You may need client permission before sharing business data through a platform. The answer depends on the material, your agreements, the proposed use and the laws that apply. Existing permission might cover a particular use, or you may need further approval. There is no blanket answer based on who saved the files.
A platform such as OpenSet can be part of the route you assess, but participation still needs a clear rights and privacy review. Start with one collection and its paperwork before uploading real records. The legal examples below concern UK copyright and data-protection guidance and U.S. copyright rules. They are a practical starting point, not a determination for your business.
What exactly would you be sharing?
Describe the proposed collection in ordinary language. It might contain your work notes, customer requests, final outcomes and attachments supplied by a client. Those components can raise different questions even when they sit in the same export.
Also describe who would receive it and why. The first upload to a platform for preparation is itself a step to consider. Later access by another organization may involve a different purpose and different permissions.
Ask the platform for an explanation of the proposed handling before preparing a client permission request. What needs to leave your systems? Who can access the original material? What will be retained? What uses would a later license allow?
If those details aren't settled, begin with a general description of the category that reveals no confidential or personal information. A client cannot give informed approval to an arrangement neither of you can explain.
Read the agreements that already exist
Find the contract, statement of work, confidentiality terms and later amendments. Include any data-processing agreement or separate terms accepted when using the client's systems. Check whether obligations continue after the project ends.
Look for provisions covering ownership, reuse, permitted purposes, disclosure to others, retention and deletion. Record the clauses that appear relevant and the questions they leave open. Don't rely on a friendly conversation about a different project or use.
For example, permission to display a finished design in your portfolio may say nothing about sharing drafts and client comments in a commercial dataset. Approval to use a client's company name may say nothing about the messages written by its customers.
If a clause is unclear, keep that material outside the proposed release while you obtain advice or clarification. You can continue inventorying other records without treating silence as permission.
Check copyright ownership where it matters
Under the UK Intellectual Property Office's guidance, a freelancer working under a contract for services will usually retain copyright unless an agreement says otherwise. For commissioned copyright work, the creator is generally the first owner unless otherwise agreed in writing. A client may have a limited implied license for the commissioned purpose without owning the copyright.
Those are starting positions for reviewing the agreement. They do not settle confidentiality, personal-information handling or rights in material supplied by someone else.
In the United States, the Copyright Office's work-made-for-hire guidance distinguishes qualifying employee work from certain specially commissioned works. The latter route requires a qualifying category and an express signed written agreement. Paying an invoice alone does not resolve the classification.
Use the rules relevant to the actual work and agreement. If a project combines contributions from several people, identify whose protected material appears in the proposed collection. Don't assume one client's approval settles every contributor's rights.
Separate client approval from the privacy assessment
A client may be able to approve a use of its confidential business material without being able to resolve every question about individuals mentioned in the records. Customer messages, employee notes and contact details require their own assessment.
For personal information covered by UK GDPR, the ICO's purpose-limitation guidance, updated in March 2026, requires a lawful basis for a new purpose and compliance with the applicable compatibility rules. The rules differ where the original collection relied on consent. Consent is not the only possible lawful basis, and a client's general approval is not automatically the relevant consent.
Have a qualified adviser assess your role, the original purpose, the proposed processing and any notices or permissions already in place when needed. The review should cover the actual handling, including preparation and onward access.
If a permitted route cannot be established, exclude the affected material. A possible payment doesn't change the permissions you hold.
What if names are removed?
Removing obvious identifiers does not by itself settle whether people remain identifiable. The ICO's anonymisation guidance calls for considering the information, likely recipients and reasonably available additional information. It also requires the assessment to be documented and reviewed. The page carried an under-review notice when checked in October 2026.
A distinctive event or unusual job description can warrant attention even when an email address is gone. Ask how the particular release will be assessed and what happens if the remaining risk is unacceptable.
Keep the other restrictions in view too. Even an effectively anonymized version may contain copyright-protected work or information covered by confidentiality terms. Do not treat a privacy preparation step as legal clearance for the whole collection.
Count the records that are actually eligible
Consider a hypothetical collection of 600 project records. After the relevant rights and agreement checks, 360 remain candidates. Of those, 240 satisfy the separately required privacy review for the proposed handling. Of those, 160 contain enough context to be useful for the proposed collection.
The final share is 160 divided by 600, or about 26.7%. This is an illustration of sequential filtering, not a legal assessment or a typical acceptance rate. It assumes each later group is contained within the previous one.
The reasons for exclusions matter. There are 240 records excluded at the rights stage, another 120 at the privacy stage and another 80 for insufficient context. Extra client permission would not repair missing information in those last 80 records.
Keeping these reasons separate helps you choose the next useful action. You might resolve one agreement question, reduce the proposed collection or decide the remaining work is too large. You don't need to force every old project into the same outcome.
Make any permission request specific
Where further approval is needed, prepare a concise description of the material, recipients, intended uses, safeguards and duration. Explain any proposed onward sharing. Have the wording reviewed when the consequences or agreements are complex.
Ask how corrections, complaints and ending future supply would work. Establish what happens to copies already licensed and any uses already carried out before promising that everything can be removed later. Keep the approved description with the exact version released.
A request should leave room for the client to decline. Preserving a trusted relationship may be worth more than including that project in a collection.
Review one project before scaling up
Pick a representative project and follow its rights, privacy and practical questions from beginning to end. You may find a collection suitable for platform assessment, a specific permission request or a reason to exclude it.
Use what you learn to make the next review easier, while checking for different contract terms and sources. The useful goal is a collection whose permitted handling you can explain and document. That gives you a sounder basis for participation than either assuming every file is available or asking clients for an unnecessarily broad approval.
