A proposal is ready to send. It carries your pricing structure, your delivery method and the process that sets you apart from every other supplier quoting on the job. Before clicking send you add a line at the bottom of the email: "This document is confidential. Do not distribute." You hit send and assume the information is now protected.
Confidentiality statement or NDA: the two options
A confidentiality statement is a short clause or notice that marks information as confidential and says it should not be used or shared without permission. You find them in email footers, on quote and proposal covers, in slide footers of pitch decks, and on internal documents like strategy papers and customer lists. An NDA is a contract. It is signed before disclosure, defines what is confidential, sets the permitted purpose, and creates obligations the recipient can actually be held to.
The assumption that needs correcting is that a footer automatically creates a binding obligation. Australian contract law requires an offer, acceptance, consideration and certainty of terms, together with an intention to create legal relations. A line pasted at the bottom of an email is usually a unilateral statement the recipient never agreed to. It is notice, not agreement. That does not make it useless. It puts the recipient on notice, it evidences your intention to keep information confidential, and it supports obligations that already exist elsewhere. But if you are relying on the footer alone to protect sensitive information, you are relying on notice rather than enforceable terms.
There is also a layer of protection that operates without any document at all. Australian courts recognise an equitable action for breach of confidence, adopted from Coco v AN Clark (Engineers) Ltd [1969] RPC 41 and applied in cases such as Commonwealth v John Fairfax & Sons Ltd (1980) 147 CLR 39. Broadly, information is protected where it has the necessary quality of confidence, where it was imparted in circumstances importing an obligation of confidence, and where it is misused without authority. That protection can apply even where no NDA was signed, for example in early negotiations. But it has limits. The information must be genuinely confidential, it must be capable of being identified with specificity, and you must be able to prove how it was disclosed. A vague footer rarely carries that weight on its own.
An example shows the difference. A founder emails a supplier a deck that mixes a public product summary with a slide showing the company's cost structure, and adds a confidentiality footer. If the supplier forwards the deck, the founder must convince a court that the cost structure slide was genuinely confidential, that it was shared in circumstances importing an obligation of confidence, and that the supplier knew it was not to be passed on. With a signed NDA, the founder only has to point to the agreement and the breach. The footer is not worthless. It is simply a lighter tool that shifts more of the evidentiary burden onto the person seeking protection.
Six factors that settle the call
What are you actually sharing?
The sensitivity of the information is the first and most important factor. A confidentiality statement suits information of low to medium sensitivity:
- High-level overviews: service descriptions, meeting agendas and marketing material that could be shared widely without real harm
- Reinforcement: reminders that internal methods, templates or pricing logic are not for redistribution
- Existing relationships: communications under a contract that already contains confidentiality clauses
An NDA is the right tool where the information is genuinely valuable and specific:
- Technical assets: source code, product roadmaps, technical documentation, algorithms and manufacturing processes
- Commercial information: pricing models, margins, supplier terms, financial projections and customer lists
- Deal information: partnership, joint venture or acquisition discussions, especially with someone who could become a competitor
Equity protects only information with the necessary quality of confidence. Public information, general know-how and ideas stated too broadly are hard to protect no matter what your footer says. The High Court has long required that confidential information be capable of being identified with specificity, a point made in O'Brien v Komesaroff (1982) 150 CLR 310. A footer that simply says "this email is confidential" leaves the recipient, and later a court, guessing about which part of the message actually counts. If you regularly share specific categories of information, such as pricing formulas or customer lists, name them in the document rather than relying on a blanket label.
Can you show the recipient agreed to be bound?
The two options differ in how they are enforced:
- Confidentiality statement: no signature, no negotiation and usually no consideration. Its practical force is evidentiary. It shows the recipient knew the information was confidential.
- NDA: signed before disclosure, with agreed definitions, exclusions and a permitted purpose. Its force is contractual, and breach gives rise to contractual remedies.
Courts look at what was actually agreed, not just what you printed. If a dispute ends up in litigation, the party with a signed NDA has a straightforward contractual claim. The party with a footer must instead prove breach of confidence: that the information was confidential, that it was disclosed in circumstances importing an obligation of confidence, and that it was misused. That is a heavier case to run.
The consideration point deserves attention as well. A contract needs something exchanged between the parties, and a one-sided footer gives the recipient nothing in return for their promise. An NDA handles this cleanly because the parties exchange the disclosure itself, or a nominal payment, for the confidentiality promise. That is why a footer bolted onto an email after the conversation has begun is particularly hard to enforce: it looks like a demand, not a bargain.
What happens if it gets out?
