Confidentiality Agreement Best Practices

A confidentiality agreement is easy to underestimate. Many drafts look tidy while leaving the parties unsure about what is protected, who may receive it, whether subcontractors are covered, how long duties last, and what happens when a regulator or court requires disclosure. Best practice is not longer wording for its own sake. It is precise wording that the parties can actually follow.

This guide uses a consulting-style example because it shows the common pressure points. A client is sharing sales data, pricing plans, customer interview notes and strategy documents with an outside consulting team. The consulting team may involve employees, advisers and one subcontractor. Both sides want the work to move quickly, but neither side wants confidential information copied into the wrong system or locked behind unrealistic promises.

Define confidential information clearly

The definition should identify the protected information, the reason it is being shared and the forms it may take. Avoid a definition so broad that it covers every conversation forever, and avoid one so narrow that an unmarked spreadsheet falls outside the agreement by accident.

A practical definition usually addresses:

• The purpose of the disclosure
• The disclosing and receiving parties
• Written, oral, visual and electronic information
• Examples relevant to the transaction
• Whether information must be marked confidential
• Information that a reasonable person would understand to be confidential

Draft language:

Confidential Information means non-public information disclosed by or on behalf of [Disclosing Party] to [Receiving Party] in connection with [Purpose], whether written, oral, visual, electronic or otherwise, that is marked confidential or that a reasonable person would understand to be confidential from the nature of the information or the circumstances of disclosure. Examples include [customer lists, pricing models, interview notes, product plans and financial analysis].

For trade secret issues, a confidentiality agreement can be one reasonable measure, but it is not the whole protection system. Access controls, labeling, project storage rules and recipient training may matter just as much in practice.

Review question: could a project manager decide whether a draft pricing workbook, interview transcript or site drawing is covered without calling a lawyer for every file?

Limit permitted use and disclosure

The permitted use clause is where the agreement becomes operational. It should say why the recipient may use the information and who may see it. Without this section, a recipient may understand that the information is "confidential" but still be unclear about whether it can be used for benchmarking, training, marketing or another client project.

Draft language:

Receiving Party may use Confidential Information solely to evaluate and perform [Purpose]. Receiving Party may disclose Confidential Information only to its employees, professional advisers and approved subcontractors who need the information for that Purpose and who are bound by confidentiality obligations at least as protective as those in this agreement.

Best practice is to match the clause to the actual workflow. If advisers, auditors, insurers, lenders or subcontractors need access, decide whether they are allowed and under what conditions. If the recipient uses a project workspace, state the handling expectation in a way the recipient can meet. Do not promise "military-grade security" or deletion from every backup if that is not how the systems work.

For personal data, confidentiality wording may not be enough. Under UK GDPR guidance, the ICO explains that contracts between controllers and processors must address required data protection terms, and the commercial terms are for the parties so long as the contract complies with UK GDPR (ICO controller and processor contracts). State the jurisdiction and get privacy review when personal data is part of the exchange.

Review question: does the agreement identify every class of person who will actually receive the information, including subcontractors and advisers?

Write exceptions that do not swallow the rule

Exceptions are not loopholes; they keep the agreement realistic and legally safer. Common exceptions cover information that is public through no breach, already lawfully known, lawfully received from a third party, independently developed without using confidential information, or required to be disclosed by law.

Draft language:

Confidential Information does not include information that Receiving Party can demonstrate: (a) is or becomes public other than through breach of this agreement; (b) was lawfully known by Receiving Party before disclosure; (c) is lawfully received from a third party without a duty of confidence; or (d) is independently developed without use of Confidential Information.

Required disclosure clauses should be careful. A recipient may need to respond to a court order, regulator or legal duty. The agreement can require notice where legally permitted, but it should not prohibit protected reporting.

In the United States, the SEC states that Rule 21F-17(a) prohibits actions that impede an individual from communicating directly with SEC staff about a possible securities law violation, including enforcing or threatening to enforce a confidentiality agreement for those communications (SEC whistleblower protections). Separately, the DTSA includes immunity provisions for certain confidential disclosures to government officials or attorneys to report or investigate suspected legal violations, and contains notice consequences for employers in agreements governing trade secret or confidential information with employees, contractors or consultants (18 U.S.C. § 1833).

Draft protected-reporting language:

Nothing in this agreement prohibits any person from reporting a possible violation of law to a government agency or making another disclosure protected by law. No prior approval from [Company] is required for such protected reports.

Have counsel decide the exact language. The point for a business drafter is to spot the issue before the agreement goes out.

Make duration, return and deletion workable

Many confidentiality agreements fail the "can we actually do this?" test. A clause requiring immediate deletion of all information may conflict with legal retention, backups, insurance requirements or professional records. A clause that lasts forever may be inappropriate for ordinary business information, while some trade secrets may need protection as long as they remain trade secrets.

Draft language:

Upon written request or completion of the Purpose, Receiving Party will return or securely delete Confidential Information, except that it may retain copies required by law, professional obligation, insurance requirement or routine backup processes, provided retained copies remain subject to confidentiality obligations.

Best practice is to split the decision. Business owners identify the information and systems. Legal reviewers decide the term, survival language, remedies and retention carve-outs. IT or operations confirms whether return and deletion promises can be performed.

Review question: if the agreement ended today, could the recipient follow the return or deletion clause without breaking another duty or lying about backups?

Use legal review and signature controls

Confidentiality agreements are often signed quickly at the start of a deal. That is exactly why review controls matter. A good internal process checks the agreement before signature and preserves the signed version after signature.

Operational review criteria:

• The purpose is clear and matches the transaction.
• Confidential information examples match what will actually be shared.
• Permitted recipients include only people who need access.
• Subcontractor and adviser access is addressed.
• Exceptions and protected reporting language are present.
• Personal data, employment, securities or trade secret issues are routed for specialist review.
• Duration, return and deletion terms are realistic.
• Governing law and remedies have legal review.
• Signers have authority.
• Both parties sign the same clean version.

Signature block language:

Signed for [Party]: Name, title, date. By signing, the signer confirms they are authorized to bind the party. Version signed: [file name/version]. Legal review completed by: [name/date].

Do not treat a template as enforceability insurance. The final result depends on facts, law, negotiation and execution.

Keep the agreement connected to the work

The best confidentiality agreement is not isolated from the rest of the project. It should align with the statement of work, data processing terms, subcontractor approvals, security policies and incident process. If the SOW allows subcontractors but the confidentiality agreement does not, the team will either breach the agreement or stall the work. If the agreement says data stays in an approved workspace, the project setup should create that workspace before files arrive.

For a drafting head start, the consulting confidentiality agreement template includes editable Word sections for parties, purpose, confidential information, permitted use, exceptions, duration, return, review and execution. Use it to organize the first draft, then send the completed agreement through legal review for your jurisdiction and transaction.

Best practice is practical alignment: protect the information, permit the work, preserve lawful disclosures, and make the signed record easy to prove later.