# Confidentiality Agreement: [Organization name]

> Confidentiality and non-disclosure agreement format for employees,
> contractors and third parties, with the programme around it: which
> agreement variant each relationship needs, the clause set, the register
> of signed agreements and the periodic review. It supports ISO/IEC
> 27001:2022 + Amd 1:2024, Annex A control A.6.6 (confidentiality
> agreements), with guidance in ISO/IEC 27002:2022, and links to A.6.2
> (security terms in employment contracts), A.6.5 (duties after leaving
> or changing role) and A.5.20 (security in supplier agreements). Replace
> every `[bracketed]` value and every row marked *Example*. This is a
> documentation format, not legal advice: enforceability, mandatory
> wording and permitted duration depend on the governing law, and
> employee agreements are often restricted by labour law.

<!--
Guidance: How to use this template
- When to use: to set up the confidentiality agreement programme for the
  ISMS, and as the base text for the employee, contractor and third-party
  variants. For a commercial mutual NDA between two companies negotiating
  a deal, the shorter `legal-lite/nda` may fit better; this template adds
  the ISMS requirements analysis, register and review.
- Fill first: section 2 (requirements analysis) and section 3 (variant
  per relationship). Then have counsel adapt Part B for each governing law.
- Main pitfall: agreements that are signed once and never reviewed. An
  auditor will ask how you decided what the agreements must protect, who
  has signed which version, and when the text was last checked against
  current needs. Keep the register current and review the text when
  needs change.
- Second pitfall: clauses that try to stop lawful whistleblowing or
  reports to regulators. In many jurisdictions such clauses are
  unenforceable or unlawful, and some laws expect an explicit notice
  (section 11 of Part B).
- Related templates: `legal-lite/nda`, `isms/personnel-screening-procedure`,
  `isms/offboarding-security-checklist`, `isms/supplier-security-agreement-27036`,
  `data/data-classification-policy`, `isms/information-labelling-handling-procedure`,
  `compliance/acceptable-use-policy`, `isms/control-evidence-matrix`.
-->

## Document control

<!-- Guidance: The template and each signed agreement are different records. This table controls the template text; signed agreements live in the register in section 5. -->

| Field | Value |
|---|---|
| Document ID | DOC-ISMS-051 |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@general-counsel] (text), [@isms-manager] (requirements and register) |
| Approvers/reviewers | [@head-of-people], [@ciso], [@dpo], [@procurement-lead] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal] (template), signed agreements [Confidential] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024, A.6.6; guidance ISO/IEC 27002:2022 |
| Variants in use | [NDA-E employee / NDA-C contractor / NDA-M mutual / NDA-O one-way inbound / NDA-V visitor] |
| Governing laws covered | [Jurisdictions for which counsel has approved the text] |
| Next scheduled review | YYYY-MM-DD (at least annually and when classification or legal requirements change) |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Legal counsel | [@general-counsel] | [Approved for listed governing laws] | YYYY-MM-DD |
| ISMS owner | [@isms-manager] | [Approved] | YYYY-MM-DD |
| HR | [@head-of-people] | [Approved employee variant] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 *(Example)* | YYYY-MM-DD | [@general-counsel] | First approved text and register |
| 1.1 *(Example)* | YYYY-MM-DD | [@general-counsel] | Added protected-disclosure notice for a new hiring country |

## Contents

Part A: programme

1. Purpose and scope
2. Confidentiality requirements analysis
3. Agreement variants
4. Signing and onboarding rules
5. Register of agreements
6. Review and re-signing
7. Size tiers
8. Records and evidence

Part B: model agreement text

9. Parties, purpose and definitions
10. Obligations, exclusions and permitted disclosures
11. Protected disclosures and compelled disclosure
12. Duration, return and destruction
13. Remedies, general terms and signatures

Part C

14. References

## 1. Purpose and scope

<!-- Guidance: Say which relationships need an agreement. Questions to answer: do interns, board members, auditors, visitors to secure areas and acquired staff sign? Pitfall: relying on employment contracts that contain no confidentiality wording, or on a supplier master agreement whose confidentiality clause excludes subcontractors. -->

This document sets how [Organization name] protects confidential
information through written agreements with the people and organizations
that receive it. It covers:

- employees, through a confidentiality agreement or confidentiality
  terms in the employment contract (A.6.2);
- contractors, consultants, interns and agency staff;
- suppliers, partners, prospective customers and investors who receive
  non-public information;
- visitors to secure areas and external auditors where their own
  professional duties do not already bind them.

