Ask who owns the data in an online community and you may receive a comforting answer: “you do”. The phrase is appealing, but incomplete. A community contains different information, created by different people, held for different reasons and governed by contracts and law.
A useful answer begins by separating practical control, legal rights and responsible stewardship.
There is no single bucket called community data
Member account information may include names, contact details, eligibility, roles and preferences. Member content may include discussions, comments, documents and event responses. Administrators create announcements, group structures, moderation records and support notes. The provider may generate security and operational logs.
Some of these categories contain personal information. Some may include copyright or confidential material. Some may need to be retained as organisational records. A discussion can contain contributions from many people, making the idea of one owner especially difficult.
The first step is a data map: what exists, who provides it, who can access it, why it is needed and when it should be removed.
The organisation usually operates the community
The organisation defines the purpose, invites members, sets policies and authorises administrators. In many arrangements, it decides why and how personal information is handled, while the software provider processes information to deliver the service.
Exact legal roles depend on jurisdiction, context and contract. Government, employment, education, health and residential communities may have additional obligations. A marketing page cannot determine them.
The organisation’s control brings responsibility. It should not use community information for an unrelated purpose merely because it can access it. It needs appropriate policies, permissions, retention and member communication.
The provider should have limited, defined rights
A provider needs enough permission to host, transmit, protect, support and maintain the service. That operational permission should not silently become a right to sell personal information, build advertising profiles or use private content for model training.
Read the agreement for language about licences, derived data, analytics, product improvement, artificial intelligence and subprocessors. Broad wording deserves explanation. The privacy notice and product behaviour should tell the same story as the contract.
Portal Page’s intended model is that organisations pay for software. Private community activity should not fund a behavioural advertising marketplace. That principle must still be expressed in final agreements and implemented controls.
Members retain interests and rights
Members do not surrender every interest when they contribute to a community. They may retain intellectual property rights. Privacy law may provide access, correction or deletion rights. Community policies create expectations about audience and use.
Those interests are not absolute. A member may not be able to demand deletion of a record the organisation must lawfully retain. Removing every contribution from a discussion can also damage the meaning of other members’ contributions. Policies should explain what happens when an account closes and how identity may be separated from content.
Meaningful transparency is better than a blanket promise that cannot be kept.
Ownership is different from stewardship
An organisation can have legal control and still handle information badly. Stewardship asks how power is exercised.
A responsible operator collects only what it needs, restricts access, maintains accuracy, protects information and considers the context in which members contributed it. It provides understandable rules and a route to question decisions.
Stewardship also recognises collective value. Community knowledge may have been created through many people’s effort. Export and migration decisions should respect member privacy and contribution context, not merely the organisation’s technical ability to copy a database.
What meaningful portability looks like
Portability reduces deliberate lock-in, but a technically complete export can still be useless. Flat text files may omit groups, authorship, dates, relationships and status. Proprietary identifiers may require significant reconstruction.
Before buying a platform, ask:
- which data categories can be exported;
- which formats are used;
- whether relationships and metadata are preserved;
- how large exports are delivered and protected;
- whether members can export appropriate personal information;
- what assistance is available during exit;
- when active copies and backups are deleted;
- which records must be retained separately.
Do not wait until contract termination to understand the answer.
Deletion needs a policy, not a button
Account deletion can involve several different actions: removing access, deleting profile fields, anonymising contributions, deleting content, retaining moderation records or preserving legally required information.
The correct outcome depends on purpose and obligation. The interface should explain the likely consequences and route complex cases to a responsible person. Administrators should not have an unexplained ability to erase or retain information indefinitely.
Backups require attention too. Immediate removal from every backup may be impractical, but backup retention should be limited and restored data should not silently revive deleted active records.
Questions for a provider
- What data does the service collect by default?
- Which fields and logs can the customer configure?
- Does the provider sell information or use behavioural advertising?
- Can private content be used for AI training or product improvement?
- Which personnel and subprocessors can access information?
- Where are roles and obligations defined contractually?
- How do member requests reach the responsible organisation?
- What are the retention, export and deletion processes?
- How are material changes communicated?
- What happens at the end of the service?
The best answer to “who owns the data?” is not a slogan. It is a coherent set of product controls, operating practices and agreements. Portal Page’s data ownership framework sets out the intended standard, while the data ownership guide helps organisations document their own decisions.