Can You Share It? Contracts, NDAs, Personal Data and Sign-Off

Three questions decide almost everything. Answer them honestly, in this order:

1. Is it ours? Do we own the rights in these records, or are we using someone else's material?
2. Does a contract or a law limit what we can do with it? Customer contracts, NDAs, licences and data protection law all matter.
3. Has someone with authority agreed we should explore this? The business, not an individual, decides.

Records that your own employees created in the course of their jobs are often owned by the business, but not always, and the answer depends on contracts and circumstances. Material created by contractors, freelancers, agencies or software vendors is a different matter: unless an agreement assigns the rights to you, you may only have permission to use it, not to pass it on.

Things to look for:

• Contractor and freelancer agreements. Do they assign rights in the work, or only license them?
• Templates and frameworks you bought or copied. Many are licensed for internal use only.
• Content derived from a client's materials, such as a process you built from their specification.
• Third-party text inside your documents: standards, vendor manuals, regulatory material.

Know-how that is kept confidential can also be protected as a trade secret. WIPO describes trade secrets as information that has commercial value because it is secret, is known to a limited group, and is protected by reasonable steps to keep it secret. Sharing it carelessly can weaken that protection, which is one reason to take advice before any disclosure.

Customer and supplier contracts

Look for confidentiality clauses, restrictions on using client information for other purposes, and clauses that survive after the contract ends. Some forbid disclosing even the fact that you work with a client. Records that mention a client's name, systems, pricing or processes are the most likely to be affected.

NDAs

An NDA you signed with a client, partner or supplier may cover information you now hold in your own documents. Check the definition of confidential information and how long the obligation lasts.

When you hold data for someone else

If a client gives you personal data to process on their behalf, you may be a processor rather than a controller under UK data protection law. A processor generally acts on the controller's instructions and cannot use that data for its own new purposes. The ICO's controllers and processors guidance explains the roles.

Regulated and privileged material

Legal professional privilege, regulated financial or health information, and anything covered by sector rules each carry their own limits. If you work in a regulated sector, these usually need specialist advice before anything else.

Operational records are full of personal data once you look closely: names in project files, email addresses in ticket histories, staff details in review notes, and combinations of facts that point to one person even without a name.

If records contain personal data, UK data protection law applies. The UK GDPR and the Data Protection Act 2018 require, among other things, a lawful basis for the processing, that people are told how their data is used, and that data is used only for compatible purposes. The ICO's guide to lawful basis currently sets out seven lawful bases: consent, contract, legal obligation, vital interests, public task, recognised legitimate interest and legitimate interests. The law and guidance have been changing, so rely on the ICO's current pages rather than older summaries.

Two points matter for planning:

• A new purpose needs a basis. Records collected to deliver a service to a customer, or to employ a person, were not necessarily collected so they could be licensed to someone else. Whether that new use is permitted depends on facts and on advice.
• Anonymisation is hard to get right. The ICO's anonymisation guidance explains that whether data is anonymous depends on whether people can be identified by means reasonably likely to be used. Pseudonymised data, where names are swapped for codes, is still personal data. If a large-scale or high-risk use is planned, a data protection impact assessment may be needed.

If you handle personal data in the UK you may also need to pay the ICO's data protection fee unless an exemption applies.

Work communications are the most sensitive family of record. They tend to contain personal data about staff and customers, confidential commercial information, candid opinions and sometimes legal advice. Whatever a buyer may be willing to consider, treat these as red until an adviser tells you otherwise.

Exploring a data partnership is a business decision, not a personal one. Whoever has authority over contracts and confidential information, typically a director, owner or general counsel, should agree before anyone makes an enquiry. A short memo is usually enough. Here is a template you can adapt.

Get advice before any records leave your control, and before you agree to anything with a buyer. A solicitor with commercial and data protection experience can read your contracts against the inventory. A data protection professional can assess personal data and anonymisation. An accountant can explain the tax treatment of any income.

Bring your inventory, the amber and unsure rows highlighted, and the contracts that touch them. Specific questions get specific answers.

We are an independent introduction service. We do not review, clear, value, hold or negotiate over your records, and we never ask you to upload them. If you decide to go ahead, our free eligibility check asks high-level questions and, where a buyer's published criteria appear to be met, points you to that buyer's own application. We may be paid by a buyer if an introduction leads to a qualifying commercial relationship. That is explained on our disclosure page.