How confidential information protection works for Australian businesses

If you run a small business or startup, you hand confidential information to other people almost every week. You pitch to investors, brief contractors, onboard staff, and negotiate with suppliers, and each conversation carries a little of what makes your business valuable: pricing, client lists, product plans, internal processes. The risk is not that you share information. It is that you share it without understanding what protection attaches to it and what happens if it is misused.

The first thing to understand is that confidential information is not protected like a patent or a trade mark. There is no registration system and no official register in Australia. Protection is built from layers: an equitable duty of confidence that can exist with no paperwork at all, the contracts that make obligations explicit, and a set of overlapping statutes that bite when the information is also personal information, or when the person misusing it is a director or employee. This article walks through how those layers work, when each one engages, and what to do when someone crosses the line.

Who is involved in protecting confidential information

A handful of players carry the framework:

Your business: the owner of the information, and the party that must treat it as confidential for the law to help later.
The people you share with: employees, contractors, suppliers, investors, joint venture partners and prospective buyers. Each one is a potential pathway for information to leave your control.
The courts: they recognise the equitable duty of confidence and enforce contractual obligations, including by granting urgent injunctions to stop further use or disclosure.
Regulators: where the information is also personal information, the Office of the Australian Information Commissioner (OAIC) enforces the Privacy Act 1988 (Cth) as a separate compliance regime.

The central tension is that you cannot scale without sharing, yet every disclosure creates a route out. The legal framework is designed to let you share while preserving a remedy if the recipient uses the information improperly.

The equitable duty of confidence: protection that exists without a contract

The default layer of protection is the equitable action for breach of confidence, which applies regardless of whether you have signed anything. The classic test comes from Coco v A N Clark (Engineers) Ltd [1969] RPC 41 and is applied by Australian courts, including the Federal Court in Corrs Pavey Whiting & Byrne v Collector of Customs (Vic) (1987) 14 FCR 434. It has three elements:

The information must have the necessary quality of confidence: In plain terms, it must not be public knowledge, common knowledge or trivial. If it is already on your website or in the trade press, there is nothing to protect.
The information must be imparted in circumstances importing an obligation of confidence: The recipient knew or should have known it was confidential, for example because it was disclosed under an NDA, during employment, or in a meeting where it was identified as confidential.
There must be unauthorised use or disclosure: The recipient used the information for their own purposes or passed it on without your permission.

The practical consequence is significant. An obligation of confidence can bind an employee, a former employee, an adviser, or a recipient who obtained information in confidence, even with no document in sight. In Sports Data Pty Ltd v Prozone Sports Australia Pty Ltd [2014] FCA 595, for example, a sports statistics business alleged a competitor had used its input criteria in breach of confidence, and the Federal Court considered whether to restrain the use of that confidential information by injunction.

The catch is that the equitable duty is only as strong as the evidence. The business must be able to show the information was genuinely confidential and was treated that way. That is where contracts and internal controls come in.

NDAs and confidentiality clauses: making the obligation explicit

A non-disclosure agreement (NDA) converts a general equitable duty into a defined contractual obligation. It is the right tool when you are sharing confidential information with someone outside the business before a broader contract exists, for example when testing an idea with a collaborator, briefing a manufacturer, engaging a developer before services are signed, or discussing a sale or partnership.

A well-drafted NDA deals with the points the courts would otherwise have to infer: what information is confidential and what is carved out, how the recipient may use it, how it must be stored, who else can see it, how long the obligations last, and what happens on breach. Defining the scope in plain English removes most of the grey areas that otherwise end up in dispute.

There is one common sticking point. Many early-stage investors will not sign NDAs when evaluating a pitch, and pressing the point can damage the relationship. Where that happens, the practical control is not a document but behaviour: disclose less, later, and hold genuinely sensitive trade secrets back until the relationship is further along.

For ongoing relationships, a standalone NDA is often unnecessary. A confidentiality clause inside the services agreement, supply agreement or partnership deed serves the same function while sitting alongside the payment terms, deliverables, IP ownership and liability provisions that govern the relationship.

Employees and contractors: what they can and cannot take with them

Your own team is where most confidential information actually lives, and the law treats employees differently from contractors.

Employees

While employed, an employee owes an implied duty of fidelity and confidence, which is why employment contracts usually make the position explicit: how business information may be used during employment, the obligation to return company property and data on exit, and ongoing confidentiality after employment ends where appropriate.

The harder question is what an ex-employee can use afterwards. The courts draw a line between trade secrets, which remain protected, and the general skill and knowledge an employee built up over years, which belongs to them. In Del Casale v Artedomus (Aust) Pty Ltd [2007] NSWCA 172, the New South Wales Court of Appeal dealt with former directors and employees of a stone importer who had learned the source of its flagship product. The case illustrates the categories the courts work with: trade secrets, confidential information more generally, and the employee's own know-how. The practical lesson is that if a departing employee walks out with a client list or a supplier source and starts competing, your contract needs to have identified that information as confidential, and your conduct needs to back that up.

Post-employment restraints are a separate tool. A non-compete or non-solicit clause is only enforceable to the extent it protects a legitimate business interest, such as trade secrets or client connections, and is reasonable in scope and duration. An over-broad restraint will simply be struck down.

