Competition law compliance: competitively sensitive information

Competition law risk does not live in meeting rooms as much as most organizations assume. It lives on file servers and in mail archives. A price list saved to the wrong folder, a tender file shared with an “everyone in the organization” link, or a competitor’s quote sitting in an employee’s PST archive are findings that are hard to explain when they surface during an investigation. Knowing where competitively sensitive information is, who can reach it and how it moves is a data management question before it becomes a legal one.

Competitively sensitive information: a concrete definition

Competition compliance programs use the phrase “competitively sensitive information” constantly, but rarely make it concrete inside the organization. A practical definition: non-public information that, in a competitor’s hands, could allow market behaviour to be aligned. Applied to an organization’s actual data, specific types stand out:

• Prices and discounts. Current and planned list prices, discount rates, campaign calendars, price increase plans.
• Bid and tender terms. The amounts in prepared bids, unit prices, delivery and payment terms; tender strategy notes; decisions about which tenders to enter or skip.
• Costs and margins. Unit cost sheets, profitability analyses, supplier prices.
• Customer-specific terms. Conditions granted to particular customers, framework agreement annexes, special discount correspondence.
• Capacity and output plans. Plant utilization, plans to halt or expand production, inventory policy.
• Strategic plans. Market entry and exit decisions, investment plans, regional and product strategies.

What these types share is that they are entirely legitimate inside the organization and are natural outputs of business processes. The risk is not in the information existing; it is in uncontrolled circulation, and above all in direct or indirect sharing with competitors. For international readers: the Turkish Competition Authority (Rekabet Kurumu) is the body that enforces competition law in Türkiye, and the guidelines it publishes describe the framework for how undertakings are expected to behave in this area. An organization’s compliance program should be built on that framework together with counsel. This article is not legal advice; Seratus supports the organization’s compliance program and does not replace counsel.

Why information exchange risk is a data problem

A substantial part of what competition authorities investigate concerns information exchange between competitors. That exchange does not always take the form of a deliberate agreement. A presentation handed out at an industry meeting, a sales manager who brought the price list along when leaving a previous employer, a quote shared with a common customer that reaches a competitor from there, manufacturer prices circulating through a distributor: all of these can lead to the same result.

The Turkish Competition Authority’s announcement of 19 October 2026, “Investigation opened into undertakings active in catering service procurement tenders”, is a current example showing that tender processes are on the authority’s agenda. Without commenting on the content or outcome of that announcement, the lesson for organizations is clear: tender files, bid calculation sheets and tender-related correspondence are among the first documents requested in an investigation, and an organization needs to know where they are, who can reach them and with whom they have been shared.

From a data management perspective, three questions decide everything:

1. Where? Which shares, which SharePoint sites, which mail archives hold competitively sensitive documents?
2. Who? Do the people and groups with access actually need it? Has access held by departed employees been removed?
3. How does it move? Are there anonymous sharing links, “everyone in the organization” permissions, folders shared with external organizations, files copied into personal archives?

Answering these questions turns the training and policy documents of a compliance program into a concrete control environment.

Where it accumulates: from price lists to mail archives

Unlike personal data, competitively sensitive information mostly lives in unstructured documents and communications. Typical accumulation points:

Location	Typical content	Typical risk
Sales and marketing shares	Price lists, discount matrices, campaign plans	Broad read permissions, old versions never deleted
Tender and bid folders	Bid files, unit price calculations, strategy notes	Permissions never narrowed after the project, external sharing
Finance and planning	Cost sheets, margin analyses, budget decks	“Everyone” permission, personal OneDrive copies
Production and procurement	Capacity plans, supplier prices	Copies uploaded to supplier portals
Microsoft 365 (SharePoint, Teams)	Decks, meeting notes, chat attachments	Anonymous links, “everyone in the organization” shares
Mail archives (PST/OST/MSG)	Competitor quotes, industry meeting correspondence	Sitting for years in a departed employee’s archive
Local disks	Exported sheets, drafts	Absent from every inventory

Mail archives deserve particular attention. A price list an employee brought from a previous employer years ago, a table from an industry association that contains competitor data, or a competitor’s quote forwarded by a customer by mistake all sit in a PST file where nobody sees them. The mere existence of such documents can require explanation during an investigation. Seratus scans these archives where they sit on disk, without connecting to a live mailbox.

