Before any client information is shared
A later engagement needs a defined purpose, scope, lawful authority, necessary information, authorised participants and approved exchange channel. Access, reporting, retention, incident handling and any provider or cross-border arrangements must be addressed for that engagement. A discovery email does not establish those arrangements.
Start with aggregated or non-identifying operating information where it answers the question. Avoid unnecessary personal detail. Aggregation does not guarantee anonymity: small groups, distinctive comments or combinations of facts may still identify someone. Do not assume that removing a name makes a record safe to share.