Writing a corporate disclosure policy that names an owner for every gate

A disclosure policy should route a decision to the right owner. It should not prescribe one label for every corporate message. Copy the blank fields below and complete them for the actual legal entity, content, relationship, channel and territory.

This framework was researched on 6 September 2026. Cedar Vale Engineering Ltd is fictional, and no live message or policy test occurred. The document is general information rather than legal advice.

Policy identity

• Contracting and speaking legal entity: [complete]
• Policy owner and deputy: [complete]
• England operations and other territories: [complete]
• Content and channels in scope: [complete]
• Explicit exclusions: [complete]
• Effective, review and expiry dates: [complete]
• Applicable legislation, code, regulator rule or contract: [complete]

Keep employee communication, customer service, PR, public affairs, investor relations, marketing, crisis response and formal notices in separate records.

Paid, controlled and independent material

• Payer, benefit or commercial relationship: [complete]
• Party controlling the content or placement: [complete]
• Advertising classification and reviewer: [complete]
• Required identifier and placement evidence: [complete]
• Independent editorial boundary: [complete]

CAP Code Section 2 requires marketing communications within its non-broadcast remit to be recognisable. The policy owner must classify the real item. A supplied quote, newsroom post or media relationship does not prove independent endorsement.

Claims, interests and source authority

• Objective claim and likely audience meaning: [complete]
• Documentary source, period and owner: [complete]
• Quotation authority and edit approval: [complete]
• Sponsorship, gift, client, investor or affiliate interest: [complete]
• Rights or licence record: [complete]
• Sector restriction and approver: [complete]

The CMA's unfair commercial practices guidance applies to relevant consumer commercial practices from 6 April 2025 and was updated 18 November 2025. Its examples are not definitive legal rulings for Cedar Vale. Consumer and advertising reviewers decide whether an omission or presentation needs correction.

Market and formal-disclosure escalation

• Issuer, instrument or formal recipient in scope: [complete]
• Potential inside or confidential information: [complete]
• Authorised market or company-law owner: [complete]
• Release route and timing: [complete]
• Leak or premature-publication action: [complete]

FCA Handbook DTR 2 addresses disclosure and control of inside information by issuers within scope. The communications team must not infer applicability or use a general press route in place of an authorised market announcement.

Data, accessibility and security

• Personal-data purpose, role and minimum fields: [complete]
• PECR or direct-contact classification: [complete]
• Objection, suppression and retention evidence: [complete]
• Accessible format and request route: [complete]
• Access control, confidentiality and incident owner: [complete]

The NCSC's cyber-incident communication guidance supports preparation, coordination and accurate information in its UK incident context. It does not replace a legal notification analysis or prove that a routine message is secure.

Correction, withdrawal and accountability

• Authoritative version and archive: [complete]
• Person who can pause release: [complete]
• Correction trigger and approval: [complete]
• Channels and recipients to update: [complete]
• Complaint or challenge route: [complete]
• Withdrawal, evidence retention and reissue: [complete]

Add a decision log beneath the policy. For each disclosure, record the question raised, person who decided it, evidence inspected, exact wording approved, placement, timestamp, expiry and reason for any later change. A blank field is unresolved, not permission to omit information. Preserve rejected versions where lawful and necessary so a correction can be traced without republishing confidential or personal data.

Every legal, factual, employment, market, advertising, consumer, privacy, IP, accessibility, security and sector gate receives its own pass, fail or unresolved status. Any failure stops the affected release. Publication stays on hold until named reviewers complete the fields, check the live source status and approve only the defined communication.