Where data control fits in a compliance program

An effective competition compliance program typically consists of policy, training, a helpline, audits and sanctions. Most of those components address human behaviour. Data control is the program’s technical backbone and produces the evidence that the other components actually work.

Data control runs in four steps:

• Definition. Categories such as “price list”, “tender file”, “cost sheet” and “communication containing competitor information” are defined in the organization’s taxonomy and mapped to confidentiality levels. The Seratus data classification capability keeps that taxonomy manageable and supports human-approved corrections.
• Discovery. All connected sources are scanned read-only; candidates are listed with a confidence percentage and a masked sample. False positives (public price lists, old catalogues) are removed with human approval.
• Access and sharing analysis. For each candidate document, ACLs, sharing links, external shares, access held by departed users and unresolved SIDs are shown.
• Review and remediation. Documents enter an approved review queue; the decision is to narrow access, quarantine, label or release; every decision is written to the audit log.

The value of this workflow becomes visible when an investigation begins. The organization can say “on this date we knew who could reach this document, we narrowed access on that date, this person approved the decision for this reason”. That is evidence of a working compliance program.

Example scenario: a tender folder at a manufacturing company

At a manufacturing company, the sales team prepares bids for public and private tenders. A folder is opened for each tender; unit price calculations, cost sheets and strategy notes are collected there. When the project ends the folder is not closed and its permissions are not narrowed; over the years hundreds of tender folders accumulate on the same share. Group memberships of employees who left the sales team were never cleaned up; some folders were copied to SharePoint to share with a consultancy, and the external sharing links were never revoked.

In this scenario Seratus first finds the documents matching the “tender file” and “cost sheet” categories in the taxonomy; the access graph then shows which folders are still reachable by departed users and which files carry external sharing links. In the review queue, the sales director and the compliance officer narrow access on closed tenders to an archive group only, revoke the external links and record each decision with its reason. The example is anonymous and hypothetical, but the pattern is common.

How Seratus closes these gaps

Gap 1: Nobody knows where competitively sensitive documents are. The competition compliance module uses the same engine as personal data discovery to find documents and communications that may contain prices, bids, costs, customer terms and capacity plans across file servers, local disks, Microsoft 365, databases, object storage and mail archives. Details: agentless DSPM.

Gap 2: The categories do not fit the organization. Categories are defined and tuned in the organization’s own taxonomy; sector-specific document types can be added, and false positives are corrected with human approval so the corrections flow back into the taxonomy.

Gap 3: Access is invisible. The access and exposure graph shows ACLs, sharing links, external shares, access held by departed users and unresolved SIDs for every candidate document; violations of least privilege are prioritized.

Gap 4: Competitor information in mail archives goes unnoticed. PST/OST/MSG files are scanned where they sit on disk, without a live mailbox connection; message bodies and attachments are flagged by category. Details: email archives.

Gap 5: Decisions leave no evidence. Every review decision is assigned to an owner, approved by a separate authority and written to the audit log with who, when and why; reports are exported as PDF, Excel or CSV and findings can be forwarded to a SIEM or request management system. Details: remediation and evidence.

Gap 6: Concern that documents leave the organization. Seratus runs on-premises and supports air-gapped networks; scanning and classification happen inside the organization’s network; optional document-type enrichment runs only on the organization’s own or self-hosted LLM, and no data goes to external AI services.

Takeaway

Competitively sensitive information is a natural output of the business; the problem is not that it exists but that it circulates without control. Knowing where price lists, tender files, cost sheets and correspondence containing competitor information are, who can reach them and how they are shared turns the policy and training components of a compliance program into a measurable control environment. Seratus provides that visibility and the evidence chain inside the organization’s own network.