There were no instructions when the information was provided. We asked the question at the beginning, given how sanction laws work when that list is public, whether this was a confidential or private list. We were told it was a confidential list and that's why we only shared it on a need-to-know basis. There were no specific instructions.
Having said that, privacy law kicks into effect, which requires that you only hold information as necessary and for the purpose for which it was collected.