Respond to supplier evidence requests when information is confidential
Identify what the customer needs to establish, which information is restricted and whether an authorised extract, aggregate or limited-access review can answer the question. Agree the permitted use and recipient before sharing. Confidentiality is a constraint to resolve, not a reason to invent an answer or assume that a full document can be uploaded.
This guide is for suppliers whose supporting evidence exists but contains commercially sensitive or personal information. It addresses controlled sharing. For genuinely missing data or a portal that cannot capture an accurate answer, use the supplier questionnaire response guide.
Separate the requested fact from the requested file
A buyer may ask for an invoice to support an energy quantity, a workforce record to support an aggregate metric, or a contract to confirm a process. Establish what must be verified before deciding whether every field in the underlying file is necessary.
Record the requester, purpose, required scope and period, expected audience and proposed channel. Check whether the information will remain with named reviewers, enter a wider customer system or be published. Ask the internal owner to identify actual restrictions; do not assume that a confidentiality label has the same meaning for every document.
The GHG Protocol Supplier Engagement Guidance, pages 4–5, calls for checking data-provider restrictions and the purpose for which information may be used. Its GHG context is useful here, but does not determine the legal effect of your contract or authorise a disclosure.
Choose a bounded evidence route
Existing public source: use it if its scope and period answer the question.
Approved extract: retain the relevant facts and context while removing information the recipient does not need.
Aggregate schedule: show a defined total or summary with a retained source trail, if the recipient accepts that evidence level.
Limited-access review: arrange authorised access for agreed reviewers under approved terms where an extract is insufficient.
Unresolved restriction: explain what can be supported and what remains unavailable for sharing, then seek an accepted next step.
These options require case-specific approval. An NDA does not automatically permit all data uses or override another obligation. Do not accept unfamiliar portal terms or waive restrictions merely to complete a questionnaire; route material terms to the authorised business or legal owner.
OECD's Due Diligence Guidance, question 47, printed pages 86–87, discusses approaches to communicating useful information while respecting confidentiality. It also recognises situations where disclosure is fundamental to protecting people. A generic confidentiality explanation must not be used to conceal information that must be disclosed or needed to address serious harm.
A fictional invoice extract
A customer asks a supplier to substantiate 12,000 kWh of electricity at Factory A for a named month. The invoice includes that quantity, the billing interval and account details, but also prices, payment instructions and unrelated contact information.
In this invented example, the authorised owner confirms that an extract may be shared with the customer's named reporting reviewer for this purpose. The customer agrees that the extract is acceptable. The supplier preserves the quantity, unit, period, supplying-site identification and enough document context to connect the extract to its retained original.
The sharing copy is labelled as an extract with specified information removed. A record identifies the original document, extract version, approval, recipient and purpose. The original remains access-controlled. The supplier does not claim the extract is an unaltered full invoice or that customer acceptance is independent assurance.
If removing the identifying details prevents the recipient from establishing which site or period the evidence covers, the extract may no longer answer the question. The next step is an agreed alternative, not an unsupported confirmation.
Check that reduction has not changed the meaning
Redaction must not remove a qualification, a site exclusion, an estimate label or a correction that changes the interpretation. An aggregate should state its population and period; it should not imply that every underlying record was independently verified.
Aggregation does not automatically make information anonymous. Other available information can allow people to be identified again; the UK ICO's anonymisation guidance explains that technical risk. Where personal information or sensitive commercial relationships are involved, have the appropriate owner assess the proposed disclosure and format.
Check the actual sharing copy for hidden or recoverable content using the organisation's approved process. Simply covering text visually may leave it accessible, and a spreadsheet summary may retain underlying records. The ICO's document-redaction guidance illustrates these risks. These UK sources are technical references here, not determinations of Indian law or certification of a redaction technique. At this review, the ICO flags its anonymisation guidance as under review following the UK Data (Use and Access) Act 2025; recheck it before relying on a later version.
Keep the agreement with the evidence
Retain the request, restriction decision, approved extract or summary, recipient's agreed evidence route and the exact version shared. If wider reuse or publication is later requested, revisit permission for that new purpose.
Nitium's value-chain ESG reporting support can help structure evidence and make reporting limitations clear. Discuss the reporting need using a non-confidential outline or email contact@nitium.in. Legal clearance, secure-system certification and independent assurance are not promised here.
Reviewed 10 October 2026. No document-sharing permission, contractual waiver or legal conclusion is created by following this workflow.
Comments