Confidentiality is a set of obligations that differ at each border.

A structure holds three kinds of information that somebody expects kept: the identity of the landowner whose parcel is under discussion, the identity and particulars of each holder and of the persons behind it, and the portfolio's details, its positions, its terms and its numbers. Each is protected by a law, and the law differs at each border the structure crosses. The centre's data protection law governs personal data the manager holds there and its transfer out. The onshore state's law governs the same data once it arrives, and the state's own confidentiality rules, in its companies law, its banking law and its land law, govern what the onshore vehicle may disclose. The holders' own jurisdictions' laws reach the holders' data wherever it goes. And the contracts, the non-disclosure terms with the landowner, the confidentiality clauses in the constitution and the side letters, the terms of the licensed distributor's engagement, add obligations that the laws do not. A transfer of a prospective holder's file from the manager in the centre to a licensed distributor onshore is a regulated act under the centre's law, a receipt under the state's, and a contractual act under the engagement, and a manager that sends the file by email because the distributor asked has done three things and considered none.

This note sets out the three kinds of information and who expects what, the laws that protect each and where they bind, the transfer as a regulated act, the landowner's name and the land door's particular discipline, the holder's data and the provenance file, the portfolio's details and the reporting, the licensed distributor and the onshore counterparty as recipients, the regulators' and authorities' requests, the consents and their drafting, the custody and the breach, the lender's reading, a comparison, a worked transfer as a type, cases, what each party holds, the sequence, questions, terms and what to read.

The three kinds of information

The landowner's identity and the parcel's particulars are the structure's most sensitive information on the land door, because the landowner's willingness to discuss rests on discretion and the parcel's identification before terms are agreed is a disclosure the landowner did not authorise. The holders' identity, ownership and financial particulars are personal data where the holders' owners are individuals and confidential information in any case, protected by the data protection laws and by the constitution. The portfolio's details are the fund's commercial information, protected by the constitution's confidentiality clause against disclosure by holders, and by the manager's own obligations against disclosure to anybody the constitution does not permit. Each kind has a different expectant, a different law and a different consequence of breach.

The laws and where they bind

The centre's data protection law binds the manager and the administrator on personal data they process in the centre, with rules on the basis for processing, the rights of the data subject, the security of the data and its transfer outside the centre to jurisdictions with or without adequacy. The onshore state's data protection law, where it has one, binds the onshore affiliate, the distributor and the onshore vehicle on data they hold there, and may restrict the transfer of the state's residents' data out. The holders' jurisdictions' laws bind the holders' data by reference to the holder's or its owners' residence, and a holder from a jurisdiction with a strict regime brings that regime's reach with it. Bank secrecy and companies law confidentiality in the onshore state bind the onshore bank and the onshore company on what they hold. Each law binds on its own facts, and the structure's information moves through several at once.

The transfer as a regulated act

Under the centre's law, sending personal data to a recipient outside the centre is a transfer that needs a lawful basis and, for a destination without adequacy, safeguards: contractual clauses the law approves, the data subject's explicit consent, or a specific exception. The licensed distributor onshore is outside the centre, and the prospective holder's file, with its owners' identity documents, is personal data. The manager needs the basis, the safeguards and a record of the transfer, and the distributor's engagement carries the approved clauses. The same is true of a transfer to the onshore bank for account opening, to the onshore registrar for the beneficial ownership declaration, and to the onshore authority on request. The transfer is an act the law regulates, and the structure's data map shows every transfer and its basis.

The landowner's name

On the land door the landowner's identity is held by the manager under a non-disclosure term with the landowner, and it is disclosed to nobody until the landowner agrees: not to the fund's committee in a form that identifies the parcel, not to the developer before the landowner has agreed to meet it, not to the lender before terms are agreed, and not in any document the holders receive. The discipline is the landowner's condition for the discussion and the firm's practice on the door, and it is a contractual obligation the laws reinforce where the landowner is an individual. The structure's papers describe the parcel by type, tenure, market and state of title, and name nothing, until the landowner's consent is in writing.

Why the borders multiply the obligations

A domestic structure has one data protection law, one confidentiality regime and one set of contracts, and the three align because they were written for the same jurisdiction. A cross-border structure has the same information in four jurisdictions, and each jurisdiction's law reaches the information while it is there and, in the stricter regimes, after it leaves. The obligations do not merge into the strictest; they stack, and a transfer satisfies the sender's law, the recipient's law and the contract or it satisfies none of them in the reading of whichever regulator looks. The structure manages the stack with the data map, which is the only document that shows all four jurisdictions' obligations on one piece of information at once.

