Sharing of Prospect and Client Data with Channel Partners or Resellers for Joint Pitches

When pursuing a deal jointly with a channel partner, reseller, or systems integrator, the sales team shares prospect and client contact details, deal context, and sometimes commercially sensitive account history with the partner organisation to coordinate the joint pitch — typically over email, with no formal data-sharing agreement in place.

1. Does sharing prospect and client personal data with an external channel partner require a distinct lawful basis or agreement under DPDP?
2. What risks arise from informal, undocumented data sharing between the organisation and its go-to-market partners?
3. What is the compliant approach to managing data flows in joint sales motions?

Not permissible without a governing agreement and disclosed basis.

The prospect or client's contact data was collected by the organisation under its own relationship with that individual. Passing it to an independent third-party partner — who now has its own copy, outside the organisation's control — is a disclosure to a party the data principal has no relationship with and did not anticipate, and it requires either a specific consent basis or a properly governed data-sharing arrangement, neither of which typically exists in ad hoc channel motions.

 

• No data-sharing agreement with the partner — Channel and reseller relationships are usually governed by a commercial partnership agreement addressing revenue splits and territory — not a data processing or data sharing agreement addressing how personal data exchanged during joint pursuits will be handled, retained, or deleted.
• Partner retains an independent copy indefinitely — Once shared, the organisation has no control over how long the partner retains the prospect's details, whether the partner adds them to its own CRM or marketing lists, or whether the partner shares them onward to its own sub-partners.
• Deal loss does not trigger data deletion — If the joint pursuit is unsuccessful or the partnership itself ends, there is typically no process requiring the partner to delete the prospect and client data it received during the engagement.
• Existing client data shared without the client's knowledge — Where an existing client's account history or usage data is shared with a partner to build a joint upsell pitch, the client has not been informed that a third party now holds details about their relationship with the organisation.

1. Execute a data-sharing addendum with every channel partner before joint pursuits begin. Partnership agreements should include a specific clause covering permitted use, retention limits, and mandatory deletion of any personal data exchanged during joint sales activity.
2. Share only what the partner needs for the immediate pursuit. Limit data shared to the minimum required for the specific joint pitch — company-level context in most cases — rather than complete contact databases or full account history by default.
3. Notify existing clients when their data will be shared with a partner. Where an existing client relationship is being used as the basis for a joint pitch involving a partner, inform the client and obtain their agreement before sharing their details or usage history.
4. Require deletion confirmation at deal close or partnership end. Build a standard process requiring partners to confirm deletion of prospect and client data once a deal concludes (won or lost) or the partnership itself ends.

DPDP Risk Summary