A team can consider reusing independently sourced public creator facts across clients, after checking privacy, source and contract restrictions. Keep client negotiations, campaign results and private correspondence within that client's workspace by default. Reuse personal details collected for a specific task only after reviewing the new purpose and authority to share. A creator appearing in two accounts does not make the whole record transferable.
The matrix below is an illustrative agency policy, not a legal determination. The privacy examples use UK GDPR guidance. Ask qualified counsel or your privacy lead to assess applicable jurisdictions, client agreements and the agency's role before approving uncertain reuse.
Classify each field before copying a record
Use three overlapping labels: public fact, client-confidential information and purpose-limited personal data. One field may need more than one label. A private rate quote can concern an identifiable creator and also reveal a client's commercial terms.
Under the ICO's personal-data guidance, information relating to an identifiable person can be personal data. That includes a name and corporate email address. Public visibility therefore does not, by itself, settle whether an agency may store, share or contact someone using those details. The ICO flags this guidance as under review following UK legislative changes.
Treat the following as recommended defaults. A written approval must identify the fields, recipient and purpose; a vague permission to share "creator information" leaves too much unresolved.
| Information | Default treatment | Before another client uses it |
|---|---|---|
| Public handle, profile URL, content topic, public post link | Candidate for shared research | Record the public source and date. Check the intended use and applicable restrictions. |
| Public business email identifying a person | Personal-data review | Check the contact purpose, privacy information and outreach rules. Public availability alone is insufficient. |
| Negotiated fee, counteroffer, client brief, private relationship notes | Keep within the client account | Review confidentiality terms and obtain the required authority. Prefer a fresh quote for the new scope. |
| Creator-supplied analytics or campaign sales report | Keep within its reporting scope | Confirm who may receive it and why. Remove unrelated client information before any approved transfer. |
| Delivery address, private phone number, payment or tax details | Restrict to the task and responsible staff | Review the new purpose and authority. Ask for current details through the new client's approved process where needed. |
| Agency-wide performance benchmark | Review before sharing | Check contractual rights and whether a creator or client remains identifiable. Removing names alone is insufficient. |
For contact imports, use the public-contact review before adding an address to another client's outreach list.
Decide whether the new purpose is allowed
The ICO's purpose-limitation guidance says a new use needs a lawful basis and must be compatible with the original purpose. The reuse rules differ depending on whether the original collection relied on consent. Where purposes change, the guidance requires updated privacy information before reuse.
Apply that distinction to a specific request. "Use this address to deliver Client A's sample" and "send promotional gifts for any agency client" describe different scopes. Do not let a shared address field silently turn the first into the second.
Before transferring a field, record answers to these questions:
- Origin. Did the agency find it independently, receive it from the creator, or obtain it through Client A?
- Purpose. Why was it collected, and what will Client B do with it?
- Authority. Which agreement, instruction, permission or privacy assessment supports that use? Who can approve it?
- Minimum disclosure. Which fields does Client B need? Can the team use a public link or request a new quote instead?
- Expiry. When will the recipient review, remove or update the copy?
An unknown answer means hold the transfer for review. Client permission addresses only part of the question. It does not settle the creator's privacy rights, platform restrictions or another party's confidentiality terms.
Ask counsel to resolve uncertain controller and processor roles, cross-border transfers, sensitive information and conflicts between agreements. The account manager should not invent a legal basis to meet a campaign deadline.
Keep the shared directory smaller than each client record
A workable design has a reviewed shared directory and separate client records linked to the same creator identity. The shared directory might contain a public handle, profile URL, research date and source. Each client record contains that client's outreach, negotiations, supplied reports, approvals and delivery tasks.
Choose shared fields explicitly. Avoid copying the entire record and deleting the columns someone happens to notice. Free-text notes, attachments, email history and hidden spreadsheet tabs also need review.
Modash's relationship-management article recommends team reference materials and clear communication ownership. Put a field-sharing policy in those materials so a new manager can tell which information belongs to which relationship. Use a decision-focused creator CRM structure to assign owners and next actions without making every client's history visible to everyone.
Platform access needs a separate check. YouTube channel permissions let an owner delegate work without sharing Google Account credentials. Its Viewer role includes revenue access; Viewer (Limited) excludes revenue data. Choose the role for the agreed work, then document who may receive any resulting report. These channel roles do not determine cross-client sharing rights, and YouTube says channel permissions do not support its APIs.
A hypothetical transfer request
Client B asks an agency to contact a creator who worked with Client A. The agency has a public profile link, a private fee agreement, a delivery address and a campaign sales report.
The account manager creates a Client B record with the independently verified public link and its source date. The manager leaves the fee agreement, address and report in Client A's restricted workspace. Client B gets a new scope and quote request through an approved contact route.
If Client B asks whether the creator performed well, the manager first reviews what the agency may disclose. A permitted summary still needs its measurement context. If disclosure is unresolved, the manager offers public work samples or asks the creator for a report intended for Client B.
Renaming the sales report "Creator 17" does not resolve the issue. The ICO distinguishes pseudonymisation from anonymisation. A reference number that can be linked back to a person can remain personal data. Contractual confidentiality also needs its own review.
Audit a client boundary before the next export
Use an authorised test account with the same permissions as the intended recipient. Test access without sending real private data to an unauthorised person.
- Open a creator shared by two clients. Confirm that each client can see only its authorised notes, attachments and reports.
- Check search results, recent-activity feeds, notification emails and previews for information from the other account.
- Inspect the proposed export, including hidden columns, comments, linked files and embedded report tabs.
- Check shared links, connected tools and scheduled reports. Record each destination and its owner.
- Review former staff and ended-client access. Check platform permissions separately from agency workspace permissions.
- Record each exception with its approver, permitted fields, recipient, purpose and review date.
For program closure, use the agency-to-client handover checklist to plan the transfer separately from day-to-day sharing.
Before your next cross-client copy, take one creator record through this audit. Approve only the named fields, save the decision with the request, and leave unresolved fields in their original client workspace.
