Finding UK geodata is rarely the hard part. The hard part is working out what you are allowed to do with it — on a commercial project, on a public map, or inside a product you intend to sell. A dataset can look open and turn out to be licensed for internal use only. It can be free to a public body but not to the consultancy working for it. It can require you to credit three organisations in a specific order, and to keep crediting them on every derived layer. None of that is hidden, exactly; it is just scattered across metadata pages, licence PDFs and terms written for procurement teams rather than for people building things. Work through the checks below before you download, not after you have shipped.

Start with the source, not the file

Anyone can rename a shapefile. The licence lives with the publisher, not with the download, so go back to the organisation that produced the data and read their page rather than the copy sitting on a shared drive. Look for four things: the exact licence name and version — the Open Government Licence v3.0, ODbL 1.0, CC BY 4.0 — the date the licence was applied, the geographic coverage, and whether you have the current release. Datasets get re-released under different terms, and a file saved two years ago may no longer reflect what the publisher actually permits. If the metadata states no licence at all, treat that as unresolved rather than permissive.

Five questions to ask of any licence

Most UK geodata decisions come down to the same handful of questions. Answer them in writing before you commit.

1. Who owns the rights? Crown copyright, database right, a private company, or a mixture. Ownership tells you who to ask when the licence text is silent.
2. What is permitted? Copying, adapting, publishing, sub-licensing. Many licences allow the first three and quietly forbid the fourth.
3. Is commercial use allowed? This is the most common tripwire. Anything described as non-commercial, internal use only, or for evaluation restricts what you can sell or publish.
4. What attribution is required? Exact wording, placement, and whether it must appear on derived products and in data exports.
5. What happens to derived data? Some licences say nothing; others impose share-alike obligations or assert rights over anything produced from the source.

If you cannot answer all five from the licence text, email the publisher. That message costs nothing; a rebuild does not.

Attribution: small print with a long reach

Attribution is the condition teams most often get wrong, usually by leaving it out. Open Government Licence material needs a statement such as Contains public sector information licensed under the Open Government Licence v3.0. Ordnance Survey open data is normally credited with Contains OS data © Crown copyright and database right followed by the year. OpenStreetMap asks for © OpenStreetMap contributors.

Where the credit has to appear

A footer on a website is not enough. If you publish a PDF map, the credit belongs on the map or in its credits. If you export a CSV, it belongs in the metadata or a readme. If you build a tile layer, it needs to be visible on the map itself. If you hand data to a client, the credit travels with it. Put the required strings in one place in your codebase — a single template, a single line in the export script — so a new layer cannot quietly ship without them.

Commercial reuse: where projects fall over

Commercial reuse is broader than selling data. Charging for a report that contains a map, using geodata inside a paid app, or including a dataset in a consultancy deliverable all count. Under the Open Government Licence that is generally fine: it permits commercial and non-commercial reuse, and does not impose share-alike conditions. The difficulties tend to come from somewhere else:

• Non-commercial licences, which are workable for coursework and not for client work.
• Evaluation or trial terms that expire quietly.
• Public-sector-only agreements, where a council can use a dataset but its contractor cannot.
• Address and postcode products, which are licensed commercially and often restrict redistribution and derived outputs.

Read the redistribution clause carefully. A licence can allow internal use while forbidding you from passing the data on, publishing it, or embedding it in something a customer could extract it from.

Derived data, tiles and share-alike

This is where the reasoning gets subtle. OpenStreetMap's ODbL, for example, requires that a derivative database you publish is licensed on the same terms, while a rendered map image — a produced work — mainly needs attribution. That distinction matters when you are deciding whether to release a routing graph or only the map built from it. Similar questions arise with tiling: the tile layer is usually a produced work, but the extract feeding it may not be.

If a product depends on derived output from a share-alike or restricted dataset, get advice before launch. Licence questions are also worth raising early when a dataset contains personal information, such as addresses tied to individuals, since data protection obligations sit alongside the licence rather than replacing it.

Keep a licence record

Six months from now, nobody will remember which file came from where. A short register saves hours of archaeology during due diligence or an audit.

• Dataset name, publisher and the address of the licence page.
• Licence name and version, plus the date you checked it.
• The attribution string, copied exactly.
• Whether commercial use and redistribution are permitted.
• Any conditions affecting derived outputs.
• Who confirmed it, and when.

Keep the register in the repository alongside the code, not in somebody's inbox. Adding a line to your pull request template — does this change introduce a new dataset? — takes a minute and prevents an awkward conversation later.

Before you publish

The routine is short. Identify the publisher, read the current licence, confirm the commercial and redistribution position, place the attribution where people will actually see it, and write down what you decided. Where anything is ambiguous — a missing licence, an unclear derived-data clause, personal information in an address dataset — ask the publisher or take professional legal advice. A licence question raised before launch is a paragraph in an email. Raised afterwards, it is a rebuild.

Photo: Kampus Production / Pexels