Agreements protect information classified Internal and above under the
data classification policy (`data/data-classification-policy`) and any
information received from customers or partners under their own
confidentiality terms.

## 2. Confidentiality requirements analysis

<!-- Guidance: The control starts with identifying needs. Write down what the organization must protect and why, so the clauses follow from real requirements. An auditor asks how the agreement content was determined and when it was last checked against current needs. -->

| Ref | Requirement source | What must be protected | Effect on agreement |
|---|---|---|---|
| CONF-REQ-001 *(Example)* | Customer contracts and data processing agreements | Customer data and customer system details | Flow-down to all personnel and subprocessors with access, duration at least as long as customer terms |
| CONF-REQ-002 *(Example)* | Data protection law (for example GDPR Article 28(3)(b) for processors) | Personal data processed for customers | Persons authorised to process the personal data have committed to confidentiality or are under a statutory duty of confidentiality |
| CONF-REQ-003 *(Example)* | Trade secret protection (for example Directive (EU) 2016/943) | Source code, algorithms, pricing models | Trade secret status depends on reasonable steps to keep the information secret; agreements are commonly one of those steps, alongside technical and organisational measures |
| CONF-REQ-004 *(Example)* | Security architecture and incidents | Network diagrams, vulnerabilities, incident details | Specific mention in the definition, no time limit while information remains sensitive |
| CONF-REQ-005 *(Example)* | Mergers, financing and listed-company rules | Deal information | Separate one-way agreement with stricter use limits |

Record each requirement source also in the legal, regulatory and
contractual register (DOC-ISMS-014).

## 3. Agreement variants

<!-- Guidance: Use as few variants as possible, but do not force one text onto every relationship. Each variant is Part B with the options in the table selected. -->

| Variant | Use for | Direction | Duration of confidentiality *(Example options)* | Specific clauses |
|---|---|---|---|---|
| NDA-E Employee | Employees, where the employment contract does not already cover it | One-way (to the organization) | During employment and indefinitely after for trade secrets and personal data, [3] years after for other information | IP and inventions handled in the employment contract, protected-disclosure notice |
| NDA-C Contractor | Individual contractors, consultants, interns, agency staff | One-way | Engagement plus [5] years, trade secrets and personal data indefinitely | Return of assets, subcontracting prohibited without consent |
| NDA-M Mutual | Partners, prospective suppliers and customers exchanging information | Two-way | [2] to [5] years from disclosure | Purpose limitation, no licence, no obligation to proceed |
| NDA-O One-way inbound | Receiving information from a customer or partner | One-way (to the other party) | As requested by the discloser, reviewed by counsel | Review against our ability to comply, access lists |
| NDA-V Visitor | Visitors to secure areas, short-term auditors | One-way | [2] years | Short form, signed at reception or electronically |

Supplier relationships with system or data access use the supplier
security agreement (`isms/supplier-security-agreement-27036`, DOC-ISMS-068)
in addition to, or instead of, a stand-alone NDA.

## 4. Signing and onboarding rules

<!-- Guidance: Agreements must be signed before information is shared. State the gate. Pitfall: account creation before the agreement is signed. -->

1. HR or the requester selects the variant from section 3.
2. The agreement is signed (wet ink or an electronic signature method
   accepted in the governing law) **before** any account, badge or
   non-public information is provided.
3. For employees and contractors, the signed agreement is a precondition
   of the onboarding ticket (`ops/onboarding-checklist`), after screening
   is cleared (`isms/personnel-screening-procedure`).
4. Any change to the standard text requested by a counterparty goes to
   legal counsel; accepted deviations are recorded in the register.
5. The person receives a copy and a short explanation of what is
   confidential, linked from the employee security handbook
   (`isms/employee-security-handbook`).

```mermaid
flowchart LR
  A["Relationship identified"] --> B["Select variant from section 3"]
  B --> C{"Counterparty requests changes?"}
  C -- Yes --> D["Legal counsel review, deviation recorded"]
  C -- No --> E["Signature"]
  D --> E
  E --> F["Register entry, section 5"]
  F --> G["Access or information shared"]
```

