Contract clause
Confidentiality clause
A confidentiality clause is the section of a wider agreement that stops each party disclosing or misusing information it receives from the other. It does the same job as a standalone non disclosure agreement, but it has to fit alongside the term, the survival clause and the rest of the contract.
Inside a services or employment agreement, this clause is rarely read until somebody leaves. Its real drafting questions are about how it interacts with the other clauses rather than about the duty itself.
Nuwan Madhusanka · Co-founder
4 min read · Published
Sample clause
a consulting agreement between Fernhill Consulting and Marlow Logistics, a fictional freight business in Brisbane
1. Confidential Information. Confidential Information means information disclosed by one party to the other in connection with this agreement that is marked confidential or that a reasonable person would understand to be confidential, including pricing, customer lists, operating procedures and the terms of this agreement. 1.1 Confidential Information does not include information that is public other than through a breach of this clause, that the receiving party already held without a duty of confidence, that it receives from a third party entitled to disclose it, or that it develops independently without using the other party's information. 2. Obligations. Each party must keep the other's Confidential Information confidential, use it only for the purposes of this agreement, and protect it with at least the care it applies to its own confidential information. 3. Permitted Disclosure. A party may disclose Confidential Information to its employees, contractors and professional advisers who need it and are bound by equivalent obligations, and where required by law, after giving the other party notice where it is lawful to do so. 4. Duration. Clause 2 applies during the Term and for 3 years after this agreement ends.
Sample wording, not legal advice.
Variants
Mutual, inside a services agreement
Both parties expect to hand over information, which is the normal position once a supplier is inside a customer's systems.
Each party must keep the other party's Confidential Information confidential, must use it only for the purposes of this agreement, and must not disclose it except as permitted by this clause. Each party must apply at least the standard of care it applies to its own confidential information of similar importance, and in any event no less than a reasonable standard of care. These obligations apply during the Term and for three years after this agreement ends, and apply to each item of Confidential Information from the date it was disclosed.
One way, protecting the customer only
The supplier receives information and discloses nothing of its own, such as a data processing or assessment engagement.
The Supplier must keep the Customer's Confidential Information confidential and must use it only to perform the Services. The Supplier must not copy or extract Confidential Information except as needed to perform the Services, must keep a record of where it is stored, and must restrict access to the personnel named in Schedule 3. The Supplier must notify the Customer within two business days of becoming aware of any unauthorised access, use or disclosure, and must cooperate with the Customer's response.
With a compelled disclosure exception
Regulated industries and any contract where a party may receive a subpoena, a notice to produce or a regulator request.
A party may disclose Confidential Information to the extent required by law, by a court, or by a regulator with jurisdiction over it. Before disclosing, the party must notify the other party where it is lawful to do so, must give that party a reasonable opportunity to seek a protective order or equivalent relief, and must disclose only the part of the Confidential Information it is legally required to disclose. Disclosure under this clause is not a breach of this agreement.
What to negotiate
How long the duty runs after the contract ends
A tail of three to five years is the usual commercial range for ordinary business information, with trade secrets carved out to run while they remain secret. Customers sometimes ask for perpetual protection over everything, which is difficult to comply with and easy to forget. Splitting the duty into a fixed tail plus an indefinite trade secret carve out satisfies both positions.
Whether the marking requirement is real
Requiring information to be marked confidential is neat on paper and rarely followed in practice, since most sensitive material arrives in conversation or in an ordinary email. Suppliers like the certainty of a marking rule. The common settlement is a clause covering material that is marked or that a reasonable person would understand to be confidential, which catches both.
Who inside the receiving business may see it
The disclosing party wants a need to know limit and a requirement that anyone who sees the information is bound by equivalent obligations. Receiving parties want advisers, insurers and auditors covered as standing permissions so they are not seeking consent each time. Naming those categories in the clause avoids a request that will always be granted anyway.
What happens on an unauthorised disclosure
A duty with no reporting obligation means the disclosing party may learn of a leak long after it could have acted. Two business days to notify, plus cooperation with the response, is a common and workable standard. Receiving parties ask that notification not be treated as an admission of breach, which is a fair addition to include.
The risk of leaving it out
With no confidentiality clause, protection depends on the general law of confidence, which requires the information to have the necessary quality of confidence, to have been received in circumstances importing an obligation, and to have been used without authority. That is provable but slow, and it gives no agreed duration, no exclusions and no reporting obligation to work from.
