Privacy and preparation
Building an exclusion list: HR, legal and executive channels and mailboxes
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
A data export exclusion list names the HR, legal, executive and other sensitive channels, mailboxes, folders and queues that will never leave the company, with an owner and a verification step for each. Build it before any export runs, apply it at the source system, and prove it held by searching the finished export for excluded identifiers.
Key takeaways
- An exclusion list removes whole containers before export; redaction cleans details inside the records you keep.
- Cover HR, legal, executive, finance, security and client-owned material, each with a named owner.
- Combine container, person and pattern rules, because each misses what the others catch.
- Verify with canary searches on the finished export, then sign and date the result.
What a data export exclusion list does#
A data export exclusion list is a written register of the channels, mailboxes, folders, queues and record types that will not leave the company under any circumstances, each with a named owner and a way to confirm the exclusion worked. It is a scoping control applied before export, not a redaction step applied afterward.
The distinction matters. Redaction removes details from records you intend to keep, such as a phone number in a support ticket. Exclusion removes whole containers whose content is sensitive by nature, such as a termination investigation thread or privileged advice from outside counsel, where no amount of redaction leaves something both safe and useful.
Public data transactions show the same instinct. Reporting on the sale of Spirit Airlines data states that passenger profiles, Free Spirit loyalty records and privileged legal materials were excluded from it.
Exclusion categories, owners and typical containers#
Exclusion categories for most mid-sized companies fall into the same handful of groups, but the containers that hold them differ by system. Name a business owner for each category, not just IT, because the owner knows where the sensitive material actually lives.
| Category | Typical containers | Why it is excluded | Owner |
|---|---|---|---|
| HR and people | HR channels, HR and recruiting mailboxes, HRIS exports, investigation folders, performance reviews | Discipline, pay, health, accommodation and complaint details about named people | Head of HR |
| Legal | Legal mailbox, threads with outside counsel, dispute and claims folders, litigation hold sets | Privilege, settlement terms and confidential dispute facts | General counsel |
| Executive and board | Board channels, CEO and CFO mailboxes, board decks, financing and M&A data rooms | Confidential strategy, investor terms and deal information | CEO or company secretary |
| Finance and payroll | Payroll exports, banking portals, tax files, compensation spreadsheets | Account numbers, pay data and tax identifiers | CFO or controller |
| Security | Incident response channels, credential vaults, penetration test reports | Secrets and unresolved vulnerabilities | CTO or security lead |
| Client-owned material | Client deliverables, customer code, files received under client NDAs | The rights belong to someone else | Account or project owner |
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
Finding the containers system by system#
Finding every container is harder than naming the categories, because sensitive conversations spread across tools. Work through each system with its admin and record container identifiers, not just display names, since channels and folders get renamed over the years.
- Slack or Teams: export the full channel list with privacy settings and members, then flag HR, legal, leadership and incident channels. Decide separately about direct messages and group chats.
- Email: list shared mailboxes, distribution lists and the individual mailboxes of executives, HR staff and in-house lawyers.
- Shared drives: list top-level folders and their owners in Google Drive, SharePoint, OneDrive, Box or Dropbox, and flag folders shared with outside counsel or the board.
- Ticketing: identify HR, legal and IT security queues or groups in Jira Service Management, Zendesk or ServiceNow.
- CRM and ERP: find notes fields, attachments and custom objects that hold employee or dispute information.
Files that live somewhere other than the conversation#
Attachments often live in a different system from the conversation that shared them, which is the most common way an exclusion leaks. Microsoft states that files shared in Teams chats are stored in the OneDrive of the person who shared them, while files posted in channels are stored in the team's SharePoint site. Excluding an HR chat therefore does not exclude the documents posted in it.
The same pattern shows up elsewhere: links in Slack messages point to drive files, help desk tickets reference attachments in separate storage, and email threads quote earlier messages from excluded mailboxes. For each excluded container, list where its files and quoted content actually sit, and add those locations to the list.
