Can You Use Existing Customer Data To Test A New Product?

When you're running a business, collecting customer information is often just part of the process. Whether it's contact details, purchase histories or account information, over time, your business can build up quite a collection of data.

Of course, there are privacy obligations to consider when collecting and handling this information. But once you've got it, you might start thinking about what else it could be useful for.

Perhaps you're developing a new product or service, and the customer data you've collected over the years could help you test your ideas, improve certain features or understand what your customers actually need.

After all, you've already collected the information, so why not put it to good use?

However, just because your business legally collected customer information doesn't necessarily mean you're free to use it for something entirely different.

Before using existing customer data for a new project, there are a few important data protection obligations worth understanding.

Can You Use Existing Customer Data For A Different Purpose?

Potentially, yes. However, the fact that your business already holds customer information doesn't automatically give you permission to use it for a new project.

Under the UK General Data Protection Regulation (UK GDPR), businesses must follow the principle of purpose limitation. This means personal data must be collected for specified, explicit and legitimate purposes, and generally cannot be reused for incompatible purposes.

Say your business collects customer information to process purchases and arrange deliveries. A few years later, you decide to use those records to test a new product recommendation system.

Although you've already collected the information, the testing may involve using it for a different purpose.

Under the UK GDPR, further processing may be permitted where the new purpose is compatible with the original purpose, or where another applicable legal provision allows it.

The Data (Use and Access) Act 2025 introduced changes to the UK's purpose limitation framework, including rules under Article 8A of the UK GDPR.

When considering whether a new use is compatible, businesses may need to assess factors such as the connection between the purposes, customers' reasonable expectations, the nature of the information and the potential impact on individuals.

Certain further uses, including qualifying research and statistical purposes, are also addressed by specific provisions. However, ordinary commercial product testing doesn't automatically qualify for these provisions simply because it involves analysing data.

Importantly, having a compatible purpose doesn't remove the requirement to have an appropriate lawful basis for processing the information.

Both questions need to be considered before testing begins.

Is Improving An Existing Product Different From Testing A New One?

There's a practical difference between improving a service your customers already use and developing something entirely separate.

Imagine you operate an online booking platform.

You analyse customer activity to identify booking errors, improve existing features and understand where customers experience difficulties.

Depending on why the information was originally collected, this may be part of the original purpose or a compatible use.

Now imagine you're developing an unrelated financial services product and want to use those same customer records to test how it works.

The connection to your original booking service is much less obvious. Customers might reasonably expect you to use their information to improve their bookings, but not necessarily to develop an entirely different product.

That distinction matters when assessing compatibility under the UK GDPR.

However, the name or type of product isn't the deciding factor. Even improvements to an existing service can raise legal concerns if they involve unexpected or intrusive uses of personal data.

The important question is what you're actually doing with the information, how it relates to the original purpose and whether the proposed use is legally permitted.

Do You Need Customer Consent To Use Their Data?

Not always.

Under Article 6 of the UK GDPR, businesses need an appropriate lawful basis for processing personal data.

Consent is one option, but businesses may sometimes be able to rely on another basis, such as legitimate interests.

For instance, your business may have a legitimate commercial interest in improving its software or understanding how customers use particular features.

However, relying on legitimate interests involves more than identifying a business benefit.

You need to consider whether the processing is necessary for that interest and whether it is outweighed by customers' rights, freedoms and interests. A legitimate interests assessment can help document this decision.

Importantly, legitimate interests doesn't automatically authorise an incompatible use of information. You still need to satisfy the purpose limitation requirements.

There are also additional considerations if you originally relied on consent to process the information.

Under the UK's updated purpose limitation rules, further processing of information originally collected on the basis of consent is subject to specific conditions. In many situations, using that information for a new, unrelated purpose will require fresh consent.

You also can't simply switch from consent to legitimate interests to avoid giving customers a genuine choice. Any change of lawful basis needs a proper legal justification.

Where consent is required, it must be freely given, specific, informed and unambiguous. Customers must also be able to withdraw it.

Additional requirements apply to special category data, such as health information or biometric data used to uniquely identify someone. This generally requires both an Article 6 lawful basis and an applicable Article 9 condition.

What Rights Do Customers Have?

Customers may also have rights that affect how your business conducts product testing.

For example, where you're relying on legitimate interests, individuals generally have the right to object to the processing. Depending on the circumstances, your business may need to stop unless it can demonstrate compelling legitimate grounds that override their interests, rights and freedoms.

Customers may also be entitled to withdraw consent or request erasure of their information where the relevant legal requirements are satisfied.

Using personal data without a valid legal basis or otherwise breaching data protection obligations can also lead to complaints, investigations by the Information Commissioner's Office (ICO), enforcement action or potential legal claims.

Understanding these obligations before testing begins can help avoid issues later, particularly where your project involves large amounts of customer information.

Does Your Existing Privacy Policy Cover Product Testing?

Your business might already have a privacy policy explaining how customer information is collected, stored and used.