## 5. Register of agreements

<!-- Guidance: The register is the main evidence for A.6.6. Track every signed agreement with its expiry. Store personal data of signatories only in the HR or contract system, and use IDs here. -->

| Agreement ID | Variant | Counterparty (ID or company) | Signed | Expires | Deviations | Owner | Next review |
|---|---|---|---|---|---|---|---|
| NDA-2026-001 *(Example)* | NDA-E | E-1042 | 2026-01-12 | Indefinite for trade secrets and personal data, [3] years after employment for other information | None | [@head-of-people] | 2027-01-12 |
| NDA-2026-002 *(Example)* | NDA-M | [Prospective partner company] | 2026-02-03 | 2029-02-03 (3 years) | Governing law changed to counterparty's | [@general-counsel] | 2027-02-03 |
| NDA-2026-003 *(Example)* | NDA-C | C-0017 | 2026-02-20 | End of engagement plus [5] years | None | [@procurement-lead] | 2027-02-20 |

## 6. Review and re-signing

<!-- Guidance: The control expects regular review. Decide what is reviewed (the text, and whether each agreement is still adequate) and when. -->

Review the template text at least annually and when:

- the classification scheme or handling rules change;
- a new customer or regulatory requirement adds confidentiality duties;
- the organization hires or contracts in a new jurisdiction;
- an incident shows that an agreement did not cover a disclosure.

Review the register quarterly for expiring agreements, missing signatures
for active personnel and suppliers, and agreements on superseded text.
Ask for re-signature when the text changes materially for roles with
access to Confidential information, where the governing law allows it.

## 7. Size tiers

<!-- Guidance: These are the library's working tiers. Show what changes with size. -->

| Aspect | Small: Quillmere Analytics Ltd | Medium: Quillmere Health Systems | Large: Quillmere Group |
|---|---|---|---|
| Variants | NDA-E in the employment contract, NDA-C for 8 contractors, NDA-M for partners | All five variants, NDA-O for hospital customer terms | All variants per governing law in 4 countries, local counsel versions |
| Register | Spreadsheet owned by the ISMS manager (0.5 FTE) | Contract management system, HR system for employees | Group contract platform, country HR systems, quarterly consolidated report |
| Review | Annual with the ISMS management review | Annual plus customer-driven changes | Annual group review, country updates when local law changes |
| Typical gap found at audit | Contractors who started before signing | Expired mutual NDAs still used for sharing | Plant visitors in OT areas not covered |

## 8. Records and evidence

<!-- Guidance: Link these records in the control evidence matrix (`isms/control-evidence-matrix`, DOC-ISMS-033). -->

| Record | Proves | Owner | Location | Retention |
|---|---|---|---|---|
| Signed agreements | Agreement in place before access | HR, procurement, legal | HR system, contract system | Agreement term plus [6] years or as set in DOC-ISMS-014 |
| Register (section 5) | Coverage and expiry tracking | ISMS manager | [Location] | Current plus superseded versions [3] years |
| Requirements analysis (section 2) | Needs identified | Legal counsel | Document management system | Life of version plus [3] years |
| Annual review record | Regular review | Legal counsel, ISMS manager | Management review input | [3] years |
| Onboarding tickets referencing the agreement ID | Signature before access | IT service desk | Ticketing system | [2] years |

## 9. Parties, purpose and definitions

<!-- Guidance: Part B starts here. Remove all guidance comments and the bracketed options you do not use before signature. Have counsel adapt it for the governing law. -->

**This Confidentiality Agreement** ("Agreement") is made on [YYYY-MM-DD]
between:

| Party | Details |
|---|---|
| Disclosing party (or Party A in the mutual variant) | [Organization name], [registered address], [registration number] |
| Receiving party (or Party B in the mutual variant) | [Name of individual or company], [address], [registration number if a company] |

**9.1 Purpose.** The Receiving Party will receive Confidential Information
only for [the employment / the engagement described in contract reference /
evaluating a possible business relationship concerning description]
(the "Purpose").