How it differs from a standalone NDA
A non disclosure agreement is a whole document built around one duty, so it carries its own definitions, term, governing law and notices. A confidentiality clause is a section inside an agreement that already has all of those, which changes the drafting. The duration cannot simply be five years from disclosure if the survival clause says something different, and the permitted disclosure list has to line up with the subcontracting clause, since a supplier allowed to subcontract must also be allowed to brief the subcontractor. Reviewing the clause on its own is how contracts end up with a confidentiality duty that expires before the intellectual property licence it was meant to protect.
Personal information is a separate obligation
Confidential information and personal information overlap but are not the same thing, and a confidentiality clause does not discharge privacy obligations. In Australia the Privacy Act 1988 and the Australian Privacy Principles apply to entities covered by that Act and govern how personal information is collected, used, disclosed, secured and destroyed, regardless of what the contract says. Agreements that involve customer records usually carry a separate privacy clause dealing with notifiable data breaches, offshore disclosure and the handling of information at the end of the contract. Treating the confidentiality clause as covering all of that is a common and expensive assumption.
Where it sits in a generated document
The document generator writes an agreement as numbered content, so a confidentiality clause arrives as a numbered section with its definition, obligations, exceptions and duration as sub clauses. The generated text is written from the description it is given and it never prints citations, so any period or statutory reference in a draft has to be checked before the document is used. Saying in the description how long the duty should run after the agreement ends is worth doing, because otherwise the clause and the survival list can end up disagreeing.
Documents that carry this clause
Consulting agreementAn advisory firm reviews three bakeries over seven weeks. What makes this agreement useful is not the fee clause but the two clauses that say what the advice is not.
Employment contractA full time ongoing contract for an operations coordinator on $86,000 plus $10,320 of superannuation. Eleven numbered clauses, a leave table drawn from the National Employment Standards, and a notice table that scales with service.
Statement of work template under a master agreementArdent Analytics migrates Coastline Insurance’s claims database to a cloud platform over 18 weeks under SOW-2026-041, governed by a master services agreement dated 3 March 2026. The work is time and materials with four roles priced by the day and a $412,000 estimate before GST, five dated deliverables, ten business days to accept each one, and five assumptions written down before anyone starts.
Employee confidentiality agreement with information classesMost employee confidentiality agreements treat every secret the same way. This one sorts information into four classes, gives each its own handling rule and its own survival period, and is executed as a deed so it still binds after the salary that supported it has stopped.Questions people ask
Do I need an NDA if the contract already has a confidentiality clause?
Usually not for the same subject matter. A properly drafted clause inside the agreement does the same work. A separate non disclosure agreement is still useful before the main contract exists, because information is often exchanged during the negotiation, and the two documents should then be checked against each other so the duties do not conflict.
How long should a confidentiality clause last?
Three to five years after the agreement ends is the common commercial range for ordinary business information, with trade secrets carved out to run for as long as they remain secret. The period should match the survival clause, since a confidentiality duty of five years is worth nothing if the survival list only carries the clause for two.
What are the standard exclusions?
Four appear in almost every clause: information already public other than through a breach, information the receiving party already held, information received legitimately from a third party, and information developed independently without using the other party's material. Requiring written evidence for the independent development limb is a reasonable amendment for the disclosing party to seek.
Can confidential information be shared with subcontractors?
Only if the clause allows it. The permitted disclosure list should cover employees, contractors and advisers who need the information and are bound by equivalent obligations. Where the contract allows subcontracting, the confidentiality clause has to permit briefing the subcontractor, otherwise two clauses in the same document contradict each other.
Does a confidentiality clause cover personal information?
Not adequately. Privacy obligations under the Privacy Act 1988 and the Australian Privacy Principles apply to covered entities regardless of the contract, and cover collection, use, disclosure, security and destruction. Agreements handling customer records normally carry a separate privacy clause dealing with data breaches, offshore disclosure and end of contract handling.
What should happen if information leaks?
The clause should require prompt notification, commonly within two business days of becoming aware, plus cooperation with the disclosing party's response and reasonable steps to limit further disclosure. Adding that notification is not an admission of breach makes the obligation easier for the receiving party to accept and more likely to be complied with quickly.
Put the clause in a finished document
The button opens the document generator with a starting description already filled in. Change it to match your own agreement before you run it.
Create a document with OneCraftRelated clauses
- Trade secrets clauseA trade secrets clause protects know how that has value because it is secret. Sample wording for a recipe and supplier list, perpetual terms and the US notice.
- Return of confidential information clauseA return of confidential information clause says what is given back or destroyed at the end. Sample wording, backup carve outs and the destruction certificate.
- Survival clauseA survival clause names the obligations that keep running after a contract ends. Sample wording, which clauses survive, time limits and what to negotiate.
For everything the document generator can do, see the document maker.
Step by step in the builder: Create a document with AI, then Document builder components.
Written and checked by the OneCraft team. Last checked .