07Legal and Ethical Governance and Intellectual Property

4 min read9 of 34Read it in the book · page 42

“The ideas you own are not protected by law alone, but by clear contracts and disciplined practice.”

In the creative industries, legal and ethical considerations form the backbone of information security practice. This chapter explores the relationship between legal compliance, ethical handling of data, and building trust. Adhering to these principles is not just a regulatory duty but a strategic necessity for protecting the organisation, its clients and its reputation.

Navigating a Complex Legal Landscape

Creative organisations operate amid many laws and regulations governing data protection, intellectual property and consumer rights. ISO 27001 provides a structured framework for managing sensitive information that helps meet these obligations, and its control on legal requirements calls for an up-to-date register of everything that applies to the organisation.

Data protection regulations: The EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) and similar laws have had a profound effect: explicit consent to use personal data, and secure, transparent management of it. This directly affects personalised advertising, client relationship management and the use of data in projects.
Intellectual property laws: The cornerstone of the creative industries: copyright, patents and trademarks. ISO 27001 protects them with controls that prevent unauthorised access and ensure the integrity of content.
Contractual obligations: Client and partner contracts require protection of specific information. The system helps meet them and proves seriousness to the client.

2026 Update

In our region, the UAE Personal Data Protection Law (Federal Decree-Law 45 of 2021) was issued, and the Saudi Personal Data Protection Law came into effect in 2023. The EU AI Act entered into force in August 2024, with obligations phasing in through 2026–2027, affecting anyone offering an AI service to a European audience.

Ethical Challenges in the Creative Industries

Confidentiality and privacy: Safeguarding sensitive information, especially in projects involving personal data or trade secrets, to protect individuals’ privacy and the project’s integrity.
Transparency: Balancing information protection with openness about how it is handled, the foundation of trust with clients, partners and the public.
Respecting copyright and creative rights: Proper licensing and attribution to original creators, to avoid legal problems and foster a culture of respect for creativity.

Integrating these considerations into the ISMS not only protects the organisation from legal and financial penalties but builds a foundation of trust and integrity that supports its long-term success.

A Practical Guide to Copyright and Client Licensing

When you are commissioned to create a logo, a photograph, a piece of music or a program, you are the creator and automatically own the copyright the moment it is created. The contract determines how the client may use the work; this is the licence. Without a clear licence, a client may assume unlimited rights forever, and your work may be used in ways you never intended and were never paid for.

Key licensing terms for your contracts

Scope of use: Where and how? Be specific: “for use on the client’s website and social channels for one year” is entirely different from “unlimited worldwide print and digital advertising”.
Exclusivity: Does only the client use the work (exclusive), or can you license it to others (non-exclusive)? Exclusive usually costs more.
Duration: A fixed period such as one or five years, or in perpetuity.
Copyright ownership: The client may want to own the rights outright in a so-called “work-for-hire agreement” or “copyright buyout”, meaning you transfer all your rights to them. It is the most comprehensive and most expensive option and should be priced accordingly.

Implementation tip: develop a standard licence template for your contracts that defines the usage rights in return for your base fee, and offers tiered pricing for broader rights or a full buyout. This positions you as a professional and creates upselling opportunities.

Demystifying Creative Commons

Creative Commons is a non-profit that provides a simple, standardised way to grant public permission to share and use work on terms you choose. As a creator you can license your work with it; as a user you find a vast library of licensed images, music and text you can legally incorporate into your projects. Understanding it is essential to protect your work when you share it, and to avoid infringing others’ rights.

Creative Commons licences: from most permissive to most restrictive

CC BY · Attribution: The most flexible: distribute, remix, adapt and build upon, even commercially, provided credit is given to you.
CC BY-SA · ShareAlike: As above, but new works must be licensed under the same terms.
CC BY-ND · NoDerivs: Redistribution, commercial or not, provided the work is passed along unchanged and in whole, with credit.
CC BY-NC · NonCommercial: Remix and adapt for non-commercial purposes with credit, without requiring derivatives to carry the same terms.
CC BY-NC-SA: Non-commercial, with derivatives licensed under the same terms.
CC BY-NC-ND: The most restrictive of the six: download and share with credit only, with no changes or commercial use.

How do you use Creative Commons works correctly? Always check which licence applies. The condition shared by all six is attribution (BY): name the original creator, link to the source, and indicate any changes you made.

2026 Update

Intellectual property now has a new question: who owns AI outputs? In many legal systems, fully machine-generated outputs do not qualify for copyright protection unless there is a clear human creative contribution. So add a clause to your contracts stating whether generative tools may be used, how this is disclosed, and who bears the risk of potential infringement in the tool’s training data.

Lessons Learned

1Law, ethics and contract are three layers of one protection.
2A clear licence defines scope, exclusivity, duration and ownership.
3Creative Commons is six licences joined by the attribution condition.
4AI outputs need an explicit clause in the contract.

Tip: use ← → to move between sections.