**9.2 Confidential Information** means all information, in any form,
disclosed by or on behalf of the Disclosing Party or obtained by the
Receiving Party through access to its premises, systems or personnel,
that is marked or identified as confidential, or that a reasonable person
would understand to be confidential given its nature. It includes, in
particular:

- personal data, including customer and employee data;
- source code, designs, algorithms, product roadmaps and unreleased
  features;
- security information: architecture, configurations, credentials,
  vulnerabilities, audit findings and incident details;
- customer lists, pricing, contracts and financial information;
- information received from third parties under a duty of confidence.

**9.3 Representatives** means employees, officers and professional
advisers of the Receiving Party who need to know Confidential Information
for the Purpose (mutual and company variants only).

## 10. Obligations, exclusions and permitted disclosures

<!-- Guidance: Keep the obligations aligned with the handling rules in the labelling and handling procedure (DOC-ISMS-042) so staff are not given two different rule sets. -->

**10.1 Obligations.** The Receiving Party shall:

1. use Confidential Information only for the Purpose;
2. not disclose it to anyone except Representatives bound by duties of
   confidentiality at least as protective as this Agreement;
3. protect it with at least the care it uses for its own confidential
   information and no less than reasonable care, following the
   Disclosing Party's handling rules where provided;
4. not copy, extract or transfer it to personal accounts, devices or
   unapproved services, including public AI tools, unless permitted by the
   Disclosing Party's policies;
5. report any actual or suspected unauthorised disclosure without undue
   delay through [reporting channel] (see `isms/security-event-reporting-procedure`).

**10.2 Exclusions.** Obligations do not apply to information that the
Receiving Party can show by written records:

1. is or becomes public other than through a breach of this Agreement;
2. was lawfully known to it before disclosure without a duty of
   confidence;
3. is lawfully received from a third party without a duty of confidence;
4. is independently developed without use of the Confidential
   Information.

Personal data remains protected under data protection law even where an
exclusion applies.

**10.3 Permitted disclosure** to Representatives is allowed only on a
need-to-know basis; the Receiving Party is responsible for their
compliance.

## 11. Protected disclosures and compelled disclosure

<!-- Guidance: This clause keeps the agreement lawful. Many laws protect whistleblowers and reports to authorities, and some require an explicit notice. Examples: the EU Whistleblower Directive (EU) 2019/1937 prevents rights under it from being waived or limited by agreement (Article 24), Directive (EU) 2016/943 (Article 5) lists, under conditions, revealing misconduct or illegal activity in the public interest among the cases where trade secret claims are dismissed; and in the United States 18 U.S.C. 1833(b) gives immunity for certain confidential disclosures of trade secrets to government officials or attorneys for reporting a suspected violation of law, and an employer that does not give notice of it in agreements with employees (a term that there includes contractors and consultants) cannot recover some remedies against them. Some labour laws also protect discussing pay and working conditions. These are examples only, not a complete list. Counsel confirms wording per governing law. -->

**11.1 Protected disclosures.** Nothing in this Agreement prevents the
Receiving Party from reporting possible violations of law to a
government authority, regulator or law enforcement, from making a
disclosure protected by whistleblower law, from communicating with an
attorney for legal advice, or from exercising rights the law does not
allow to be limited by contract. [Insert any notice required by the
governing law, for example the trade secret immunity notice where 18
U.S.C. 1833(b) applies.]

**11.2 Compelled disclosure.** If law, regulation or a court order
requires disclosure, the Receiving Party shall, where lawful, notify the
Disclosing Party promptly, disclose only what is legally required and
cooperate with any lawful effort to obtain protective treatment.

