Confidentiality breaches in small business, causes, consequences and prevention

Your account manager has just sent a spreadsheet of client pricing to the wrong email address. Or a departing developer has walked out with your source code on a personal laptop. Or you pitched your business model to a potential partner over coffee with no paperwork and are now watching them do something very similar in the market. None of these needed a hacker. All of them are confidentiality breaches, and all of them are more common in Australian small business than the dramatic "data leak" you picture when you hear the phrase.

What counts as a breach of confidence under Australian law

A confidentiality breach is an unauthorised access to, use of, or disclosure of information your business is entitled to keep restricted. In Australia, the obligation to keep information confidential can come from two separate places, and most businesses only know about the first.

The first is contract. Confidentiality clauses in employment agreements, contractor agreements, client and supplier contracts, and standalone non-disclosure agreements (NDAs) create a clear, enforceable obligation, usually drafted to survive the end of the relationship.

The second is equity. Even with no document at all, Australian courts recognise an equitable obligation of confidence. The classic test, applied by the New South Wales Court of Appeal in Filby v TEG Live Pty Ltd [2023] NSWCA 320 (following the English decision in Coco v AN Clark (Engineers) Ltd), asks three questions:

• was the information confidential in nature, meaning it has the "necessary quality of confidence"?
• was it received in circumstances importing an obligation of confidence?
• was it misused, in the sense of an unconscientious use of the information or taking unfair advantage of it?

The first limb trips up more businesses than any other. Information only has the necessary quality of confidence if it is not public knowledge and not readily ascertainable, and if it has enough specificity to be worth protecting. In Filby, a promoter's vague pitch idea for a free concert promotion failed precisely because it was a general and inchoate idea that was not sufficiently unique. A half-formed concept sketched in a meeting is rarely protected; a detailed pricing model, a customer database, or proprietary software is.

For a typical small business, the information worth protecting includes:

• Customer and client data: contact details, sales pipelines, purchase history
• Commercial terms: pricing, margins, discounts, supplier rates and purchase volumes
• Financial information: internal forecasts, budgets and performance
• Product information: specifications, formulas, source code, prototypes and roadmaps
• Strategy: marketing plans, ad accounts, launch timing and positioning
• People information: staff files, remuneration and performance records
• Personal information: anything about identifiable customers or employees, which also engages privacy law

Trade secrets sit at the top of the spectrum: a formula, recipe, algorithm or process that gives you an edge and is kept secret. The lower down the spectrum you go, the harder it is to convince a court the information qualifies, which is one reason written definitions of "Confidential Information" in your agreements matter.

Confidentiality versus privacy: the distinction that changes your obligations

"Confidentiality" and "privacy" are routinely used interchangeably, but they are different legal animals.

Confidentiality is a relationship-based obligation between you and whoever received the information, arising from contract or equity. Privacy is a statutory regime. The Privacy Act 1988 (Cth) governs how businesses handle personal information, meaning information about an identifiable individual, regardless of what any contract says.

The two overlap whenever the information in question is personal information. A customer list is both commercially confidential and, to the extent it identifies individuals, personal information. That overlap matters because the Privacy Act imposes obligations no contract clause can replicate, including the Notifiable Data Breaches (NDB) scheme in Part IIIC of the Act.

The common assumption that "we're a small business, the Privacy Act doesn't apply to us" is only partly right. Under s 6D of the Act, a business with an annual turnover of $3,000,000 or less is generally exempt. But the exemption has significant carve-outs. You are caught regardless of turnover if you:

• provide a health service and hold health information
• disclose personal information about another person for a benefit, service or advantage
• collect personal information by providing a benefit, service or advantage
• are a contracted service provider under a Commonwealth contract
• are a credit reporting body, or are related to a body corporate that is not itself a small business

So a physiotherapy clinic, a business that sells marketing lists, or a firm that delivers services to a government department under contract can be fully covered by the Privacy Act on a turnover well under $3 million. If you are not sure which side of the line you fall on, treat the personal information you hold as if the Act applies; the cost of being wrong is higher than the cost of being careful.

