Confidentiality Agreement Template (ISO/IEC 27001 A.6.6)

Confidentiality Agreement: [Organization name]

Confidentiality and non-disclosure agreement format for employees, contractors and third parties, with the programme around it: which agreement variant each relationship needs, the clause set, the register of signed agreements and the periodic review. It supports ISO/IEC 27001:2022 + Amd 1:2024, Annex A control A.6.6 (confidentiality agreements), with guidance in ISO/IEC 27002:2022, and links to A.6.2 (security terms in employment contracts), A.6.5 (duties after leaving or changing role) and A.5.20 (security in supplier agreements). Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice: enforceability, mandatory wording and permitted duration depend on the governing law, and employee agreements are often restricted by labour law.

Document control

Approvals

Revision history

Contents

Part A: programme

1. Purpose and scope
2. Confidentiality requirements analysis
3. Agreement variants
4. Signing and onboarding rules
5. Register of agreements
6. Review and re-signing
7. Size tiers
8. Records and evidence

Part B: model agreement text

9. Parties, purpose and definitions
10. Obligations, exclusions and permitted disclosures
11. Protected disclosures and compelled disclosure
12. Duration, return and destruction
13. Remedies, general terms and signatures

Part C

14. References

1. Purpose and scope

This document sets how [Organization name] protects confidential information through written agreements with the people and organizations that receive it. It covers:

• employees, through a confidentiality agreement or confidentiality terms in the employment contract (A.6.2);
• contractors, consultants, interns and agency staff;
• suppliers, partners, prospective customers and investors who receive non-public information;
• visitors to secure areas and external auditors where their own professional duties do not already bind them.

Agreements protect information classified Internal and above under the data classification policy (data/data-classification-policy) and any information received from customers or partners under their own confidentiality terms.

2. Confidentiality requirements analysis

Record each requirement source also in the legal, regulatory and contractual register (DOC-ISMS-014).

3. Agreement variants

Supplier relationships with system or data access use the supplier security agreement (isms/supplier-security-agreement-27036, DOC-ISMS-068) in addition to, or instead of, a stand-alone NDA.

4. Signing and onboarding rules

1. HR or the requester selects the variant from section 3.
2. The agreement is signed (wet ink or an electronic signature method accepted in the governing law) before any account, badge or non-public information is provided.
3. For employees and contractors, the signed agreement is a precondition of the onboarding ticket (ops/onboarding-checklist), after screening is cleared (isms/personnel-screening-procedure).
4. Any change to the standard text requested by a counterparty goes to legal counsel; accepted deviations are recorded in the register.
5. The person receives a copy and a short explanation of what is confidential, linked from the employee security handbook (isms/employee-security-handbook).

5. Register of agreements

6. Review and re-signing

Review the template text at least annually and when:

• the classification scheme or handling rules change;
• a new customer or regulatory requirement adds confidentiality duties;
• the organization hires or contracts in a new jurisdiction;
• an incident shows that an agreement did not cover a disclosure.

Review the register quarterly for expiring agreements, missing signatures for active personnel and suppliers, and agreements on superseded text. Ask for re-signature when the text changes materially for roles with access to Confidential information, where the governing law allows it.

7. Size tiers

8. Records and evidence

9. Parties, purpose and definitions

This Confidentiality Agreement ("Agreement") is made on [YYYY-MM-DD] between:

9.1 Purpose. The Receiving Party will receive Confidential Information only for [the employment / the engagement described in contract reference / evaluating a possible business relationship concerning description] (the "Purpose").

9.2 Confidential Information means all information, in any form, disclosed by or on behalf of the Disclosing Party or obtained by the Receiving Party through access to its premises, systems or personnel, that is marked or identified as confidential, or that a reasonable person would understand to be confidential given its nature. It includes, in particular:

• personal data, including customer and employee data;
• source code, designs, algorithms, product roadmaps and unreleased features;
• security information: architecture, configurations, credentials, vulnerabilities, audit findings and incident details;
• customer lists, pricing, contracts and financial information;
• information received from third parties under a duty of confidence.

