LIBRARY // OUTSOURCING ARCHITECTURAL PRODUCTION

Data Security and NDAs in Architectural Outsourcing

Sharing project files with a partner means trusting them with client information. That trust should be backed by process.

Architectural projects involve confidential information, such as client plans, building layouts and sometimes security-sensitive details. When work is outsourced, practices need to make sure this information is protected. Good agreements and practical controls work together.

Confidentiality agreements

A non-disclosure agreement (NDA) or confidentiality clause sets out:

• What information is confidential
• How it can be used
• Who can access it
• How long obligations last
• What happens at the end of the engagement

Legal advice helps make sure agreements suit your jurisdiction and clients.

Client requirements

Some clients have specific requirements, such as restrictions on subcontracting, data location or security vetting. Check contracts before sharing information with a partner.

Data protection law

If project information includes personal data, such as names or contact details, data protection laws may apply, such as UK GDPR in the UK or GDPR in the EU. Check obligations, especially for transfers across borders.

Access control

• Give access only to the files each person needs
• Use individual accounts rather than shared logins
• Remove access when people leave the project
• Review access regularly

Secure file sharing

Use secure platforms with encryption, access logs and version history. Avoid sending sensitive files through personal email or unsecured services.

Device security

Sensitive projects

Some buildings, such as infrastructure, government or security-sensitive facilities, may have special requirements. In the UK, for example, PAS 1192-5, now replaced by ISO 19650-5, addresses security-minded approaches to building information. Follow client and project requirements.

Minimise data shared

Share only the information needed for each task. Removing unrelated sheets or information reduces risk.

End of engagement

Agree how files are returned or deleted at the end of the engagement, and ask for confirmation.

Incident response

Agree what happens if there's a security incident, including how quickly the partner must report it.

Ask the right questions

When choosing a partner, ask about security policies, certifications and past audits. Some partners hold certifications such as ISO/IEC 27001.

Train both teams

Security depends on people. Short reminders about secure file handling, phishing and access rules help both teams follow good practice.

1. 01Confidentiality agreements
2. 02Client requirements
3. 03Data protection law
4. 04Access control
5. 05Secure file sharing
6. 06Device security

Review arrangements periodically

Review security arrangements regularly, especially when projects or clients with new requirements start.

Data security is a shared responsibility. Clear agreements and practical controls help protect clients and build trust in outsourced work.

If your team needs extra production capacity for work like this, take a look at our Architectural production services, or tell us about your project.