But does it reflect what you're now planning to do?

Under the UK GDPR, businesses must provide individuals with relevant information about how their personal data is handled, including the purposes of processing and applicable lawful bases.

If you originally collected information to provide a particular service, but now intend to use it for substantially different product testing, your existing privacy information may no longer adequately explain your activities.

Where relevant, Articles 13 and 14 require businesses to provide information about a new processing purpose before using personal data for that purpose.

This doesn't necessarily mean every small product improvement requires an entirely new privacy policy. However, significant changes to how information is used should prompt a review of your existing documentation and communications with customers.

Updating your privacy policy doesn't automatically make a new use of personal data lawful.

You still need an appropriate lawful basis and must comply with the purpose limitation rules.

Having a tailored Privacy Policy can help ensure your business's documentation reflects its actual data-handling practices.

Can You Use Anonymous Customer Data Instead?

What if your new product doesn't actually need to know who your customers are?

In some cases, using anonymous information may be a more suitable option.

Under UK data protection law, properly anonymised information that no longer relates to an identifiable individual generally falls outside the UK GDPR.

However, simply removing customer names and email addresses isn't necessarily enough.

Purchase histories, location information and other details may still allow people to be identified, especially when different datasets are combined.

There's also an important distinction between anonymisation and pseudonymisation.

Pseudonymised information remains personal data where individuals can still be identified using additional information. Properly anonymised information, on the other hand, must no longer allow individuals to be identified through means reasonably likely to be used.

The initial process of anonymising personal data must also comply with applicable data protection obligations.

Before using identifiable customer records for testing, it's worth considering whether anonymous, aggregated or synthetic information could achieve the same result.

What If You're Using A Third-Party Testing Platform Or AI Tool?

Developing a new product often involves external software providers.

You might use an analytics platform to understand customer behaviour, a testing environment to experiment with new features or an AI tool to evaluate how your product performs.

But what happens to customer information once you've uploaded it to those systems?

Under the UK GDPR, businesses must take appropriate technical and organisational measures to protect personal data.

Where an external provider processes personal data on your behalf, Article 28 generally requires a legally binding data processing agreement containing specified protections.

This should address matters such as processing instructions, confidentiality, security, the use of subprocessors and what happens to the information when the arrangement ends.

It's also important to understand whether the provider will only process information on your instructions or use it for its own purposes.

For instance, an AI provider might seek to retain uploaded information to develop or train its own models. That could raise additional questions about the provider's role, lawful basis and whether the proposed use is permitted.

If personal data will be transferred outside the UK, international data transfer requirements may also apply, depending on the destination and arrangements.

Businesses should also consider how long customer information remains in testing environments. Under the storage limitation principle, personal data generally shouldn't be kept for longer than necessary for its purposes, subject to applicable exceptions.

Having an appropriate Data Processing Agreement can help establish the responsibilities of your business and its external service providers.

Do You Need A Data Protection Impact Assessment?

Not every product test requires a formal privacy assessment, but some projects introduce greater risks than others.

Under Article 35 of the UK GDPR, businesses must carry out a Data Protection Impact Assessment (DPIA) where proposed processing is likely to result in a high risk to individuals' rights and freedoms.

This may be relevant where testing involves large-scale profiling, sensitive personal data or innovative technologies combined with other risk factors.

However, simply using a new technology doesn't automatically mean a DPIA is required. The nature of the processing, the information involved and the potential risks all matter.

A DPIA helps identify and assess those risks, consider whether the processing is necessary and proportionate, and establish measures to reduce potential harm.

Where a DPIA is required, it must be completed before the relevant processing begins.

What Should You Check Before Using Customer Data For Product Testing?

Before putting your existing customer information to work on a new project, it's worth checking that the proposed testing complies with your data protection obligations.

Some useful questions include:

• Why was the information originally collected? Review the original purpose and what customers were told.
• Is the new use compatible? Consider whether the proposed testing is permitted under the purpose limitation rules.
• What lawful basis applies? Determine whether consent, legitimate interests or another applicable basis is appropriate.
• Do you need identifiable information? Consider whether anonymous or synthetic data could achieve the same result.
• Who else will access the information? Review third-party agreements, security measures and any international transfers.

It's also worth distinguishing product testing from marketing.

If you intend to contact existing customers to promote your new product, separate rules may apply under the Privacy and Electronic Communications Regulations (PECR), alongside the UK GDPR.

Addressing these legal questions early can help avoid unnecessary complications once your new product is ready to launch.

Need Help With Your Business's Data Protection Obligations?

Existing customer information can be valuable when developing new products, but it's important to understand what your business can legally do with it.

Whether you're reviewing your privacy documentation, assessing a new use of customer information or working with external testing providers, understanding your obligations early can help avoid problems later.

Sprintlaw's legal experts can assist with Privacy Policies, Data Processing Agreements and other data protection requirements for businesses developing new products and services.

Get in touch with our team on 0808 134 7754 or email team@sprintlaw.co.uk to find out how we can help.