How confidential information actually leaks from small businesses

Most confidentiality breaches are not committed by bad people. They come from fast-moving businesses, informal processes and unclear expectations. The patterns repeat across Australian small business:

• No written obligation and undefined expectations: If your business model, pricing or product plans are shared with potential partners, suppliers or investors without an NDA, you are relying on equity to protect you. Equity may well do so, but only if the information qualifies and the circumstances clearly imported confidence, and proving either later is harder than agreeing it upfront.
• Human error: The single most common leak is an accident: an email to the wrong recipient, a shared folder left on "anyone with the link", a screenshot of a client list posted to a group chat, a laptop with customer data left on a train, a quote sent to the wrong customer. These risks multiply when people are busy, untrained, or unsure what counts as sensitive.
• Poor access controls: Ex-employees still holding logins, staff with access to folders they never use, and no process for revoking access when roles change are all quietly common. The breach is not an external hack; it is the account that was never disabled.
• Cyber incidents: Phishing, compromised or reused passwords, malware and misconfigured cloud systems can expose customer databases, payment details, invoices and employee records. Even where no personal information is involved, a ransomware event can still expose commercially confidential documents.
• No training or policies: Contracts do not run a business day to day. If nobody has told the team what is confidential, how to share files securely, or what to do when something goes wrong, the same mistakes repeat.

What a breach can cost you

The immediate damage is usually commercial. If your pricing, supplier terms, roadmap or strategy reaches a competitor, the advantage you were selling on is gone, and a confidentiality breach can derail an investment or sale process where key information has been exposed.

The second cost is trust. Clients rarely distinguish between a careless mistake and a malicious leak. What they see is that their information was not safe with you, and the result can be cancellations, refund requests, negative reviews and harder sales conversations.

The third cost is legal. A breach of a confidentiality clause is a breach of contract. A breach of the equitable obligation is the separate cause of action of breach of confidence, which exists independently of any signed document. Where a breach is proven, an Australian court can order:

• an injunction stopping further use or disclosure, often sought urgently on an interlocutory basis before trial
• damages or equitable compensation for the loss suffered
• an account of profits, requiring the wrongdoer to hand over profits made from the misuse
• delivery up or destruction of copies of the information

The fourth cost is internal. A breach involving an employee or contractor can trigger a workplace investigation, warnings or termination, and a review of your systems, all of which burn time and morale.

The fifth cost, where personal information is involved and your business is covered by the Privacy Act, is regulatory. The NDB scheme requires notification to the OAIC and affected individuals in defined circumstances (below). And for serious or repeated interferences with privacy, s 13G of the Privacy Act allows courts to order civil penalties for body corporates of up to $50 million, or three times the value of any benefit obtained, or 30% of adjusted turnover in the relevant period, whichever is greatest. Even where the Act does not apply to you, client contracts often impose their own notification and security obligations, and those can bite regardless of your turnover.

Prevention without turning the business into a fortress

You do not need enterprise security from day one, but you do need a minimum effective system of clear rules, sensible documents and good habits:

• Make your contracts work together: An NDA for pitching to potential partners, suppliers and investors; employment and contractor agreements with confidentiality clauses that survive the engagement; client or service agreements covering situations where customers share sensitive data with you or you access their systems; and a workplace policy setting expectations on device use, file sharing and password standards. A clause only helps if it is in the right document, tailored to how information actually moves through your business.
• Know what your high-risk information is: List what would cause real harm if disclosed: customer data, commercial terms, product know-how, financials. Those get the strongest controls. Not everything needs to be locked down equally.
• Apply least privilege: People should only access what their role needs. Practical steps include role-based access to folders and systems, multi-factor authentication on key accounts, password management rules, regular audits of who has access, and immediate offboarding steps when someone leaves.
• Train on scenarios, not theory: Short practical guidance beats a 40-page policy: what do we treat as confidential, what can go to clients, how do we share files securely, and what do you do if you accidentally send something to the wrong person. A no-blame reporting culture matters: the sooner you hear about a mistake, the more likely you can contain it.
• Be careful with marketing and public content: Case studies, screenshots and behind-the-scenes content can reveal client details or sensitive processes. If you share customer stories, get the approvals documented in advance.