The land door's discipline in detail

The landowner's condition is discretion, and the firm's practice on the land door is built to it. The manager's papers describe the parcel by typology, market, state of tenure and the structure it suits; they do not name the parcel, the owner, the area, the price or any return. The committee reads the type and approves the approach in principle. The developer is told the type and the market and meets the landowner only when the landowner has agreed to meet. The lender is told nothing until terms are agreed. The holders' reports name the parcel only after it is acquired. The discipline is contractual, under the non-disclosure terms, and it is also the firm's own rule on the door, because the landowner's willingness to discuss is the access, and access disclosed is access lost.

The non-disclosure terms

The landowner's non-disclosure terms name the information covered, the persons to whom the manager may disclose it and on what conditions, the purposes, the period, the return or destruction of the information if the discussion ends, and the consequences of breach. They are drafted by the manager's counsel to the landowner's condition and reviewed by the landowner's. They bind the manager and, through the manager's own engagements, its affiliates, its advisers and its counsel; they do not bind the fund's committee or the developer until each has signed its own, and the manager discloses to neither until it has. The terms are the first document on the land door, and the structure's papers are written within them.

The holders' data and the provenance file

The provenance file is the densest personal data the structure holds: identity documents, addresses, ownership charts to natural persons, wealth and income evidence, politically exposed status. It is collected under the anti-money-laundering rules, which give the processing its lawful basis, and it is transferred among the parties under the reliance arrangement, which needs the transfer safeguards. The holders' consent in the subscription documents covers the collection, the transfers to named categories of recipient in named jurisdictions, and the disclosure to regulators and authorities on request, and the consent is drafted to the strictest of the holders' regimes. A holder's owner who exercises a right of access or erasure under its own law is answered under that law, and the anti-money-laundering retention obligation is the usual answer to erasure.

The portfolio's details

The constitution binds each holder to confidentiality over the fund's reports, its positions and its terms, with exceptions for the holder's own advisers, regulators and, for public-body holders, the disclosure their own law requires. A public pension institution or a sovereign that must publish its holdings publishes the fund's name and its commitment and returns, and the constitution's exception is drafted to what the holder's law requires and no more. The manager's own obligation is to disclose the portfolio only to the persons the constitution names: the holders, the committee, the administrator, the depositary, the auditor, the valuer, the lender, and the regulators. A presentation to a prospective holder that shows the portfolio is a disclosure under the constitution and a marketing document under the marketing rules, and both are satisfied or it is not sent.

The recipients

The licensed distributor receives the prospective holder's data to classify and to offer; it holds it under the state's law and its engagement's confidentiality terms, and it may not use it for its own purposes. The onshore counterparty, the developer or the joint venture partner, receives the fund's identity and its holders' identity to the extent the onshore regime's beneficial ownership rules require and no further, under the joint venture agreement's confidentiality clause. The onshore bank receives the chart. The onshore registrar receives the declaration, which in some states is public. Each recipient is a transfer with a basis and a term, and the data map names each.

The regulators' and authorities' requests

The centre's regulator may require the manager's records; the onshore authorities may require the onshore vehicle's beneficial owners and the fund's holders; a foreign authority may request information through the exchange arrangements. Each request is answered under the law that compels it and under the consents the holders gave, and a request the manager cannot lawfully answer, because the holder did not consent and the requesting authority's law does not compel the manager, is a request the manager answers by stating the position. The subscription documents' consent to disclosure to regulators and authorities in named jurisdictions is what makes most requests answerable, and a consent drafted to the centre alone leaves the onshore authority's request unanswerable.

The consents

The consents in the subscription documents and the landowner's non-disclosure terms are drafted to the laws: the categories of data, the purposes, the recipients by category and jurisdiction, the transfers and their safeguards, the retention periods, the holder's rights and how they are exercised, and the regulators and authorities to whom disclosure may be made. A consent drafted generally, to any disclosure the manager considers necessary, is a consent the stricter laws do not recognise, and the transfers made under it are transfers without a basis. The consents are drafted by counsel in the centre to the centre's law and reviewed by counsel in the holders' jurisdictions to theirs.

Custody and breach

The data is held by the administrator and the manager in the centre under the centre's security requirements, by the distributor and the affiliate onshore under the state's, and by each recipient under its own. A breach, a loss or unauthorised access, is notifiable under the centre's law within a period, under the onshore law within its period, and under the holders' laws within theirs, and the notification goes to the regulators and in some cases to the data subjects. The administrator's engagement carries the security standard, the breach procedure and the notification obligations, and the manager's own procedure runs alongside.

The lender's reading

A lender receives the fund's register, the holders' identities and the portfolio's details under the facility's confidentiality terms and its own data protection obligations, and the facility names what it receives and what it may do with it. The lender's transfer of the data to its own affiliates or to a participant is a further transfer under the centre's law, and the facility's data clauses carry the safeguards.

