Confidentiality Clauses: Protected Information, Exceptions and Use
By Anirudh Menon, Viaclause editor
Test a services confidentiality clause against public information, independent development, required disclosure, protected reporting and retained backups.
A confidentiality clause defines information a party must protect and limits how that party may use or disclose it. It can sit inside a services agreement or form part of a separate non-disclosure agreement. A useful clause answers six practical questions: what is protected, for what purpose, who may receive it, what is excluded, when disclosure is permitted and what happens to copies at exit.
For incidental access to customer information, “keep everything confidential” leaves important decisions unanswered. The technician still needs authorised access, a permitted use, instructions for a legal request and a realistic process for deleting working copies while dealing with restricted backups.
This guide uses a fictional business-services scenario and scoped US and UK official sources. It is general information, not legal advice. Employment, settlement, privacy and regulated-data requirements need separate review. The sample is a discussion draft, not a complete agreement.
Clause or NDA: choose the document that fits the relationship
A clause can govern information shared while carrying out an existing service agreement. A standalone NDA may suit an earlier evaluation or a separate exchange. The UK Intellectual Property Office’s 2015 NDA guidance emphasises a defined permitted purpose and realistic confidential sharing with staff or advisers. Its UK guidance should not be treated as a universal execution rule.
Use our NDA template for the separate document structure. Here the focus is applying a clause to everyday service access. Put unanswered scope, recipient and retention questions into the contract review checklist before anyone receives the data.
Define protected information and the permitted purpose
Fictional scenario: Pine Support fixes an export problem for Willow Wholesale. Pine receives an export containing customer contacts and order details, alongside publicly advertised prices. The intended purpose is diagnosing and correcting that specific export problem. The parties are not proposing a general licence to reuse Willow’s customer information.
| Information or action | Proposed treatment in this scenario | Evidence or decision |
|---|---|---|
| Customer contacts and order details | Protected service information; minimise the fields shared | Approved export, access list and ticket reference |
| Public website price | Evaluate the public-information exclusion for that price | Dated public page; do not extend the exclusion to the whole customer export |
| Diagnostic logs | Protect logs containing Willow information | Log contents, location and retention schedule |
| Code Pine independently develops | Evaluate the independent-development exclusion | Development record showing no use of protected Willow information |
| Uploading the export to another AI service | Check permitted use and recipient approval before upload | Exact route, data use, recipients and separate written authorisation if needed |
A label does not establish that all information is a statutory trade secret. The federal definition in 18 USC 1839(3) includes reasonable secrecy measures and independent economic value from not being generally known or readily ascertainable through proper means. Contractual scope and statutory trade-secret status require distinct analysis.
For an AI upload, follow the exact-route contract-data guide. Permission to diagnose a problem should be checked against the actual tool, people and uses involved. A confidentiality label alone does not answer those permission questions.
An original clause for discussion
The following terms are illustrative negotiation choices. Three years and a 120-day backup cycle are not statutory periods or claimed market standards. Integrate the clause with the data-processing, security, incident, recipient and exit schedules.
Confidential Information means Willow Wholesale's non-public customer contacts, order information and diagnostic material disclosed to Pine Support for the export-repair task identified in the service ticket, including copies and extracts containing that information. Pine may use that information solely to diagnose and correct the identified export problem. Access is limited to authorised staff and approved service providers who need it for that task and are subject to appropriate confidentiality obligations. Pine must apply the agreed access and security controls. Other use or sharing requires Willow's written authorisation unless permitted by the exceptions below. The obligations do not cover information Pine can establish was already lawfully known without a confidentiality duty; becomes public other than through a breach of confidentiality; is lawfully obtained from a third party without such a duty; or is independently developed without using Willow's Confidential Information. Where disclosure is legally required, Pine must, to the extent legally permitted and consistent with protected reporting rights, notify Willow promptly and limit the disclosure to what is required. Nothing in this clause restricts disclosures protected by applicable law or imposes an approval or notification requirement on such protected reporting. On completion or termination, Pine must return or delete working copies within ten calendar days, except identified records required by applicable law or a documented legal hold. Backups inaccessible in ordinary operations may remain until expiry of the documented 120-day cycle, with restricted access and no active use. Restored copies must be protected and deleted again when the retention exception no longer applies. These confidentiality duties continue for three years after termination; for information qualifying as a trade secret, they continue for as long as it retains that protection under applicable law. Retained copies remain subject to the confidentiality duties while retained. Required notices and other non-waivable rights must be addressed in the complete agreement.
“Appropriate confidentiality obligations” needs concrete treatment in the recipient schedule: who signs, which restrictions apply and who is responsible for unauthorised use. Set the incident-response requirements separately; a secrecy promise is not a complete security plan. The vendor data-breach response guide covers that operational work.
Test the clause against six edge cases
| Test | Result under the proposed wording | Check before relying on it |
|---|---|---|
| A price is publicly advertised | That public fact may fall outside scope; private order details remain separately assessed | Which precise information is public, and how did it become public? |
| Pine builds similar code independently | The exclusion depends on development without using Willow’s protected information | Repository history and access records, rather than similarity alone |
| A court requires particular records | Use the required-disclosure procedure with its legal limits | Binding scope, recipient, deadline and whether notice is permitted |
| An individual reports possible securities violations to the SEC | Protected reporting is outside the ordinary approval and notification process | Relevant statutory and regulatory conditions, without contractual obstruction |
| The active service ends | Working copies and retained records follow different processes | Export, deletion evidence, legal hold and continuing protection |
| A backup is restored later | Protection still applies; restored working copies need renewed handling | Reason for restoration, access and the deletion record |
A claim of prior knowledge should identify the information and an earlier lawful record. A public price does not make an entire spreadsheet public. For independent development, separate the team’s permitted general skills from any actual reuse of protected data; unresolved cases need review rather than a broad “we already knew it” assertion.