9.3 Representatives means employees, officers and professional advisers of the Receiving Party who need to know Confidential Information for the Purpose (mutual and company variants only).

10. Obligations, exclusions and permitted disclosures

10.1 Obligations. The Receiving Party shall:

1. use Confidential Information only for the Purpose;
2. not disclose it to anyone except Representatives bound by duties of confidentiality at least as protective as this Agreement;
3. protect it with at least the care it uses for its own confidential information and no less than reasonable care, following the Disclosing Party's handling rules where provided;
4. not copy, extract or transfer it to personal accounts, devices or unapproved services, including public AI tools, unless permitted by the Disclosing Party's policies;
5. report any actual or suspected unauthorised disclosure without undue delay through [reporting channel] (see isms/security-event-reporting-procedure).

10.2 Exclusions. Obligations do not apply to information that the Receiving Party can show by written records:

1. is or becomes public other than through a breach of this Agreement;
2. was lawfully known to it before disclosure without a duty of confidence;
3. is lawfully received from a third party without a duty of confidence;
4. is independently developed without use of the Confidential Information.

Personal data remains protected under data protection law even where an exclusion applies.

10.3 Permitted disclosure to Representatives is allowed only on a need-to-know basis; the Receiving Party is responsible for their compliance.

11. Protected disclosures and compelled disclosure

11.1 Protected disclosures. Nothing in this Agreement prevents the Receiving Party from reporting possible violations of law to a government authority, regulator or law enforcement, from making a disclosure protected by whistleblower law, from communicating with an attorney for legal advice, or from exercising rights the law does not allow to be limited by contract. [Insert any notice required by the governing law, for example the trade secret immunity notice where 18 U.S.C. 1833(b) applies.]

11.2 Compelled disclosure. If law, regulation or a court order requires disclosure, the Receiving Party shall, where lawful, notify the Disclosing Party promptly, disclose only what is legally required and cooperate with any lawful effort to obtain protective treatment.

12. Duration, return and destruction

12.1 Duration. This Agreement applies from the date of signature. Obligations continue for [number] years after [end of employment / end of the engagement / last disclosure], except that obligations for trade secrets and personal data continue for as long as the information remains a trade secret or personal data.

12.2 Return and destruction. On request, and in any event at the end of the [employment / engagement / Purpose], the Receiving Party shall promptly return or securely destroy all Confidential Information, including copies on personal devices and in cloud accounts, and confirm in writing within [10] business days. Copies that must be kept by law, or in automatic backups that cannot reasonably be deleted, stay subject to this Agreement until destroyed. For employees and contractors this confirmation is part of the offboarding checklist (isms/offboarding-security-checklist).

13. Remedies, general terms and signatures

13.1 Remedies. The Receiving Party acknowledges that unauthorised disclosure may cause harm for which damages alone may be inadequate, and that the Disclosing Party may seek injunctive or other relief available under the governing law, in addition to any other remedies. Breach by an employee may also lead to action under the disciplinary process (isms/security-disciplinary-process).

13.2 No licence, no warranty. No right or licence in any intellectual property is granted. Information is provided as is, without warranty.

13.3 General. This Agreement is governed by the law of [jurisdiction] and the courts of [venue] have jurisdiction [or: disputes go to arbitration under named rules]. It is the entire agreement on its subject and can be changed only in writing signed by both parties. If a provision is unenforceable, the rest remains in effect.

14. References

Related templates: legal-lite/nda, isms/personnel-screening-procedure, isms/offboarding-security-checklist, isms/security-disciplinary-process, isms/supplier-security-agreement-27036, isms/information-labelling-handling-procedure, data/data-classification-policy, isms/employee-security-handbook, compliance/legal-register, isms/control-evidence-matrix.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 including Amd 1:2024, Annex A control A.6.6, with guidance in ISO/IEC 27002:2022. The programme, variants, clause text, examples and guidance are original wording; no ISO or IEC text is reproduced. ISO and IEC standards are copyrighted: obtain the official standard from ISO or your national standards body (https://www.iso.org/standard/82875.html). Check the current edition and amendments, and the current law of each governing jurisdiction, before use. This is a documentation format, not legal advice. Template licence: MIT.