By information · by law	The expectant	The law that protects it	Where it binds	The consequence of breach
The landowner's identity and the parcel	The landowner	The non-disclosure term; data protection where an individual	Wherever the manager holds it	The landowner's withdrawal; a claim
The holders' identity and owners	The holders and their owners	Data protection in the centre, onshore and in the holders' jurisdictions; the constitution	Each jurisdiction the data enters	Regulatory penalty; the holders' claims
The provenance file	The holders' owners	Anti-money-laundering rules for the basis; data protection for the transfer	Each party's jurisdiction	Penalty; a transfer without basis
The portfolio's details	The fund and the manager	The constitution's confidentiality clause; the marketing rules	The holders and the recipients	Breach of the constitution; a marketing breach
Onshore company information	The onshore company	Companies law, bank secrecy	The onshore state	Onshore penalty

A transfer, as a type

A manager in a centre engages a licensed distributor in a Gulf state to offer the fund to the state's institutions. The structure's data map shows the transfer: the prospective holder's particulars from the manager to the distributor for classification and offer. Counsel in the centre confirms the basis, the legitimate interest in the offer and the holder's consent obtained at first contact, and the safeguards, the approved clauses in the distributor's engagement, because the state lacks adequacy under the centre's law. Counsel in the state confirms the distributor's obligations under the state's law and the engagement's confidentiality terms. The distributor receives the particulars through the administrator's secure channel, holds them under the state's law, classifies and offers, and returns the subscription with the provenance file built to the strictest standard. The subscription documents carry the holder's consent to the transfers the data map names and to disclosure to the centre's regulator and the state's authorities. In year three the state's authority asks the onshore vehicle for the fund's holders; the manager answers under the consent. The landowner's name, for the parcel the fund is considering, appears in none of it.

The structure paper's page

The structure paper carries a page on information: the three kinds and their expectants, the laws per jurisdiction, the data map, the consents' drafting standard, the non-disclosure terms' form, the engagements' clauses, the custody and security standard, the breach procedure with each regime's notification period, and the land door's discipline. The page is written before the first distributor engagement and the first landowner discussion, and it is the page the administrator builds the secure channel from.

The exchange of information between authorities

The onshore state, the centre and the holders' jurisdictions exchange tax and regulatory information under treaties and multilateral arrangements, and the fund's holders' identities and the onshore vehicles' beneficial owners travel between authorities without the manager's act. The subscription documents tell the holders so, because a holder from a jurisdiction that will receive its particulars from the onshore state's authority is a holder whose expectation of confidentiality the law has already limited. The data map shows the exchanges the manager knows of as transfers the law makes, and the holders' counsel read them.

The second fund's reading

A manager's second fund is raised from holders whose owners' data the first fund held, and the second fund's subscription documents ask for the consent again, for the new fund's recipients and jurisdictions. A first fund whose data practice was mapped, whose consents covered every request and whose breach procedure ran when tested is a fund whose holders' compliance teams sign the second consent without a query; one whose transfers were emails and whose consent covered one jurisdiction is a fund whose holders' compliance teams read the second consent line by line. The landowners read the record too, in their own way: a manager whose discretion held is a manager the next landowner will talk to.

The holder's owner's rights

An individual behind a holder has rights under the data protection laws that reach the fund's file: to know what is held, to correct it, to object to some processing, and in some regimes to have it erased. The rights are exercised against the manager or the administrator under the law of the individual's jurisdiction where it reaches and under the centre's law in any case, and the administrator's procedure answers them within each law's period. The anti-money-laundering retention obligation overrides erasure for the file's contents during the retention period, and the answer says so with the law cited. An individual who objects to the transfer of the file onshore is an individual whose holder cannot be taken through the onshore chain, and the manager tells the holder.

Four cases, as types

A manager emails a prospective holder's file to a distributor onshore because the distributor asked. The centre's regulator, on a routine review of the manager's data practices, finds a transfer without safeguards to a jurisdiction without adequacy, and the holder's owner, an individual, complains under the centre's law.

A fund's subscription documents consent to disclosure to the centre's regulator only. The onshore authority asks the onshore vehicle for the fund's holders' identities, the manager cannot lawfully disclose and cannot lawfully refuse, and the onshore vehicle's licence is conditioned until the holders consent individually.

A manager's paper to the committee on a parcel under discussion names the landowner and the parcel. A committee member's representative mentions it to a developer, the landowner learns, and the discussion ends.

A structure maps every transfer, drafts the consents to the strictest law, carries the safeguards in every engagement, describes parcels by type until the landowner consents, and answers requests under the consents. Nothing leaves a jurisdiction without a basis, and the landowner's name leaves nowhere.

What each party holds

The manager holds the data map, the consents, the landowner's non-disclosure discipline and the transfer records.

The administrator holds the provenance files, the security standard and the breach procedure.