## 12. Duration, return and destruction

<!-- Guidance: Pick durations from section 3. Trade secrets and personal data usually need protection for as long as they keep that status. A fixed short term for all information is a common weakness. -->

**12.1 Duration.** This Agreement applies from the date of signature.
Obligations continue for [number] years after [end of employment /
end of the engagement / last disclosure], except that obligations for
trade secrets and personal data continue for as long as the information
remains a trade secret or personal data.

**12.2 Return and destruction.** On request, and in any event at the end
of the [employment / engagement / Purpose], the Receiving Party shall
promptly return or securely destroy all Confidential Information,
including copies on personal devices and in cloud accounts, and confirm in
writing within [10] business days. Copies that must be kept by law, or in
automatic backups that cannot reasonably be deleted, stay subject to this
Agreement until destroyed. For employees and contractors this confirmation
is part of the offboarding checklist (`isms/offboarding-security-checklist`).

## 13. Remedies, general terms and signatures

<!-- Guidance: Remedies and general terms are where governing law matters most. Do not add penalty clauses or non-compete terms without counsel: many jurisdictions restrict them, particularly for employees. -->

**13.1 Remedies.** The Receiving Party acknowledges that unauthorised
disclosure may cause harm for which damages alone may be inadequate, and
that the Disclosing Party may seek injunctive or other relief available
under the governing law, in addition to any other remedies. Breach by an
employee may also lead to action under the disciplinary process
(`isms/security-disciplinary-process`).

**13.2 No licence, no warranty.** No right or licence in any intellectual
property is granted. Information is provided as is, without warranty.

**13.3 General.** This Agreement is governed by the law of [jurisdiction]
and the courts of [venue] have jurisdiction [or: disputes go to
arbitration under named rules]. It is the entire agreement on its subject
and can be changed only in writing signed by both parties. If a provision
is unenforceable, the rest remains in effect.

| Signed for | Name | Title | Signature | Date |
|---|---|---|---|---|
| [Organization name] | [Name] | [Title] | [Signature] | YYYY-MM-DD |
| Receiving party | [Name] | [Title, if a company] | [Signature] | YYYY-MM-DD |

## 14. References

<!-- Guidance: Cite editions exactly and check the law in each governing jurisdiction before relying on any example. -->

| Reference | Edition | Use |
|---|---|---|
| ISO/IEC 27001:2022 + Amd 1:2024, https://www.iso.org/standard/82875.html, Amd: https://www.iso.org/standard/88435.html | 2022, Amd 1 2024-02-23 | Control A.6.6, links to A.6.2, A.6.5, A.5.20 |
| ISO/IEC 27002:2022, https://www.iso.org/standard/75652.html | 2022 | Guidance on confidentiality agreements |
| Regulation (EU) 2016/679 (GDPR), Article 28(3)(b) | 2016 | Example: confidentiality of persons processing personal data for a processor |
| Directive (EU) 2016/943 on trade secrets | 2016 | Example: reasonable steps to keep information secret |
| Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law, Article 24 | 2019 | Example: rights cannot be waived by agreement |
| 18 U.S.C. 1833(b) | Current US Code | Example: trade secret whistleblower immunity notice |
| NIST SP 800-53 Rev. 5 (release 5.2.0, August 2025), control PS-6 Access Agreements | Rev. 5 | Optional crosswalk |

Related templates: `legal-lite/nda`, `isms/personnel-screening-procedure`,
`isms/offboarding-security-checklist`, `isms/security-disciplinary-process`,
`isms/supplier-security-agreement-27036`, `isms/information-labelling-handling-procedure`,
`data/data-classification-policy`, `isms/employee-security-handbook`,
`compliance/legal-register`, `isms/control-evidence-matrix`.

## Standard and licence note

Structure aligned with ISO/IEC 27001:2022 including Amd 1:2024, Annex A
control A.6.6, with guidance in ISO/IEC 27002:2022. The programme,
variants, clause text, examples and guidance are original wording; no ISO
or IEC text is reproduced. ISO and IEC standards are copyrighted: obtain
the official standard from ISO or your national standards body
(https://www.iso.org/standard/82875.html). Check the current edition and
amendments, and the current law of each governing jurisdiction, before
use. This is a documentation format, not legal advice. Template licence:
MIT.