Can we use existing records to set up an AI tool?

It depends on how far the new use departs from what was originally described, which is a real assessment rather than a formality. Summarising material collected to serve those same people sits differently from analysing it for an unrelated commercial purpose.

Is training a model on our own data allowed?

It is genuinely unsettled and views differ between regulators, so anybody describing it as obviously fine or obviously prohibited is overstating what is established. Treat it as a question carrying real weight, and one worth advice rather than an internal assumption.

What is the practical trigger to check this?

Any moment when existing material is pointed at something new. The check is cheap and the failure is silent, because a dataset already sitting there raises no procurement question and nobody in a product conversation is thinking about what it was gathered for.

Glossary

Purpose limitation

Using data only for what it was collected for, which turns any new use of existing material into a question that has to be answered.

In plain terms

You said what you were collecting it for, so that is what you may use it for. A new use is not automatically forbidden and it is also not automatically allowed, which is the part that gets skipped when a dataset is already sitting there and a project needs one.

Why it matters

Because the most attractive material for an AI project is always material the organisation already holds. It exists, it is relevant, and acquiring it cost nothing, so the reuse tends to be treated as free when the question of whether the original purpose covers it has not been asked by anybody.

How it works

The purpose is fixed at collection and stated, which is what gives the rule something to bite on. Vagueness at that moment does not create freedom later: a purpose described so broadly that it covers anything tends to be treated as not having specified a purpose at all.

A further use is judged on compatibility rather than on being identical. Some new purposes sit close enough to the original that they are permissible, and others do not, and the assessment turns on how far the new use departs from what the person would have understood was happening.

Reuse for a materially different activity generally needs its own footing. Where compatibility does not hold, the new use needs its own ground rather than inheriting the old one, which is a different exercise from simply deciding the project is worthwhile.

Whether training on existing material is compatible is genuinely unsettled and regulator views differ, so an organisation treating it as obviously fine and one treating it as obviously prohibited are both overstating what is currently established. What is safe to say is that it is a question with real weight rather than a formality.

The everyday version is smaller than model training and far more common. Feeding existing records into a tool to summarise, classify or search them is a new activity on old data, and it is the kind that arrives through a product decision where nobody thinks to ask what the material was originally for.

How far the new use departs

Drawing this as a range rather than a permitted-or-not switch matters because the switch framing produces both of the wrong behaviours. Treating everything as permitted means the question never gets asked, and treating everything as prohibited means it gets asked once, answered no, and quietly worked around by whoever needed the project to happen. The range makes visible that most real cases sit near the left end, where the answer is usually yes and the check takes minutes, so the discipline of asking costs almost nothing in the common case. It also shows why the right end deserves separate treatment rather than the same shrug: those uses depart far enough that the person whose data it is would recognise the difference, which is the same test that decides the legitimate-interest balance. The one mark worth not over-reading is the last. It is placed far right because it is a substantial departure, not because it is settled as impermissible, and anybody presenting it as settled in either direction is going beyond what is currently established.

Seen in the wild

Wanting to point an assistant at years of support conversations collected to answer those customers.
ChatGPT
A search deployment indexing material gathered for entirely separate reasons across several systems.
Glean
An automation reusing a customer list for something nobody described when it was built.
Make

Common misconceptions

People assume

Data we already hold is ours to use.

In fact

Holding it lawfully and using it for something new are separate questions. The original purpose is what permitted the collection, and a materially different use needs to be compatible with that or to stand on its own footing.

People assume

Describing the purpose broadly gives us room.

In fact

A purpose broad enough to cover anything tends to be treated as no purpose at all. Vagueness at collection does not create latitude later; it mostly removes the evidence that a purpose was ever specified.

Questions

Can we use existing records to set up an AI tool?: It depends on how far the new use departs from what was originally described, which is a real assessment rather than a formality. Summarising material collected to serve those same people sits differently from analysing it for an unrelated commercial purpose.
Is training a model on our own data allowed?: It is genuinely unsettled and views differ between regulators, so anybody describing it as obviously fine or obviously prohibited is overstating what is established. Treat it as a question carrying real weight, and one worth advice rather than an internal assumption.
What is the practical trigger to check this?: Any moment when existing material is pointed at something new. The check is cheap and the failure is silent, because a dataset already sitting there raises no procurement question and nobody in a product conversation is thinking about what it was gathered for.

Key takeaways

The purpose is fixed at collection, and vagueness then does not help later.
A new use is judged on compatibility, not on being identical.
Training on existing material is unsettled; certainty in either direction is overstated.
The common case is small: old records pointed at a new tool.

Tools that use this

ChatGPT
Pointing an assistant at conversations collected to answer those customers.
Glean
Indexing material gathered for entirely separate reasons.
Make
Reusing a customer list for something nobody described.

Last checked August 2026

All glossary terms