Exclude by container, by person or by pattern#
Exclusion methods come in three main kinds, plus date windows, and a sound list uses several of them because each catches what the others miss. Container rules are precise but blind to cross-posting, person rules are broad but can remove useful operational work, and pattern rules catch stray content but produce false positives.
| Method | How it works | What it catches | Where it leaks |
|---|---|---|---|
| Container | Drop listed channel IDs, mailbox addresses, folder paths and queues | Dedicated HR, legal and board spaces | Content forwarded or pasted into ordinary channels |
| Person (custodian) | Drop everything authored or received by listed roles | Executive and counsel correspondence wherever it sits | Useful operational work those people also did |
| Pattern | Flag messages matching terms or domains, such as outside counsel domains, privileged, termination or settlement | Stray sensitive threads in project spaces | False positives that need human review |
| Date window | Drop periods tied to a sensitive event, such as a sale process | Deal chatter across all spaces | Unrelated work from the same period |
Verifying that the exclusions held#
Verification is the step most exclusion lists skip, and it is the step that proves the list worked. Build a set of canary identifiers from the list itself, then search the finished export for them before anything leaves company control.
- Compile canaries: excluded channel names and IDs, excluded mailbox addresses, outside counsel email domains, HR system names and board document titles.
- Search the full export for every canary and record the hit count, including zero results.
- Review every hit, remove the record or container it came from, and add the gap to the list.
- Have a second person, ideally the category owner, sample the export for sensitive content the canaries would not catch.
- Sign and date the verification and keep it with the version of the list that was applied.
Illustrative: an engineering firm's first exclusion list#
Illustrative: a fictional civil engineering firm runs Microsoft 365 and Teams, Deltek for project accounting and Bluebeam for markups. It wants to license project coordination records: RFIs, submittal reviews and internal design review threads.
Its general counsel excludes the HR and leadership teams in Teams, the principals' mailboxes, a claims folder for a disputed project, and the Deltek payroll and billing rate tables. Pattern review across project channels then turns up a contract dispute thread that a project manager had forwarded into a project channel to brief the team. That thread is removed, and the outside counsel domain joins the pattern list.
The final export keeps the RFI and submittal workflows that make the records useful, and the verification sheet shows each canary search with its result and reviewer.
How SourceX uses an exclusion list#
SourceX treats the exclusion list as an input to the Rights and Preparation steps of the SourceX five-step transaction. The list defines what is out of scope before any export is planned, and personal details inside the remaining records are handled afterward during preparation.
The applied list and its verification results are recorded in the privacy record of the SourceX Evidence Packet, so the buyer's permitted use is tied to a defined scope. The supplier approves that scope and can add exclusions at any point before release.
Frequently asked questions
Should the CEO's mailbox always be excluded?
Usually yes as a default, because executive mailboxes mix board, investor, personnel and deal matters. In founder-led companies where the CEO also ran product or support, the useful operational threads can often be recovered from shared channels or ticketing systems instead, which is safer than filtering an executive mailbox message by message.
Can redaction replace excluding legal content?
Rarely. Privileged advice, settlement discussions and dispute strategy are sensitive in substance, not just in names and figures, so removing identifiers leaves the confidential content intact. Excluding the containers and running pattern review for stray legal threads is the safer default, and counsel should decide any exception.
Are excluded records deleted?
No. Exclusion only means the records stay out of the export. They remain under your normal retention schedule and any litigation holds. Deleting them is a separate decision, made with counsel and recorded in your retention and deletion schedule.
Who should sign off on the exclusion list?
The general counsel or privacy lead usually owns the list, each category owner confirms their containers, and the executive who approves the license signs the final version. Keep the signed version with the export record, because later questions will be about which list was applied, not which draft existed.
How do departed employees affect the list?
Departed employees' mailboxes and drives often hold sensitive material without an obvious owner. Check whether former executives, HR staff or in-house lawyers have retained or inactive mailboxes, and add them to the custodian rules so their content is not swept in through an archive export.
Sources
- Reporting on the Spirit Airlines data sale states that it excludes passenger profiles, Free Spirit loyalty records and privileged legal materials. Source
- Microsoft states that files shared in Teams chats are stored in the OneDrive account of the user who shared them, while files uploaded to channels are stored in the team's SharePoint site. Source
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.