A non-disclosure agreement (NDA) is a contract that sets the ground rules for sharing confidential information. It records what information is protected, who may see it, what it may be used for, and what happens to it when the relationship ends. In Australia, when those rules are broken, the injured business has two overlapping ways to respond: an ordinary claim for breach of contract, and an equitable action for breach of confidence that can apply even where no NDA was signed.
This article explains how that machinery actually runs. We look at what has to be established before a breach exists, the remedies a court can order, the steps enforcement follows in practice, and what changes when your own business is the one accused of leaking information.
Who is involved when an NDA is breached
Confidentiality disputes bring together a small cast of players, and each has a defined role:
- The disclosing business: owns the information and carries the burden of proving it was confidential, that it was shared under an obligation of confidence, and that it was misused. Everything the business does in the days after a suspected leak feeds this proof.
- The recipient: an employee, contractor, supplier, investor or joint-venture partner who signed the NDA, or who received the information in circumstances that imported a duty of confidence without signing anything.
- The court: the Supreme Courts (sitting in their equity jurisdiction) and the Federal Court of Australia can grant urgent injunctions and final relief. The Federal Court also hears applications for civil penalties against officers and employees under the Corporations Act.
- The lawyers: they shape the evidence, decide whether to seek urgent court orders or negotiate first, and run any proceedings. Their role changes at each stage of a dispute, which we cover below.
- ASIC: where a director, officer or employee misuses information obtained through their position, the Australian Securities and Investments Commission's civil penalty regime under the Corporations Act sits behind the contract claim.
The competing tension runs between the first two players. The disclosing business wants its information back under control, while the recipient usually wants to keep using the information or simply denies it was confidential. The court and the lawyers exist to resolve that tension on evidence, not on assertion.
What actually counts as a breach
A breach can be made out in two ways, and they often operate side by side.
Breach of contract
An NDA is enforceable like any other contract. A breach is a failure to comply with a valid term: disclosing the information to someone outside the permitted circle, using it for a purpose the NDA did not allow, or failing to return or destroy it when the agreement ended. To win a contractual claim, the business must prove the contract existed, identify the obligation that was broken, show how it was breached, and quantify its loss, or show why equitable relief should be ordered instead.
Breach of confidence
Even without an NDA, Australian law protects confidential information through the equitable action for breach of confidence. As the New South Wales Court of Appeal confirmed in Marshall v Prescott [2015] NSWCA 110, the claimant must establish three things: the information had the necessary quality of confidence; it was imparted in circumstances importing an obligation of confidence; and there was an unauthorised use or disclosure of it. The formulation traces back to the classic English statement in Coco v AN Clark (Engineers) Ltd, which Australian courts have applied for decades.
The practical point is that a well-drafted NDA is not just a contract. It is also evidence that the second and third elements of breach of confidence are satisfied, because it records that the information was treated as confidential and that the recipient accepted an obligation. That is why businesses without an NDA can still sue, but businesses with one have a much faster path.
The public domain limitation
No obligation of confidence attaches to information that is already public. In Kerridale Pty Ltd v Western Exporters Pty Ltd [2003] FCA 1335, the Federal Court refused an interlocutory injunction for breach of a confidentiality agreement where there was a real question whether the process in dispute had already entered the public domain. This is a common failure point. If the "confidential" material has been published, shared widely, or is common industry knowledge, an NDA over it will not hold, no matter how carefully it was drafted.
The remedies a court can order
Once a breach is established, the remedies available in Australia are broader than a damages cheque. They fall into four main categories.
Injunctions
An injunction orders the other party to stop using or disclosing the information, and often to return or delete it. Where timing is critical, the court can grant an interlocutory injunction on an urgent basis, before the full dispute is heard, to preserve the position until trial. The modern Australian test requires a serious question to be tried (or a prima facie case, depending on the circumstances) and that the balance of convenience favours the injunction, following Beecham Group Ltd v Bristol Laboratories Pty Ltd [1968] HCA 1 and Australian Broadcasting Corporation v O'Neill [2006] HCA 46. The Federal Court applied exactly that framework in Techforce Personnel Pty Ltd v Jaffer [2023] FCA 1674, where a labour-hire company obtained urgent orders restraining a former employee from soliciting its clients and from disclosing its confidential information after he moved to a competitor.
Damages and equitable compensation
A business that has suffered loss from the breach can recover damages for breach of contract, or equitable compensation for breach of confidence. The loss must be proved: the value of the information, the cost of remedying the leak, or the profit or opportunity lost because of it. Courts will not award a windfall simply because confidential information changed hands.
Account of profits
As an alternative to damages, a court can order the breaching party to account for, and hand over, any profits it made from the misuse of the information. This matters where the breach produced revenue for the recipient, such as a supplier that used a customer list to win contracts. The claimant chooses between damages and an account of profits, whichever better reflects the harm.
Liquidated damages and the penalty rule
An NDA can stipulate that a fixed sum is payable for a particular breach, for example an amount per customer poached using the confidential list. The clause is enforceable only if it is a genuine pre-estimate of the loss likely to flow from the breach. If the amount is extravagant and unconscionable compared with the greatest loss that could conceivably be foreseen, it is a penalty and the court will not enforce it. The High Court confirmed in Andrews v Australia and New Zealand Banking Group Ltd (2012) 247 CLR 205 that the penalty doctrine reaches broadly, including clauses that operate on breach beyond a simple payment, and Paciocco v Australia and New Zealand Banking Group Ltd [2016] HCA 28 confirmed the assessment is made at the date of the contract, looking forward, not with the benefit of hindsight. The New South Wales Court of Appeal restated the test in Arab Bank Australia Ltd v Sayde Developments Pty Ltd [2016] NSWCA 328: a stipulation is a penalty if it is wholly extravagant or unconscionable compared with the greatest loss that could possibly be foreseen to flow from the breach. A modest, justified figure survives; an aggressive one gives the breaching party a free argument to strike the clause out.