Your response when a breach happens

Even with strong systems, things go wrong. The sequence below keeps you moving fast without making the situation worse:

1. Contain it immediately: Recall the email if possible, disable compromised accounts, reset passwords, revoke sharing links and change folder permissions, and ask the recipient to delete the information and confirm in writing. The sooner the breach is contained, the better your legal and commercial position.
2. Document what happened: Record what information was involved, when it happened, who accessed or received it, and whether it was further shared. This record drives your decisions and, if needed, any legal action.
3. Assess your legal obligations: Start with your contracts: do you owe confidentiality to the affected party, and do they owe it back to you? Then consider privacy. Under s 26WE of the Privacy Act, an eligible data breach exists where there is unauthorised access to, unauthorised disclosure of, or loss of personal information, and a reasonable person would conclude the access, disclosure or loss is likely to result in serious harm to the affected individuals. If you suspect an eligible data breach, s 26WH requires you to carry out a reasonable and expeditious assessment, taking all reasonable steps to complete it within 30 days of becoming aware. If the assessment concludes an eligible data breach has occurred, ss 26WK and 26WL require you to prepare a statement and give it to the OAIC, and notify affected individuals (or publish the statement if individual notification is not practicable), as soon as practicable. One important nuance: under s 26WF, remedial action taken before the access or disclosure results in serious harm can mean the incident is not an eligible data breach at all, which is why containment and assessment go together.
4. Communicate carefully: If you notify clients, customers, suppliers, insurers or staff, be accurate, explain the containment steps taken, set out what affected parties should do next, and avoid admissions that create liability. What you write now may be produced in litigation later.
5. Fix the root cause: After containment, update the policy, tighten the access control, revise the contract or improve the training so the same failure cannot repeat.

When you need a lawyer on this

Confidentiality work involves judgement calls that an article cannot make for you. A lawyer can tell you whether your information genuinely has the necessary quality of confidence, whether the circumstances of a particular pitch or meeting imported an obligation of confidence, and whether your business really is outside the Privacy Act despite its turnover. Where a breach is unfolding, a lawyer can assess whether the NDB threshold is met, draft the required statement and notifications, and advise on the wording of any communication so it does not become an admission. Where the breach is serious and continuing, urgent action may be needed, including an application for an interlocutory injunction before the information spreads further. And on the prevention side, properly drafted NDAs, employment confidentiality clauses, client agreements and workplace policies are the difference between protection you can prove and protection you hope for. Artificer Legal can draft the documents and run the breach response with you.

Why a signed NDA is not the whole story

The sharpest misunderstanding in this area runs in both directions. Businesses without an NDA assume they have no protection, and businesses with an NDA assume they are fully protected. Both are wrong. The equitable obligation of confidence exists without any document, but it only protects information that genuinely has the necessary quality of confidence and was received in circumstances importing an obligation of confidence. A generic NDA signed before a vague pitch does not turn a general idea into protectable confidential information, as Filby shows. What a well-drafted NDA actually does is make the obligation easy to prove and put the recipient on clear notice that the circumstances import confidence. The protection comes from what the information is and how it was shared, not from the paper.

To summarise the key points: a confidentiality breach is any unauthorised access, use or disclosure of information your business should be protecting, and the obligation can arise from contract or from equity without any document. Confidentiality and privacy are different regimes that overlap on personal information, and the small business exemption has carve-outs that catch more businesses than people expect. Most breaches come from human error, weak access controls, missing contracts and untrained staff rather than malice. Prevention is a mix of the right documents, classified high-risk information, least-privilege access and practical training. And when a breach happens, contain it, document it, assess whether the Notifiable Data Breaches scheme applies, and communicate carefully, with legal advice on the judgement calls.