Considering diving into the world of low-code and no-code platforms? Smart move!

In today’s dynamic digital world, businesses across a wide range of sectors are increasingly embracing low-code / no-code platforms to simplify software development, such as app-building or automated workflows. These platforms enable users to create applications without extensive coding knowledge and have revolutionised the way many businesses build and deploy their software.

But as with any emerging technology, there are legal considerations that arise from the use of low-code and no-code platforms. In this article, we look at the legal landscape, exploring intellectual property (IP) ownership, data protection implications, and some other legal issues of which businesses should be aware.

 

1. Low-Code, No-Code, Whose Code?

A key question in the context of low-code and no-code platforms is who owns the copyright or any other IP in the code subsisting in the apps they are used to create.

Generally, the terms of service of the no-code / low-code platform will specify who owns the IP. You need to review these carefully, as terms are often platform-specific.

In some cases, the provider might wish to retain ownership of their own code as their background IP, while users will own any modifications, but distinguishing a modification from original code can often be practically impossible.

More commonly, you might use the platform provider’s code subject to licence restrictions (such as limitations on how you can use, modify, or distribute your app, which would integrate such code). Typically, in return for use of and access to their software, platforms will want you to commit not to use the source code to make a competing low-code platform.

In other cases, if you build upon or incorporate the platform’s code into a new app, you might be considered a co-author and have a claim to co-ownership of the resulting code. This can also lead to complexities in determining ownership / licensing rights.

For the most part, however, many development platforms do not claim ownership of generated code, even where it is derived from the platform’s own source code – so the user (as developer of the low-code / no-code app) will also be its owner.

You should also look out for those low-code or no-code platforms that adopt what is known as a source available approach – for which the main restrictions are simply around producing competing no-code or low-code platforms using the platform’s own source.

Whatever the case, it is crucial to carefully review the platform’s terms and conditions to understand the specific IP ownership arrangements, as these will have all kinds of longer-term implications for the use of the product and the scalability of your business and will be flagged in the course of any due diligence process.

 

 

2. Low on Code; Heavy on Data

The app you design using a low-code or no-code platform may be a data powerhouse, but user privacy and security are non-negotiable. You should always examine how the platform handles user data (in particular, sensitive commercial data or personal data – i.e. data identifying individuals) – considering things like:

• Data Identification and Classification: You should clearly identify and classify the types of data collected through the platform, ensuring you are aware of the scope of data processing;

• Data Ownership: Understanding who owns the data processed by the app is crucial. You want to make sure that the platform does not reserve any rights of ownership or licence over data that you input into it;

• Data Security Measures: Appropriate security measures must be implemented to protect personal data from unauthorised access, disclosure, alteration, or destruction. This includes measures such as data encryption, access control mechanisms, and regular security audits. You should ensure commitments are made about using these measures not just in binding contracts – also look for the platform’s security policy to understand what practical measures they will put in place; and

• Data Sub-Processing and Location: Where the platform stores and processes personal data will often be important to your application’s customers and end users, and there are restrictions under UK and EU data protection law on processing outside those jurisdictions. You will also want to get an understanding of what third parties or sub-processors are appointed by the platform provider, as these kinds of issues are again important legally, and not being over the detail could be embarrassing and or leave you exposed.

 

3. Playing by Industry Rules

Every industry has its rules, and your app developed through a low-code / no-code platform will need to align with these regulations. Different sectors have different standards, so it is crucial to familiarise yourself with the rules of the game if you want to be a strong player.

You should also be aware of the potential legal liabilities associated with the use of low-code and no-code platforms. These liabilities can arise from data breaches, malfunctioning applications, licence breaches, or claims of copyright infringement – all of which you will typically be responsible for if anything goes wrong.

To keep yourself right, make sure you understand your exposure if you break the rules, and how to make sure legally (through your own end user agreements or terms of service) that you are not unduly exposed to the risks of a claim.

It will be prudent to look at regular system testing and maintenance, obtain appropriate insurance coverage where possible and seek legal counsel to help you understand the legal implications of your app and running your business.

 

Summary

Low-code and no-code platforms undeniably offer incredible possibilities particularly for simple applications, but as with any technology, they bring their own unique legal considerations. By understanding these, you and your business can navigate the complexities and best protect your interests.

If you offer, use or plan to use a low-code or no-code platform and the considerations in this article are relevant to you, or if you have any questions, Andrew Kirke, partner in Contracts & Technology, or Julia Kasprzyk, at Tughans, would be delighted to provide the guidance you need.

While great care has been taken in the preparation of the content of this article, it does not purport to be a comprehensive statement of the relevant law and full professional advice should be taken before any action is taken in reliance on any item covered.