protection Act 2018 makes re-identification a criminal offence in defined circumstances.
This page is a short pointer to that offence, not a commentary on any case, and not a substitute for advice. McKays does not prepare your records or set your contract terms. Those are agreed between you and the buyer. Sellers pay nothing for an introduction. How we’re paid.
What section 171 says
Section 171 of the Data Protection Act 2018 makes it an offence for a person knowingly or recklessly to re-identify information that is de-identified personal data, without the consent of the controller who was responsible for de-identifying it. It is also an offence, in the circumstances the section sets out, to process personal data that has been re-identified in that way.
The Act defines “de-identified” personal data as data that has been processed so that it can no longer be attributed, without more, to a specific data subject. A person “re-identifies” information if they take steps which result in it no longer being de-identified in that sense.
The section includes statutory defences. We are not going to summarise them as if they were a complete or current list you can rely on. If this is relevant to you, read the section on legislation.gov.uk and take advice. The official text is the authority, not this page. (The page on legislation.gov.uk notes that the section is up to date with changes known to be in force, and that further changes may be brought into force later.)
Why this comes up in a licence
A written agreement can, and often should, say what the buyer may and may not do with a prepared copy — including a ban on trying to identify people, and limits on sharing. That is a contractual matter between you and the buyer. The criminal offence sits alongside any such clause. It does not replace it, and a clause does not replace it.
It also does not make preparation optional. If people can still be identified, you are likely still dealing with personal data, and the UK GDPR remains in play. The ICO’s anonymisation guidance discusses how identifiability is assessed, including a “motivated intruder” starting point. See preparing records and UK data protection.
What McKays does not do
We don’t run a re-identification test, we don’t certify that a copy is anonymous, and we don’t draft your licence. We introduce you to a vetted buyer once that buyer has confirmed our introduction fee in writing. What you insist on in the agreement is yours to decide, with your adviser. Points that often come up are listed in what to settle in a written licence.
Sources
- Data Protection Act 2018, section 171, on legislation.gov.uk
- ICO: Anonymisation guidance
This page is general information, not legal advice. It isn’t a ruling on any case. Please speak to your own adviser about your situation.
Sellers pay nothing. The first look is free. How we’re paid.