Video

A family business risk management case study

22 April 2026 | 4 minute watch

Play Video
Richard Penfold
A family business risk management case study
Play Video

A family business risk management case study

I wanted to give an example of a family that Withers acts for. A long‑standing client, we were in the process of selling the core family asset, which was a very, very successful business that had been built and grown by previous generations. The family had always been a very private family and were particularly sensitive about privacy, confidentiality and trust in the new world once they sold the business.

The aim was to set up a much more sophisticated family office, which would involve investing companies, trusts and foundations and charitable entities. So they needed to understand how they could protect the confidential information, the private information, that was going to be used and exploited in the new world. So we helped them identify four areas to look at. First of all was privacy and data protection. Secondly, their contracts and contractual arrangements. Thirdly, the technology they were going to use and the platforms they needed. And finally, to help them bring in trusted advisors to take them forward.

So in terms of privacy, what we needed to understand was the personal data that was going to be within the organisation. Not just family data, but data of staff, providers, financial advisors, lawyers, technology providers, beneficiaries of grants, and beneficiaries of any charitable giving. So we helped them understand the data flows, put in place a compliance program, and insisted putting together proper policies and procedures to manage that data in a compliant way.

So secondly, we looked at their contractual arrangements, NDAs, agreements with staff, with professional advisors and providers, financial advisors, technology providers. And just one point I would flag here is because of the family's concern about privacy, we highlighted issues around technology providers, most of whom use some form of AI tool within their service. So we just wanted to ensure that any providers who used AI were processing any data, confidential information or personal data in a way that couldn't be reused or identified by anyone else.

Then thirdly, we looked at the technology platforms. So what was apparent was the family had not used proper integrated systems previously. They had used Gmail and Hotmail. They'd used different devices, stored information in very different ways on local drives. They had no cyber security or password protection. So we helped them identify procedures and processes and systems that would give them proper integrated, secure systems.

And then finally was helping them provide an advisor and a technology service provider who could provide the support and the services they needed. Because of the family's focus on confidentiality and privacy and trust, we helped them beauty parade 4 or 5 providers not only so they could provide the service they needed, but actually to have a trusted long‑term relationship going forward.

So by the time that the business had been sold and the money had been received by the family, we’d put in place all these foundations to take forward their needs of privacy, trust and confidence for the future.

A case study of a family client preparing to sell a multi generational business. They used this transition to establish a secure, sophisticated family office. By focusing on data protection, contractual safeguards, integrated technology and trusted advisers, the family were able to protect confidential information and build a strong foundation of privacy, trust, and confidence for the future. View this video to learn more.

Empowering family offices for success in a digital age

find out more

I wanted to give an example of a family that Withers acts for. A long‑standing client, we were in the process of selling the core family asset, which was a very, very successful business that had been built and grown by previous generations. The family had always been a very private family and were particularly sensitive about privacy, confidentiality and trust in the new world once they sold the business.

The aim was to set up a much more sophisticated family office, which would involve investing companies, trusts and foundations and charitable entities. So they needed to understand how they could protect the confidential information, the private information, that was going to be used and exploited in the new world. So we helped them identify four areas to look at. First of all was privacy and data protection. Secondly, their contracts and contractual arrangements. Thirdly, the technology they were going to use and the platforms they needed. And finally, to help them bring in trusted advisors to take them forward.

So in terms of privacy, what we needed to understand was the personal data that was going to be within the organisation. Not just family data, but data of staff, providers, financial advisors, lawyers, technology providers, beneficiaries of grants, and beneficiaries of any charitable giving. So we helped them understand the data flows, put in place a compliance program, and insisted putting together proper policies and procedures to manage that data in a compliant way.

So secondly, we looked at their contractual arrangements, NDAs, agreements with staff, with professional advisors and providers, financial advisors, technology providers. And just one point I would flag here is because of the family's concern about privacy, we highlighted issues around technology providers, most of whom use some form of AI tool within their service. So we just wanted to ensure that any providers who used AI were processing any data, confidential information or personal data in a way that couldn't be reused or identified by anyone else.

Then thirdly, we looked at the technology platforms. So what was apparent was the family had not used proper integrated systems previously. They had used Gmail and Hotmail. They'd used different devices, stored information in very different ways on local drives. They had no cyber security or password protection. So we helped them identify procedures and processes and systems that would give them proper integrated, secure systems.

And then finally was helping them provide an advisor and a technology service provider who could provide the support and the services they needed. Because of the family's focus on confidentiality and privacy and trust, we helped them beauty parade 4 or 5 providers not only so they could provide the service they needed, but actually to have a trusted long‑term relationship going forward.

So by the time that the business had been sold and the money had been received by the family, we’d put in place all these foundations to take forward their needs of privacy, trust and confidence for the future.

This document (and any information accessed through links in this document) is provided for information purposes only and does not constitute legal advice. Professional legal advice should be obtained before taking or refraining from any action as a result of the contents of this document.

Share

Related experience

As a full-service law firm, we are able to provide advice and information about a wide range of other issues. Here are some related areas.

Join the club

We have lots more news and information that you'll find informative and useful. Let us know what you're interested in and we'll keep you up to date on the issues that matter to you.