Managing startup funding data, from lawful basis to a minimised data room

A funding process can collect names, contact details, ownership data, signatures, employment records and sensitive founder information. Financial models and contracts may also identify customers or staff. Map personal data before opening a data room or sending an investor list.

This guide is general information about UK data-protection controls. The organisation needs its own assessment and qualified advice where risk or uncertainty warrants it.

What to take away

Define purpose and roles

List each use: finding investors, handling enquiries, conducting diligence, completing a transaction and reporting after investment. Do not keep one broad purpose called "fundraising" if different parties make different decisions about the data.

Determine who is controller, joint controller or processor. The ICO's controllers and processors guidance explains that roles follow actual decisions and responsibilities. A contract label does not settle the question if practice differs.

Establish a lawful, fair process

Record the lawful basis for each processing purpose and update privacy information. Consent to receive a pitch, sign a non-disclosure agreement or join a meeting is not automatically UK GDPR consent.

The ICO's UK GDPR guidance hub covers principles, lawful bases, rights, security and accountability. Check current guidance because legislation and regulatory material can change.

Avoid buying or scraping contact lists without assessing source, expectations, transparency and direct-marketing rules. The ICO's direct marketing guidance should be reviewed before email, text, direct-message or similar outreach.

Minimise the data room

Create staged folders. Early review may need a summary rather than employee files, customer-level exports or complete identity documents. Redact irrelevant personal data and use aggregated customer evidence where it answers the question.

Typical virtual data-room providers include Datasite, Intralinks, Ansarada, Firmex and Box. Some early rounds use general tools such as SharePoint, OneDrive, Google Drive or Dropbox, which need the same access and retention settings.

A diligence request for a top ten customer list can be answered with customer codes, sector and revenue band instead of names, email addresses and contract values. Record that redaction in the data map with the date and the reason.

Assign named access, multifactor authentication where supported, expiry and download controls. Log recipients and remove access after rejection, withdrawal or completion. Do not use an open link merely because the document is described as confidential.

Govern suppliers and advisers

Map virtual data-room providers, CRM systems, email tools, analytics, transcription, accountants and advisers. Check role, contract, security, sub-processors, international transfers, deletion and incident reporting. Confirm what happens to backups and exported copies when the service ends.

Keep professional confidentiality duties distinct from controller and processor obligations. One does not automatically satisfy the other.

Retention, rights and incidents

Set retention by purpose and legal need, with dated periods rather than open-ended storage. A failed funding round typically justifies deleting pitch decks, rejected investor correspondence and duplicate working files 12 months after the process ends.

Keep accounting and transaction records longer. HMRC expects records to be kept for six years from the end of the accounting period. The Companies Act 2006 sets three years for a private company's accounting records, so the longer period usually controls.

Completed transaction records are typically held for six years, and longer while a shareholder dispute or tax enquiry is open.

Provide routes for privacy questions and rights requests. Make files searchable enough to locate a person's data. Maintain an incident plan for misdirected decks, exposed rooms, compromised accounts and unauthorised downloads.

Report a notifiable personal data breach to the ICO within 72 hours of becoming aware of it. The ICO's guidance on personal data breaches explains the test.

The ICO's right of access guidance covers the one month deadline for responding to a subject access request and the limited grounds for extending it.

Publication controls and enforcement

Obtain permission before naming investors, staff or customers in a case study. Removing a name may not anonymise a distinctive round. Review screenshots and exported charts for hidden identifiers and metadata.

An illustrative description such as the only seed of its size in a named city in a named month can identify a company and its founders after names are removed.

The ICO publishes enforcement action, including fines of up to GBP 17.5 million or 4 per cent of total annual worldwide turnover, whichever is higher, alongside reprimands and enforcement notices. Read the ICO's Guide to the UK GDPR and its enforcement action pages before treating a breach as not reportable.

Keep an auditable data map

For each dataset, record fields, source, purpose, lawful basis, controller, processors, access groups, location, retention and deletion method. Link the entry to the relevant notice and contract. Update it when a new adviser, investor platform or diligence request changes the flow.

Test deletion and access removal rather than relying on a policy statement. Check local downloads, shared drives, email attachments and back-up behaviour. Where records must be retained, restrict them and document the reason instead of leaving the entire working room open.

Train the people who administer access. A secure platform cannot prevent a founder from sending the wrong folder or granting permission to a personal address without review.

Action checklist

Common questions

What should be done before opening a data room or sending an investor list?

Map the personal data involved before the room opens or the list goes out, and keep the map current.

How should lawful basis be handled for fundraising processing?

Record a separate lawful basis for each purpose; consent to a pitch, an NDA or a meeting is not UK GDPR consent.

What controls should be applied to a data room?

Stage the folders, redact personal data, and use named access, multifactor authentication, expiry and download limits.