Company secretaries: sharing board papers without leaking inside information
Board packs hold inside information, personal data and privileged advice. See what to mask before sharing them with advisers, new directors or AI tools.
A board pack is the most sensitive document a company produces. In one file, it can hold unpublished results, a deal under a code name, a director's salary, and a lawyer's advice. Before it leaves the boardroom, someone has to decide what the next reader is allowed to see.
Take Jane Example, company secretary at a mid-cap manufacturer. An auditor asks for last quarter's board pack. She cannot send it as it stands: it still names a takeover target and lists two directors' bonuses line by line.
What makes board papers different from other documents?
A board pack mixes several kinds of sensitive material in one file. Unpublished financial results can move a share price on their own. A live deal usually carries a project name, plus a value, a timeline and a counterparty. Employee and director pay sits next to legal advice that stays privileged only while it remains inside the company.
- Inside information: results, forecasts and deals that are precise, not public, and able to move the share price
- Personal data: named salaries, home addresses, health notes, performance reviews
- Privileged legal advice: counsel's opinions and litigation strategy
- Competitive strategy: pricing plans, market entry, named partners
- Third-party confidential information: a supplier's terms, or a target company's own figures
What does the Market Abuse Regulation say about inside information?
For a listed company, the EU Market Abuse Regulation, known as MAR, sets the bar. Article 7 defines inside information as precise, not public, and likely to move the share price if it came out. According to the AMF, France's regulator, it is the issuer's job to work out the moment information becomes inside information. When in doubt, the AMF advises disclosing it promptly rather than waiting for a final press release.
MAR does not stop at insider dealing. Article 10 forbids unlawfully disclosing inside information outside the normal course of a person's job, as the FCA's guidance on UK MAR states. Article 18 then requires the issuer to keep an insider list of everyone given access, including an outside adviser. The issuer must hand that list to the regulator on request.
What confidentiality duty do directors owe, in France, Germany and the UK?
| Jurisdiction | What the rule says | Source |
|---|---|---|
| France | Directors, and anyone allowed into a board meeting, "are bound to discretion" over information the chair marks as confidential. | Code de commerce, article L225-37 |
| Germany | Management board members must keep silent about confidential matters and trade secrets learned through their board work. Supervisory board members owe the same duty. | Aktiengesetz, sections 93 and 116 |
| United Kingdom | No single confidentiality clause exists. Directors must act to promote the company's success and avoid exploiting company information for a conflicting interest. | Companies Act 2006, sections 172 and 175 |
The duty sits on the person, not on the paper. A masked board pack does not remove a director's confidentiality duty, and an unmasked one does not create it. What masking changes is the damage if the file reaches someone the duty never covered, such as a supplier or a future buyer.
What should you mask for each audience outside the board?
A board pack travels to very different readers, and each one needs a different cut of the same file.
- External adviser, such as an auditor, a bank or a lawyer: strip whatever sits outside their mandate, and confirm they are on the insider list before you attach a live deal file
- New director onboarding: mask code names, figures and dates from matters they did not sit on, and brief them live instead of handing over the archive
- AI summary tool: mask names, figures and identifiers before any text leaves your device, since a cloud tool becomes a new outside party with its own storage rules
- Template reuse, for next quarter or another company: check a supposedly clean template line by line, since names and numbers from its first use often survive a copy and paste
One practical step: ONYRI Sanitize masks names, company names followed by a legal form, IBANs and amounts with a currency, in the browser, before a board pack leaves the company. A custom rule, or the "Search the document" tool, catches a project code name on every page. Its limit: it cannot judge what counts as inside information. A person who knows the deal decides what stays, and checks the preview before download.
Why does a project code name fail to protect a deal?
A code name hides one thing: the target's name. A paper for "Project Falcon" can still show a value of 340 million euros and a signing date in November. It can still describe the target as "our largest competitor in packaging." Anyone working in that sector can fill in the blank within a day.
This is re-identification through the details left behind, not through the name that was removed. A date, a sector, a value and a role are called quasi-identifiers. None of them names the deal on its own, but a small set of them, put together, usually does.
| Board paper section | Main risk if shared unmasked | What to mask | What to keep |
|---|---|---|---|
| Financial results, before release | Insider dealing, unlawful disclosure under MAR | Exact figures, growth rates, the release date | The fact that results are on the agenda |
| Deal or project papers | The deal's identity leaks despite the code name | Target name, value, counterparties, timeline, sector detail | That a strategic review is under way |
| Personnel and remuneration | Personal data of a named employee or director | Salaries and bonuses tied to a name, health notes | Aggregate pay bands, the policy itself |
| Legal advice and litigation notes | Loss of legal privilege, reputational harm | Counsel's advice, case specifics, settlement figures | That a matter exists, in general terms |
| Strategic plan | Competitive harm if it reaches a rival or a supplier | Market entry plans, pricing, named partners | The plan's general direction, once the board has approved it |
A board pack does its job when the board reads it whole and every other reader gets only their own slice. Build the habit of asking, for each attachment: who is this page for, and what does it still show once the obvious name is gone.
Frequently asked questions
Who has to go on the MAR insider list when a board pack reaches an external adviser?
Article 18 of MAR requires the issuer to list everyone who gets access to inside information through their role. That includes an outside adviser, bank or lawyer working the matter. The issuer keeps the list current and hands it to the regulator on request. Whether a given document holds inside information is a judgment call: ask your company's compliance or legal team.
Does masking a board pack replace a director's duty of confidentiality?
No. The duty binds the director as a person, however the information was learned. Masking protects the file itself. It limits the damage if it is forwarded by mistake, or reaches someone the duty never covered, such as a supplier running due diligence later.
Is a code name enough to protect a deal before it becomes public?
Rarely. A code name hides the target's name, but a board pack usually keeps the value, the sector, the timeline and the counterparties' roles. Someone who follows that sector, or simply knows the company, can often fill in the rest within a day.
What personal data usually hides inside a board pack?
Director and executive names tied to pay figures, home addresses inside an expense claim, and sometimes a note behind a sickness absence line. Under the GDPR, this counts as personal data the company must still handle lawfully, even inside a document marked confidential.
Sources & references
- UK Market Abuse Regulation: inside information, unlawful disclosure and insider listsFinancial Conduct Authority (FCA)
- Disclosure of inside information: best practicesAutorité des marchés financiers (AMF)
- Insider lists under Article 18 MAR (Issuer Guide)BaFin
- Aktiengesetz, section 93 - management board duty of confidentialityBundesministerium der Justiz (gesetze-im-internet.de)
- Aktiengesetz, section 116 - supervisory board duty of confidentialityBundesministerium der Justiz (gesetze-im-internet.de)
- Code de commerce, article L225-37 - directors' duty of discretionBaumann Avocats (reproducing the official text)
- Companies Act 2006, Part 10 Chapter 2 - directors' general dutiesUK National Archives (legislation.gov.uk)