Protected reporting and employer notice require specific care
US trade-secret immunity: 18 USC 1833(b) protects specified confidential disclosures to government officials or an attorney solely to report or investigate suspected legal violations, and specified filings under seal. It also addresses use in employer-retaliation proceedings with sealing and disclosure conditions. It does not authorise otherwise unlawful access.
For covered agreements entered into or updated after May 11, 2016, employers must provide the immunity notice or the statutory policy cross-reference. “Employee” includes individual contractors and consultants here. Missing notice restricts specified DTSA exemplary-damages and attorney-fee remedies against the affected employee; it does not make every confidentiality agreement automatically void. The discussion clause’s general carve-out is not a substitute for a required notice. Have counsel supply and check the applicable notice or provided policy reference.
SEC communications: the SEC’s whistleblower-protections page explains Rule 21F-17(a)’s prohibition on impeding direct communications about possible securities-law violations, including through confidentiality enforcement. Its staff FAQs discuss conflicting notice or approval requirements and clarify that the rule is not confined to employees. Keep ordinary legal-request notification procedures separate from protected reporting. The FAQs are staff views, rather than additional Commission rules.
UK product-safety settlements: OPSS’s 2020 guidance says confidentiality clauses should not prevent consumers raising product-safety concerns with regulators and recommends making that limit clear. This is a scoped UK settlement example, not a complete account of all UK confidentiality law.
Retention exceptions need owners and an end point
A retention exception should identify the copy, reason, access restriction and deletion trigger. “Keep everything in the archive” provides no useful limit. “Delete every copy immediately” may conflict with identified legal requirements, a hold or the documented backup architecture. Resolve the actual facts before promising either.
For the fictional 120-day backup cycle, a copy entering that cycle on October 31, 2026 reaches 120 elapsed calendar days on February 28, 2027. That date is an illustrative scheduling calculation, not a law or a claim that Pine’s real systems work this way. The separate ten-day working-copy deadline would be November 10, 2026 under the stated elapsed-calendar-day convention. Define the convention in the actual agreement.
Current public contract language already addresses retained backups: Juro’s US MSA, confidentiality section 10, permits specified legal and ordinary backup or archive retention subject to continuing confidentiality. That is one supplier’s contract, not a universal retention entitlement or deletion standard. Our example adds a fictional cycle and a restored-copy check for the service scenario.
Confirm the customer can retrieve its usable records before deletion begins. The SaaS exit export guide helps coordinate export and access closure with the retention plan.
Copyable confidentiality review record
CONFIDENTIALITY REVIEW Information category / exact file or disclosure: Permitted purpose / approved task: Recipients / need to know / applicable obligations: Access, security and incident-response schedule: Claimed exclusion / lawful evidence / reviewer: Required disclosure / protected reporting distinction: Applicable immunity notice or provided policy reference: Working-copy return or deletion deadline: Retained copy / reason / owner / access / end trigger: Backup cycle / restoration procedure / deletion evidence: Duration / trade-secret treatment / other mandatory rules: Unresolved issues / final agreed version:
Confidentiality-clause checklist
- Identify protected information and minimise incidental access.
- State a specific permitted purpose and approved recipients.
- Require evidence for claimed exclusions.
- Separate compelled disclosure from protected reporting.
- Check mandatory notices and transaction-specific rights.
- Coordinate security, privacy, incident and AI-use terms.
- Assign owners for return, restricted retention and restored copies.
- Record duration, end triggers and the final agreed wording.
Frequently asked questions
Is a confidentiality clause the same as an NDA?
They address related duties. A clause is part of a larger agreement; an NDA is a separate agreement structure. Read the actual scope, purpose, exceptions and parties in either document.
What are the key elements?
Protected information, permitted purpose, authorised recipients, exclusions, disclosure procedures and duration with return or retention treatment. The exact obligations depend on the transaction.
Does it cover public information?
Read the exclusion and identify the precise public fact. In the fictional example, an advertised price does not remove protection from private customer contacts and orders.
Can a recipient keep an archive copy?
Only after checking the agreed retention provisions and applicable requirements. Identify the reason, access restriction, owner, continued protection and deletion trigger. There is no universal archive permission in the example.
Does it stop reports to regulators?
Protected reporting requires its own legal analysis and should not be routed through an ordinary contractual approval process. The US trade-secret and SEC notes above describe specific protections and conditions.
What about a settlement agreement?
Identify whether confidentiality concerns settlement terms, underlying information or both, then check applicable protected disclosures and mandatory rights. The UK product-safety guidance above illustrates a specific limit; do not reuse this service clause as an employment or settlement form without review.
Sources
- 18 USC 1839: federal trade-secret definitions, 2024 edition.
- 18 USC 1833: immunity, notice and conditions, 2024 edition.
- SEC: whistleblower protections and staff FAQs.
- UK IPO: 2015 NDA guidance.
- UK OPSS: 2020 product-safety settlement guidance.
- Juro US MSA: confidentiality section 10, terms dated October 1, 2026.
Prepared with AI assistance. The banner is an AI-generated fictional illustration. Pine and Willow, the clause, timelines, tests and worksheet are original illustrative aids. No real customer data, supplier test, legal review or publication of a real agreement is claimed.