Be honest about the downside. If the information leaking would cost you money, customers or competitive advantage, treat it as NDA-level. If the worst realistic outcome is mild embarrassment, a confidentiality statement may be enough.
Remedies matter too. A well-drafted NDA gives you contractual rights that, depending on the circumstances, may support steps like seeking an injunction to stop further disclosure or claiming compensation for loss. Breach of confidence can also support injunctions and damages, but only where the information is genuinely confidential and was imparted in confidence. And no remedy puts information back in the bottle. An injunction stops further disclosure; it does not un-send what has already been shared. Prevention is the point of the exercise.
Who is on the other side?
The recipient changes the risk profile:
- A competitor or potential competitor: sign an NDA before the first substantive conversation. Even an indirect competitor can act on what it learns.
- An investor or acquirer: expect to sign their NDA or ask them to sign yours before sharing financials or projections. Investors often refuse NDAs at early stages, so share high-level information first and treat anything sensitive accordingly.
- A contractor or freelancer: confidentiality is only half the picture. If they are creating work for you, you also need written IP assignment. Under s 196(3) of the Copyright Act 1968 (Cth), an assignment of copyright has no effect unless it is in writing and signed by or on behalf of the owner. Paying for work does not automatically mean you own it.
- A customer: a footer can reinforce that your methods and pricing logic are not for redistribution, but take care where the communication includes personal information, because privacy obligations apply separately.
Is there already a contract in place?
If you already have a signed services agreement, contractor agreement or NDA with confidentiality clauses covering the relationship, a confidentiality statement on individual emails reinforces those obligations without needing a new agreement each time. If there is no contract and the information is sensitive, the NDA is the agreement you need, signed before disclosure. Also watch the gap between confidentiality and ownership. Confidentiality prevents disclosure; it does not assign rights. If a contractor creates code, designs or content, deal with ownership in writing in the same agreement.
When are you sharing it?
Timing is the factor most small businesses get wrong. An NDA signed after the information has been shared protects nothing that happened before it. A footer added to an email after the conversation has already started does not retroactively bind the recipient. The pattern that works: share high-level information first, sign the NDA before sharing anything sensitive, and move key conversations into written agreements as the relationship progresses. If you would be unhappy seeing the information published, the NDA should be signed before the information leaves your hands, not after.
How an Artificer Legal commercial lawyer helps you make the call
The confidentiality statement versus NDA decision looks simple until you are the one enforcing it. A commercial lawyer at Artificer Legal helps in three ways.
First, stress-testing the assumptions: whether the information is genuinely confidential, whether it can be identified with specificity, and whether the recipient's conduct has actually created obligations. Second, modelling the downside: what remedies are realistically available if the information leaks, and what evidence you would need to run the claim. Third, drafting: the NDA or confidentiality clauses that fit the actual transaction, including definitions, exclusions for information already in the public domain, permitted purpose, term, return or destruction of materials, and remedies.
Where the relationship involves created work, the same exercise covers IP assignment in writing. Where personal information is involved, the lawyer will also check privacy compliance under the Privacy Act 1988 (Cth), whose Australian Privacy Principles regulate how personal information is handled, including its security. Whether the Privacy Act covers your business depends on factors such as its size and turnover, and a confidentiality statement can never replace privacy compliance.
This matters more than the cost of the conversation. A dispute over leaked information can consume months and run to five or six figures in legal costs, and the enforceability of the protection is decided at the start, by what was signed and when. A short review of your confidentiality documents before you send them is cheaper than reconstructing what the other party agreed to after the information has moved.
Sharing before the NDA is signed
The decision that costs the most to get wrong is not which document to use but when you share. If losing the information would cost you money, customers or advantage, get the NDA signed before the information leaves your hands. The footer is a signal, not a shield. It tells the recipient you care about the information; it does not by itself create an obligation they can be held to.
Confidentiality statements still earn their place. They set expectations, evidence your treatment of information as confidential, and support obligations that exist in signed agreements. NDAs create enforceable obligations with a defined scope and remedies. Behind both sits the equitable protection of genuinely confidential information imparted in confidence, which can help even without a document but is harder to prove. And protection is strongest when documents are backed by practice: restricting access on a need-to-know basis, password-protecting files, marking documents confidential, and training staff on what can be shared.
Where personal information travels with the confidential material, privacy obligations sit alongside confidentiality and need their own attention. The practical test to carry into your next disclosure is simple. If the information would genuinely hurt the business in the hands of a competitor, a footer is a starting point, not a finish line. Get the NDA signed, describe the information precisely, and only then let it go.