When source code sits on a personal account: what to do first
Source code sitting in a developer's personal repository, not a company-owned one, creates a gap between control and ownership. The account holder decides who sees the code; the company may not hold the rights it assumes. The first step is not moving the code — it is freezing the evidence: logs, commit history, and any signed agreement, before anyone contacts the developer.
The basis: what EU law covers, and what it does not
Directive 2009/24/EC sets the EU-wide baseline for protecting computer programs as a form of copyright. It fixes what counts as a protected "computer program" across all member states. It does not say who owns the code in a personal-account scenario. That question sits with national law and with the contract between the company and the developer.
Where the account also holds structured data — schemas, seed datasets, configuration tables — a second layer can apply. Directive 96/9/EC protects databases separately from the code around them. A single repository can carry two overlapping rights: one in the program, one in the data structure, each needing its own trail of ownership.
Neither directive assigns rights automatically to an employer or a client. Both fix what is protected across the EU. National contract and employment rules decide who holds it.
What changes in practice
Without a written assignment on file, the starting position depends on the underlying relationship — employment, contractor agreement, or an informal favour — and on national default rules, not on where the code happens to sit. A personal account does not transfer ownership by itself. It does control access, and access is what disappears first.
Two clocks are already running. One is technical: history in a personal account can be rewritten, force-pushed, or deleted at will, and each change erodes the evidence of who wrote what and when. The other is relational: once a developer leaves, is dismissed, or a dispute starts, cooperation on migrating the code becomes harder to obtain.
What to do first
Order matters more than speed. Contact made before evidence is secured is the most common way this situation gets worse.
| Step | Who acts | Why now |
|---|---|---|
| Freeze the current state of the repository — clone it, record commit history and timestamps, without changing anything | Internal IT, on instruction | Evidence decays with every day the account stays untouched |
| Pull the underlying contract, including any assignment clause | HR or in-house counsel | Sets the starting legal position before contact is made |
| Check whether a signed assignment already exists for this specific code | Legal | Can settle the question outright if found |
| Request that the developer add the company as collaborator, or push to a company-controlled remote | Line manager or counsel | Creates a parallel, company-held copy without provoking deletion |
| Hold off on revoking the developer's access | IT, on legal's instruction | A parallel copy must be confirmed first, or revocation risks losing the only copy |
| Escalate to outside counsel if the developer refuses or is unreachable | In-house counsel | A formal demand carries weight an internal request does not |
Where the underlying contract already provides for source code escrow rather than direct company custody, the sequence differs — see Source code escrow is demanded technology contract for how that mechanism is triggered.
Who decides, and how
The company decides its own evidentiary and negotiation strategy first. No external body is involved at this stage. If the developer disputes ownership or refuses to cooperate, the matter moves to the national civil court with jurisdiction over the contract. That court weighs the written agreement, the commit metadata, and any contemporaneous correspondence.
No fixed statutory deadline for this specific dispute sits in the material available here. The deadlines that matter in practice come from the contract itself — a notice period, a termination clause — and from national civil procedure once a claim is filed.
If your situation differs
A written assignment exists and covers this exact code. Ownership is already settled. Secure a copy of the document and move straight to mirroring the account for continuity, not for proof.
No assignment exists, and the developer is a current employee. National employment-based transfer rules may apply by default, but their scope is rarely automatic for every line of code. Formalise a written confirmation now, while the relationship is intact.
No assignment exists, and the developer is a contractor or has already left. No default transfer applies. A negotiated assignment or licence is the only route, and every week of delay weakens the company's position.
What this page does not cover
This page does not confirm who owns the code in your specific case — that depends on the contract and the facts, not on a general rule. It does not draft or negotiate the assignment itself. It does not cover a separate class of problem: whether a marketing statement about the software counts as a binding offer — see When marketing is treated as an offer in detail for that situation.
Sources and limits
Checked on 14 January 2025. The EU-level sources cited above are Directive 2009/24/EC and Directive 96/9/EC. National ownership rules and procedural deadlines sit outside this registry and are not stated here.
If the dispute grows into a recovery question — the code was taken, and assets or a debtor need to be located — the product layer covers that ground separately. See Asset in Latvia in practice for tracing.
See also Debtor in Latvia and the deadline for the clock that starts once a debtor is identified.
Related reading
A related situation, close to this one: When the assignment is unsigned but performed in practice covers what happens once work has already been delivered without paperwork.
If you want a first read on your own facts, send the contract and the repository log for review. The first response comes in minutes during business hours. A price follows within one business day.
Frequently asked questions
What is the first step when source code sits on a personal account?
Freeze the repository's current state before any contact with the developer. Evidence, not access, is the priority in the first hour.
Which deadline is already running?
No fixed statutory deadline is stated in the material available here. The practical clock is set by how easily history can be altered and by the notice period in the underlying contract.
Who decides, and on what evidence?
The company decides its own strategy first. If the matter is disputed, the national court with jurisdiction over the contract decides, based on the written agreement, commit metadata, and contemporaneous correspondence.