Training-data rights: what you may use, and what you must say

The question "are we allowed to train on this?" resolves into four separate questions with four separate answers: do we have a lawful basis for the personal data, do we have rights in the content, do our contracts permit it, and what must we disclose. Programmes that treat it as one question get one answer and it is usually the wrong one.

Personal data in training sets

Under GDPR the analysis runs through lawful basis, purpose limitation and Article 35 where the processing is high risk. The EDPB Opinion 28/2024 of 17 December 2024 addresses personal data in AI models specifically, and is the document to work from rather than general guidance.

Under the revised Swiss Federal Act on Data Protection the structure differs and the difference is often missed. There is no legal basis requirement for private controllers. Article 6 sets the processing principles: lawfulness, good faith, proportionality, purpose limitation and accuracy. Article 30 frames the question as breach of personality, justified under Article 31 by consent, an overriding private or public interest, or law. Article 19 imposes a duty to inform on collection, covering the controller identity and contact details, the purpose, the recipients or categories of recipients, and for transfers abroad the state and the safeguard relied on.

Purpose limitation is where training sets break. Data collected to administer a policy and later used to train a pricing model has been repurposed, and the question is whether that was within the purpose communicated at collection. Answering it requires reading the privacy notice that was actually shown, which is a job for legal rather than for the data team.

Note also Article 12: the register of processing activities, with an exemption for organisations under 250 employees unless they carry out large-scale processing of sensitive data or high-risk profiling. An insurer or bank of any size will usually fail that exemption on the sensitive data or profiling limb.

Content rights

Whether a given training use of copyright material is permitted is jurisdiction-specific and, in several jurisdictions, actively contested. We do not state a position here, and neither should your course materials or your policy: say what you have licensed, what you have not, and where advice was taken.

What you can do without resolving the underlying law is inventory. California AB 2013 requires developers to disclose whether datasets include material protected by copyright, trademark or patent, or in the public domain, and whether datasets were purchased or licensed. Answering those questions for your own datasets is a factual exercise, and doing it tells you where the legal exposure sits even while the law moves.

Contractual restrictions, which bite first

In practice the binding constraint on a regulated firm is usually contractual rather than statutory. Data supplied by a broker, a bureau, a reinsurer or a market data provider almost always arrives with use restrictions, and those restrictions were drafted before anyone contemplated model training. A clause permitting use "for the purposes of underwriting the business submitted" does not obviously permit retaining the data to train a model used on other business, and the counterparty may well read it that way when asked.

Ask before training, not after deployment. A retraining exercise is an inconvenience; withdrawing a deployed model because a data licence did not cover it is an incident.

What you must say

Three disclosure duties are distinct and get conflated. AB 2013 requires the developer to publish training-data documentation on its website. Article 50 of the EU AI Act, applying from 2 August 2026 and not deferred, requires people to be informed they are interacting with an AI system unless that is obvious, and requires providers of systems generating synthetic audio, image, video or text to mark output in a machine-readable format. Article 19 revFADP requires notice at collection. One of these concerns the data you trained on, one concerns the output, and one concerns the collection. A single paragraph in a privacy notice does not discharge all three.

Worked example: a bank wants to train on chat transcripts

A bank proposes to fine-tune an assistant on five years of customer service chat transcripts. Four reviews run in parallel and reach four different conclusions, which is the point.

Privacy finds that the transcripts contain personal data and occasionally health and financial hardship disclosures, that the privacy notice in force for most of the period described service delivery and quality monitoring, and that model training was not communicated. The proportionality assessment under Article 6 revFADP is not obviously satisfied for the full corpus.

Legal finds that transcripts from the outsourced overflow contact centre are covered by a processing agreement that restricts use to service delivery. That is a hard stop on roughly a fifth of the corpus, and it is the fastest finding of the four.

The data team proposes redaction and synthetic augmentation. Both are recordable disclosures under AB 2013 if the resulting system is in scope, and both change the dataset without changing the dataset name unless someone versions it.

The decision is to train on a consented and in-scope subset, to record the exclusion of the outsourced corpus with its reason, and to update the privacy notice prospectively rather than claim it covered the past. The exclusion record is the artefact that pays for itself: when someone proposes the same project again in two years, the answer and its reasoning already exist.

As of 24 September 2026.