Contractors

Contractors do not owe the same implied duties as employees, so the contract must do the work: confidentiality clauses, return of material on termination, and clear intellectual property assignment. This last point trips up many businesses. Under s 35 of the Copyright Act 1968 (Cth), the author of a work owns the copyright in it, and an employer owns work made by an employee under a contract of service. A contractor is not an employee, so the contractor owns what they create for you unless the agreement assigns it, and that can be varied by agreement under the Act. Without an assignment clause, a developer who builds your software or a designer who creates your branding can take the copyright with them.

Founders and officers: statutory duties beyond the contract

Confidentiality risks do not only come from outside. Co-founder disputes, particularly when someone exits early, are a classic source of leakage, and a shareholders agreement is the document that deals with it: confidentiality obligations between founders, rules about information access, and what happens to information when someone leaves.

What many founders do not realise is that the Corporations Act 2001 (Cth) backs the company up even where the paperwork is thin. Under ss 182 to 184 of that Act, a director, officer or employee must not improperly use their position or information obtained through their role to gain an advantage or cause detriment to the company. The duty about information under s 183 expressly continues after the person stops being an officer or employee, and breaching it is a civil penalty provision, while dishonest use can be a criminal offence under s 184. A founder who walks out and uses company information to set up in competition is therefore exposed twice: to the company's equitable and contractual claims, and to the statutory regime.

When confidential information is also personal information

Some confidential information is also personal information under the Privacy Act 1988 (Cth), for example customer names, email addresses, phone numbers and payment details. Where that overlap exists, a second, mandatory regime applies on top of confidentiality.

The trigger is a threshold most small businesses should know. Under s 6D of the Privacy Act, a business with an annual turnover of $3 million or less in the previous financial year is a small business and is generally exempt from the Australian Privacy Principles, subject to exceptions such as some health service providers and credit reporting activity. Above that threshold, or where an exception applies, the business must comply with the APPs, including Australian Privacy Principle 11, which requires reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure.

The two regimes are different in kind. Confidentiality is a private right you enforce against the person who misused the information. Privacy is a compliance regime enforced by a regulator, with penalties attached. If your client database is both confidential and personal, you need both: contracts and controls for confidentiality, and privacy compliance for the personal information side.

What happens when someone misuses your information

When a contractor reuses your material, an employee leaves with a client list, or a partner starts a competing business with what they learned from you, the framework moves through a sequence of stages:

Contain: The first priority is limiting further spread: disable access to email, CRM and shared drives, change passwords, revoke API keys, and preserve access logs and copies of the relevant messages. Documentation at this stage, dates, people involved, screenshots, is what a court will eventually look at.
Check the paper trail: What does the NDA say? Does the services contract have a confidentiality clause? What do the employment or contractor terms say about returning property? Does the shareholders agreement deal with information on exit? The answer determines which layers of the framework you can invoke.
Communicate: In many cases a clear written demand is enough: identify the information you say is confidential, specify the conduct that must stop, require the information to be returned or deleted, and set a deadline. Asking for written undertakings, a promise to stop and comply, is a common and effective next step.
Consider court remedies: If the misuse continues or has caused serious harm, the courts can help. The usual remedies are an injunction to stop use or disclosure, including an urgent interlocutory injunction while the matter is pending, plus damages or an account of profits and an order for delivery up or destruction of the material. The Sports Data case shows the courts applying the settled principles for interlocutory injunctions: a serious question to be tried, the risk of harm that damages cannot fix, and the balance of convenience.

Your strongest position in all of this rests on three things: the information was genuinely confidential, you took reasonable steps to keep it that way, and the other party was under a clear obligation. That is why the foundations, set early, do most of the work.

Where the framework frays: common pitfalls

A few failure modes recur:

Information already public: Nothing in this framework protects information that is already out there, whether on your website, in a public filing or in the trade press. Once it is public, the equitable duty is gone.
Calling everything confidential: If every document is stamped confidential and every conversation is secret, the label loses meaning. Courts look at how you actually treated the information, and over-claiming weakens the credible core.
The general skill line: Departing employees will argue that what they took was their own skill and experience. The way to win that argument is to have identified and treated the specific information as confidential while they were employed.
Over-broad restraints: A restraint that tries to stop a former employee from working in the industry entirely is unlikely to be enforced. Draft to protect what is genuinely yours.
Waiting to act: Prompt action on a suspected breach matters both practically and for any application for urgent court orders.

When to get a lawyer involved

There are two moments when professional help earns its keep. The first is drafting. An NDA, employment contract, contractor agreement with IP assignment, or shareholders agreement needs definitions, carve-outs, durations and consequences that match how your business actually operates, and a lawyer can tailor those terms rather than relying on a template. If the information is also personal information, the same review can map your privacy obligations under the Privacy Act 1988 (Cth).

The second is the breach. When misuse is suspected, a lawyer can assess which layers apply to your situation, put the demand letter and undertakings in place, and act quickly if urgent court orders are needed to stop further damage. The cost of acting early is usually a fraction of the cost of reconstructing what was lost after a leak runs its course.

The conduct question at the centre of every dispute

Most confidential information disputes are not won on clever clauses. They are won on conduct: whether you actually treated the information as confidential. The courts weigh whether you labelled it, limited access to it, and put obligations in writing before you shared it. That evidence is built in the ordinary course of business, not after the leak.

The most missed step for small businesses is defining what is confidential before the next pitch, the next hire or the next contractor engagement, rather than after. Listing your core confidential information, marking it, restricting access to it, and putting confidentiality obligations in writing costs little, and it is the difference between a manageable dispute and an unwinnable one. If you would like help mapping out which protections apply to your business, Artificer Legal can review your current documents and put the right framework in place, and a free initial consultation is available to get started.