Can i sell my AI agents logs (5 figures)
5 provisions of UK GDPR and the Information Commissioner's guidance on reusing personal data that agent logs hold, each quoted from legislation.gov.uk or ico.org.uk, read 28 October 2026.
What the provision settles
What it asks before the logs move
The rule, in its words
Each provision, answer by answer
A provision per row. Every answer opens onto the line it comes from, quoted exactly, with the page it sits in and the day of the read. "Not stated" marks a question the page leaves unanswered.
| Provision | What the provision settles | What it asks before the logs move | The rule, in its words |
|---|---|---|---|
| ICO on processors acting outside instructions | what a processor holding data for a customer may and may not do with it | the customer's documented instruction, as controller | If you act outside your instructions or process for your own purposes, you will step… |
| UK GDPR Article 28, processors | what a processor holding data for a customer may and may not do with it | the customer's documented instruction, as controller | if a processor infringes this Regulation by determining the purposes and means of… |
| UK GDPR Article 5(1)(b), purpose limitation | the principles every use of personal data must meet | a new purpose compatible with the original one | for specified, explicit and legitimate purposes and not further processed |
| UK GDPR Article 6(1), lawful bases | the lawful bases for using personal data | a lawful basis for the new use | processing is necessary for the purposes of the legitimate interests pursued by the… |
| UK GDPR Article 8A, further processing | when personal data may be used for a purpose other than the one it was collected for | a new purpose compatible with the original one | any link between the original purpose and the new purpose; |
The 15 sentences the answers come from
- ICO on processors acting outside instructions, ICO guidance page, read 2026-10-08, What the provision settles:
If you act outside your instructions or process for your own purposes, you will step outside your role as a processor and become a controller for that processing.
- ICO on processors acting outside instructions, ICO guidance page, read 2026-10-08, What it asks before the logs move:
you can only process the personal data on instructions from a controller (unless otherwise required by law).
- ICO on processors acting outside instructions, ICO guidance page, read 2026-10-08, The rule, in its words:
If you act outside your instructions or process for your own purposes, you will step outside your role as a processor and become a controller for that processing.
- UK GDPR Article 28, processors, legislation.gov.uk revised text, read 2026-10-08, What the provision settles:
processes the personal data only on documented instructions from the controller
- UK GDPR Article 28, processors, legislation.gov.uk revised text, read 2026-10-08, What it asks before the logs move:
processes the personal data only on documented instructions from the controller
- UK GDPR Article 28, processors, legislation.gov.uk revised text, read 2026-10-08, The rule, in its words:
if a processor infringes this Regulation by determining the purposes and means of processing, the processor shall be considered to be a controller in respect of that processing.
- UK GDPR Article 5(1)(b), purpose limitation, legislation.gov.uk revised text, read 2026-10-08, What the provision settles:
for specified, explicit and legitimate purposes and not further processed
- UK GDPR Article 5(1)(b), purpose limitation, legislation.gov.uk revised text, read 2026-10-08, What it asks before the logs move:
in a manner that is incompatible with
- UK GDPR Article 5(1)(b), purpose limitation, legislation.gov.uk revised text, read 2026-10-08, The rule, in its words:
for specified, explicit and legitimate purposes and not further processed
- UK GDPR Article 6(1), lawful bases, legislation.gov.uk revised text, read 2026-10-08, What the provision settles:
Processing shall be lawful only if and to the extent that at least one of the following applies:
- UK GDPR Article 6(1), lawful bases, legislation.gov.uk revised text, read 2026-10-08, What it asks before the logs move:
Processing shall be lawful only if and to the extent that at least one of the following applies:
- UK GDPR Article 6(1), lawful bases, legislation.gov.uk revised text, read 2026-10-08, The rule, in its words:
processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data
- UK GDPR Article 8A, further processing, legislation.gov.uk revised text, read 2026-10-28, What the provision settles:
of whether processing of personal data by or on behalf of a controller for a purpose (a “new purpose”) other than the purpose for which the controller collected the data (“the original purpose”) is processing in a manner compatible with the original purpose.
- UK GDPR Article 8A, further processing, legislation.gov.uk revised text, read 2026-10-28, What it asks before the logs move:
In making the determination, a person must take into account, among other things—
- UK GDPR Article 8A, further processing, legislation.gov.uk revised text, read 2026-10-28, The rule, in its words:
any link between the original purpose and the new purpose;
Method
Each provision's own UK GDPR as amended, on legislation.gov.uk, and the Information Commissioner's guidance were read through estate-fetch and stored whole (sha256 on every row).
For every page, three questions were answered from its own words: what the provision settles, what it asks before the logs move, the rule, in its words.
Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the page read does not address the question.
A provision with several pages reads 'varies' where they disagree.
5 provisions, 5 pages.
The 5 pages we read
- UK GDPR Article 5, principles (from the publisher's own UK GDPR as amended, on legislation.gov.uk, and the Information Commissioner's guidance; reproduced for comment)
- UK GDPR Article 6, lawfulness (from the publisher's own UK GDPR as amended, on legislation.gov.uk, and the Information Commissioner's guidance; reproduced for comment)
- UK GDPR Article 8A, purpose limitation: further processing (from the publisher's own UK GDPR as amended, on legislation.gov.uk, and the Information Commissioner's guidance; reproduced for comment)
- UK GDPR Article 28, processor (from the publisher's own UK GDPR as amended, on legislation.gov.uk, and the Information Commissioner's guidance; reproduced for comment)
- ICO: what does it mean if you are a processor (from the publisher's own UK GDPR as amended, on legislation.gov.uk, and the Information Commissioner's guidance; reproduced for comment)
Quote this figure or put it on your site
5 provisions of UK GDPR and the Information Commissioner's guidance on reusing personal data that agent logs hold, each quoted from legislation.gov.uk or ico.org.uk, read 28 October 2026.
What the provision settles, by provision: what a processor holding data for a customer may and may not do with it 2 of 5, when personal data may be used for a purpose other than the one it was collected for 1 of 5, the lawful bases for using personal data 1 of 5, the principles every use of personal data must meet 1 of 5 (5 provisions, read 28 October 2026).
What it asks before the logs move, by provision: a new purpose compatible with the original one 2 of 5, the customer's documented instruction, as controller 2 of 5, a lawful basis for the new use 1 of 5 (5 provisions, read 28 October 2026).
The rule, in its words, by provision: stated 5 of 5 (5 provisions, read 28 October 2026).
Citation: "UK data law on passing on agent logs with personal data", updated 2026-10-28, https://sellagentlogstoai.com/datasets/agent-log-uk-data-law/.
Download as CSV (15 answers as of 2026-10-28)