Statutory duties for officers and employees
Beyond the contract, directors, officers and employees owe a statutory duty under s 183 of the Corporations Act 2001 (Cth) not to improperly use information obtained through their position to gain an advantage for themselves or someone else, or to cause detriment to the corporation. The duty continues after the person leaves the role, and a contravention is a civil penalty provision. A breach of an NDA by an employee can therefore expose that employee personally, and their new employer, to consequences beyond the contract claim.
How enforcement actually runs
Enforcement is a staged process, and most disputes never reach a courtroom. The typical pathway looks like this:
- Preserve evidence and map the breach: Identify what was disclosed, to whom, and when. Save emails, message threads, screenshots, system logs and file version histories that show who accessed what. This step determines whether anything can be proved later.
- Send a letter of demand: Set out the facts, the NDA terms that were breached, and what you require: undertakings not to use or disclose the information, deletion or return of materials, and compensation. Include a deadline for response.
- Negotiate without prejudice: If the other side responds constructively, the parties discuss a practical resolution. Because these discussions are without prejudice, what is said cannot be used against either side in court, which allows both parties to talk openly.
- Document a settlement: Any resolution should be recorded in a binding settlement deed covering the undertakings, any payment, return or destruction of the information, and confidentiality about the dispute itself.
- Apply to court if needed: If the other side refuses to engage, or the harm is continuing, the next step is proceedings: an urgent application for an interlocutory injunction first, then a claim for damages or an account of profits at trial.
The urgency point deserves emphasis. An interlocutory injunction can be obtained within days, sometimes within hours, from a duty judge, but only if the evidence is ready. Businesses that spend a week gathering materials before calling a lawyer often find the information has been circulated beyond recall.
When your business is the one that breached
Being on the receiving end of an NDA claim is stressful, but the response follows a similar logic in reverse. The goal is to limit exposure and demonstrate good faith:
- Contain the leak immediately: Remove posts or links, disable access, ring-fence affected systems and require anyone who forwarded the material to delete it.
- Preserve everything: Do not delete emails or files, even incriminating ones. Destruction of evidence converts a civil claim into something far worse.
- Take legal advice before responding: A lawyer can assess the contractual exposure, whether the information was actually confidential, and whether the other side's demand is realistic. An admission made in a hurried reply can be hard to walk back.
- Offer practical mitigation: Certified destruction of copies, an audit of who accessed the information, and revised controls signal good faith and reduce the loss the other side can prove.
- Review the process gap: If an employee or contractor caused the leak, check onboarding, access controls and training. Where the culprit is a director, officer or employee, the s 183 Corporations Act exposure discussed above applies personally, and the business itself may face a separate question about its own liability for their conduct.
Many NDA disputes resolve commercially. The approach in the first 24 to 48 hours shapes the cost, the goodwill and the long-term risk more than anything that happens later.
Where NDA enforcement usually goes wrong
The cases that fail usually fail on the same handful of points:
- Information already public: The single most common reason enforcement collapses. If the information was published, shared without restriction, or independently developed, there is nothing left to protect. This is why NDAs should exclude information in the public domain and require the recipient to keep it secret rather than assume secrecy.
- Vague definitions: An NDA that says "all information disclosed" without describing categories or examples gives a court little to work with. The recipient can argue the particular item was never within scope.
- No evidence of access or disclosure: Courts decide on proof. If the business cannot show who had access, what they did with it, and when, a claim of misuse is assertion only.
- Penalty-style damages clauses: As noted, a liquidated damages figure that is not a genuine pre-estimate can be struck out entirely, leaving the claimant to prove actual loss from scratch.
- Cross-border complications: Where the recipient is overseas, an Australian judgment still has to be enforced in the foreign jurisdiction, and data transfer and governing law issues can complicate the claim. Governing law and venue clauses should be deliberate, not accidental.
- The public interest defence: The obligation of confidence is not absolute. Australian courts have recognised that disclosure may be justified where the public interest in revealing serious wrongdoing outweighs the private interest in secrecy, though the scope of that exception is narrow and fact-dependent. A recipient who discloses under a recognised whistleblowing regime may have a defence that a purely commercial leak would not.
What a lawyer does at each stage
Legal input is valuable at three distinct points. First, at drafting. A lawyer who understands how courts actually apply the elements of breach of confidence can structure the NDA so that the hard questions, such as what counts as confidential information and who may access it, are answered on the face of the document. This is where enforcement is won or lost, because the drafting determines what can later be proved.
Second, at the moment a leak is suspected. This is the highest-value intervention. A lawyer can advise on whether the facts support an urgent injunction, assemble the evidence in a form a duty judge will accept, send the letter of demand, and run the without prejudice negotiations. Getting this right can stop the damage in days and keep the dispute out of court entirely.
Third, if proceedings are needed. Drafting pleadings, managing discovery, briefing counsel for the injunction application, and running the trial are specialised work. The choice between damages and an account of profits, for example, is a strategic decision that depends on the evidence and the other side's conduct.
The hours after a leak decide the case
If there is one thing to remember from this article, it is the asymmetry of time. An injunction is only worth having before the information spreads; evidence is only useful if it is preserved before someone deletes it. The same few days that decide whether a claim can be run are also the days when a well-drafted NDA pays for itself, because it converts a messy question about what was confidential into a clear record of what the recipient promised. Businesses that act in the first 48 hours, preserve the evidence, and take advice before responding put themselves in the strongest position whether they are enforcing the NDA or defending against a claim. A short consultation early in the process, before positions harden, is usually far cheaper than undoing the consequences of a delayed response.