Counsel in the centre holds the centre's law; counsel onshore holds the state's; the holders' counsel hold theirs.

The distributor, the affiliate, the bank and the counterparties hold their receipts under their laws and terms.

The committee holds the portfolio's details under the constitution and the parcel's description by type.

The lender holds its receipt under the facility's terms.

Where it surfaces

It surfaces at the first distributor engagement, when the distributor asks for the prospective holders' particulars. It surfaces at the subscription documents, when a holder's counsel from a strict regime reads the consent. It surfaces at the onshore bank's account opening, when the chart goes onshore. It surfaces at the committee's paper on a parcel. It surfaces at the onshore authority's request. It surfaces at the public-body holder's published report. It surfaces at the breach, when the notification clocks start in three jurisdictions. And it surfaces at the landowner, when a name that should have stayed in one file is heard in a meeting.

The cost of getting it wrong

A transfer without basis costs the centre's regulatory penalty and the data subject's claim. A consent drafted to one jurisdiction costs the onshore authority's request unanswerable and the onshore vehicle's licence conditioned. A landowner's name disclosed costs the access, which on the land door is the business. A breach unnotified costs the penalties of three regimes. The cost of the data map, the consents and the discipline is counsel's week at design and the administrator's secure channel, and the discipline is free.

The committee's reading

The committee reads the data map annually with the administrator's security report and the breach log, and it reads the consents' coverage against the jurisdictions the fund has entered since the last reading, because a new onshore state is a new recipient and a new law. It reads the land door's papers for the discipline, and a paper that names a parcel before the landowner's consent is a paper the chair returns. It reads the public-body holders' disclosure exceptions against what those holders published. And it reads the requests the manager answered in the year and the basis for each.

A timeline, as a type

At design the three kinds of information are listed, the data map is drawn, and the consents and non-disclosure terms are drafted to the strictest law and the landowner's condition. At the first close the subscription documents carry the consents; the administrator's secure channel is the only route for files; the distributors' engagements carry the approved clauses. In year one a parcel is discussed; the committee's paper describes it by type; the landowner consents in writing in month four and the developer is told. In year two the onshore bank receives the chart under the consent and the state's law. In year three the onshore authority asks; the manager answers under the consent. In year four the public pension institution publishes its holding under the constitution's exception. In year five a distributor's laptop is lost; the breach procedure runs; the notifications go out within each regime's period; the data was encrypted and the regulators close the file. The landowner's name, in five years, appeared in one document, signed by the landowner.

The sequence

1. The three kinds of information are listed with their expectants and the laws that protect each in each jurisdiction.
2. The data map is drawn: every holder of each kind, every transfer, its basis and its safeguards.
3. The consents are drafted to the strictest law and the non-disclosure terms to the landowner's condition.
4. Every engagement carries the confidentiality terms and the transfer safeguards.
5. The custody, the security standard and the breach procedure are fixed at the administrator and the manager.
6. Requests are answered under the consents, and the landowner's name is withheld until the consent is written.

Questions a manager asks

Does the centre's law reach data about companies. Personal data is about individuals; the holders' owners and signatories are individuals, and the file is personal data for their particulars.

What about a public registrar's declaration. The onshore registrar's beneficial ownership record may be public under the state's law, and the holders are told at subscription that it is.

Can the committee see the portfolio. Under the constitution, yes, on the committee's confidentiality terms; a parcel under discussion is described by type until the landowner agrees.

How long is the data kept. The anti-money-laundering retention period for the file; the constitution's period for the portfolio; the landowner's terms for the parcel; each the longest its law requires.

Who answers a holder's owner's access request. The administrator under its engagement, on the manager's instruction, under the law of the owner's jurisdiction where it reaches.

Is the distributor's onward transfer to its own group permitted. Only if the engagement permits and the safeguards run to the group; most engagements forbid it.

Terms used

Data map: the record of every holder of each kind of information, every transfer, its basis and its safeguards.

Transfer: the sending of personal data to a recipient in another jurisdiction, regulated under the sender's law.

Adequacy: a jurisdiction's recognition of another's data protection as equivalent, permitting transfers without further safeguards.

Approved clauses: contractual terms a data protection regime accepts as safeguards for transfers.

Non-disclosure term: the landowner's condition for discussion, binding the manager to withhold the identity and the parcel.

Consent: the holder's or the landowner's written agreement to the processing, transfers and disclosures named.

What to read

The centre's data protection law and its transfer rules; each onshore state's data protection, companies and banking confidentiality laws; the holders' jurisdictions' laws; the constitution's confidentiality clause and exceptions; the subscription documents' consents; the landowner's non-disclosure terms; each engagement's confidentiality and data clauses. On this site, the access room under Land, the perimeter room under Jurisdictions and the DIFC law room.