Confidentiality and competitive sensitivity in shared analysis
Commercial collaboration involves exchanging information, and some of that information is sensitive to parties who are not in the room. A brand and a retailer discussing a category are discussing other brands, other retailers and, in a fragmented channel, individual independent operators.
Having a clear position on what is appropriate is part of being a credible partner rather than an obstacle to one.
Who are the third parties?
Competing brands whose performance appears in category data, other retailers whose figures might be inferred, and the stores supplying the data in the first place. Each has an interest in how information about them is used.
The stores are the ones most often forgotten. Store owners contribute data through the systems they run every day, and they are entitled to know how it is handled.
What makes something competitively sensitive?
That it would allow a party to infer another's current or future commercial intentions, or to identify an individual business's performance. Aggregated historical category performance is generally not sensitive; a named store's weekly sales is.
Forward-looking information is a distinct category and deserves particular care in any discussion involving parties who compete.
What protections exist in the data itself?
Aggregation, suppression of small cells, and access controls. Those are mechanical and they work up to a point; they do not remove the need for judgment about what is shared and with whom.
Suppression thresholds should survive into shared material. A figure suppressed in a provider's output and reconstructed in a shared pack has defeated the protection.
What about the store's own data?
A store's transaction data describes its business and it reaches a brand through a chain of agreements. Using it in aggregate for category understanding is the purpose; using it to identify and act on an individual store's performance is a different activity that the store may not have anticipated.
Where a brand does work at store level — field prioritisation, for instance — that is legitimate and it should be conducted with an understanding of what the store agreed to.
How should a policy be written?
Short, with examples. What may be shared externally, what may not, who decides edge cases, and who to ask. A policy nobody can remember is a policy that gets ignored at the moment it matters.
Include the store-facing case explicitly, because it is the one most likely to arise informally and least likely to be covered by a licence.
What should happen with an uncomfortable request?
Decline and explain. A data business in this space is well served by declining the question rather than by finding a technically permissible version of it, and the same holds for a brand asked to share something it should not.
What does good practice look like?
Aggregation preserved, suppression respected, licences followed, third parties considered, and a named person who decides when it is unclear. None of it is elaborate and together it is what keeps a data relationship durable.
Frequently asked questions
Is category data competitively sensitive?
Aggregated historical category data generally is not, which is why it forms the basis of category collaboration. Item-level competitor detail and anything forward-looking sit differently and deserve more care.
What about discussing a competitor's performance with a retailer?
The retailer has their own view of it, so the sensitivity is usually less than it appears. What changes the position is sharing analysis that goes beyond what they could see themselves, particularly at store level.
Can I use store-level data for field targeting?
It is a standard and legitimate use, and it should be conducted with the store relationship in mind. Prioritising visits is different from publishing a named store's figures.
Who should decide edge cases?
One named person with the authority to say no, and a route to legal advice for anything contractual. Distributed judgment on this produces inconsistency that is hard to defend.
What about informal sharing in a meeting?
It is the least controlled route and the most common. A rule that applies to documents should apply to conversations, and saying so explicitly is worth the awkwardness.
Does anonymisation solve it?
It helps and it is not absolute, because small cells can be re-identified from context. Anonymisation plus suppression plus aggregation is the combination that works.
How does this apply within a company?
Access controls matter internally too, particularly where a business serves competing customers. The principle is the same and the mechanisms are usually better established.
What should a store expect to be told?
How their data is used, in plain terms, and what it will not be used for. That transparency is what sustains the supply of the data in the first place.
What is the practical test?
Whether you would be comfortable with the equivalent being done with your own information. It resolves most cases quickly and it errs in the right direction.
What should a policy say about store-level work?
That it is permitted for operational purposes such as field prioritisation, and that store-identifiable figures do not leave the business. Naming the legitimate use alongside the limit is what makes the policy workable rather than obstructive. Industry context on responsible data practice is collected by trade bodies such as FMI.
### What should a brand actually do with this?
Make somebody accountable for the position rather than leaving it to individual judgment. A policy with no owner produces inconsistent decisions, and inconsistency is what eventually causes a problem.
Then write down the cases you have already decided. A short log of precedents is more useful than a long policy document, because it answers the question in the form it actually arrives.
Working with retail data? See NRS Insights data solutions or contact NRS Insights.