- What counts as confidential information in a small business
- Confidentiality is separate from privacy
- How the law actually protects confidential information
- Which contracts should carry your confidentiality terms
- Making confidentiality real in day to day operations
- Managing confidentiality with suppliers, contractors and partners
- The disclosure risks that are easy to miss
- When to get a lawyer involved
- The real cost of casual confidentiality
You hand a pitch deck to a potential investor, brief a new contractor, or give a departing employee the keys to the shared drive, and somewhere in all of that sits the real value of your business: your pricing model, your customer list, your process that took years to refine. When that information walks, it rarely comes back. The good news is that protecting it does not require an elaborate legal setup. What it does require is a clear idea of what is confidential, the right contracts, and ordinary operating habits that show the information was genuinely treated as secret.
What counts as confidential information in a small business
Confidentiality disputes usually begin because one person assumes information is obviously private while another assumes it is basically public. The more precisely you define what is confidential, the easier it becomes to protect it day to day and to enforce it later.
In practical terms, confidential information in an SME commonly includes commercial data such as pricing models, margins, supplier terms and customer lists, business plans and strategy including product roadmaps and fundraising plans, operational processes such as checklists, scripts and internal workflows, financial information including forecasts and budgets, and intellectual property and know-how such as unique methods, formulas, designs, source code and prototypes.
Two misconceptions are worth clearing up early. Confidential information does not have to be top secret to be protected. Everyday business data can still be confidential if it is not public and gives you a commercial advantage. And confidentiality is not the same as privacy, which is a distinct legal regime covered below.
Confidentiality is separate from privacy
A common point of confusion is mixing up confidentiality with privacy law. Confidentiality is a broad concept that can attach to any commercially valuable information, whether or not it concerns a person. Privacy law under the Privacy Act 1988 (Cth) (the Act) is narrower: it governs how you collect, use, store and disclose personal information about identifiable individuals, such as your customers and staff.
Whether the Privacy Act binds your business is a question of scope. Under s 6D of the Act, a business is a small business if its annual turnover for the previous financial year is $3 million or less, and historically certain small businesses were exempt from most of the Act. That position has been changing, and one reasonable attempt to rely on the old exemption is no longer safe. The practical point for an SME is not to assume you are outside the regime. If you hold customer contact details, delivery addresses, account information or staff records and you handle them through a website or a service business, it is worth confirming whether the Privacy Act, and the Australian Privacy Principles, apply to you.
Where the Act does apply, it imposes positive duties. Australian Privacy Principle 11, for example, requires an APP entity that holds personal information to take such steps as are reasonable in the circumstances to protect it from misuse, interference, loss and unauthorised access, modification or disclosure. Reasonable technical and organisational measures are expressly contemplated. This is a statutory reason to take information security seriously, quite apart from any confidentiality concern.
How the law actually protects confidential information
Confidentiality is protected through two main routes. The first is contract. When you and another party sign an agreement containing confidentiality obligations, the terms create a direct legal duty that can be enforced, including by an injunction to stop use or disclosure and a claim for damages.
The second route is the equitable action for breach of confidence, which operates even without a written contract. The Federal Court applied it in Sports Data Pty Ltd v Prozone Sports Australia Pty Ltd [2014] FCA 595, where a sports statistics provider sought to stop a competitor who had taken over the same contract from using input templates and criteria it had developed over years. The action protects information that is not public, that came to the recipient in circumstances importing an obligation of confidence, and that was then used without authorisation.
The important practical consequence is that how you treat information shapes whether it is protectable. Information that you publish, hand out freely or allow wide open access to may no longer have the necessary quality of confidence. Courts weigh the steps you took to keep information confidential. That is why the day to day habits described below matter as much as the paperwork.
Which contracts should carry your confidentiality terms
If you want a written duty that is easy to enforce, the place to put it is in the agreements you already use.
A non-disclosure agreement, or NDA, is the usual first line of defence when you share sensitive information with someone outside the business, such as a supplier, contractor, collaborator or prospective buyer. A workable NDA should define what is confidential and what is not, state the permitted purpose, require reasonable security steps, list the standard exceptions such as information already public or independently developed, set out how long the obligations last, and require return or destruction of the material at the end of the relationship.
Most leaks happen internally, through people acting in good faith, so your employment contracts and contractor agreements should also carry confidentiality clauses. These can cover keeping internal information confidential during the engagement, not using it for personal benefit, returning company property and information at the end, and continuing confidentiality obligations after departure where appropriate. If everyone in the business can access everything, it becomes far harder to argue that information was clearly treated as confidential, so align the clauses with how access actually works.
If you have multiple founders, shareholders or directors, a shareholders agreement is worth getting in place early. It is not a confidentiality document as such, but it often deals with information rights and reporting, restrictions on competing activities, and the rules for dealing with business assets including intellectual property and confidential material. Deciding these things while people are getting along saves a much harder conversation later.
Making confidentiality real in day to day operations
A contract only helps if you can show the business actually treated the information as confidential. Consider a simple classification system your team understands, such as public, internal, confidential and highly confidential, and mark sensitive documents accordingly. Even a confidential footer on a tender or a customer pricing sheet quietly signals that the material is not for general circulation.
Limit access on a need to know basis. Role based permissions for finance folders, separate channels for sensitive projects, password managers instead of shared passwords, and prompt removal of access when someone changes roles all reduce the risk of accidental disclosure. They also help with cyber security, which is increasingly part of how a court or regulator views your handling of information.
Build confidentiality into onboarding and offboarding. New team members should learn what the business treats as confidential, where files should and should not be stored, and who to ask when unsure. When someone leaves, confirm return of company property, revoke access to email, cloud drives, CRMs and project tools, and remind them of ongoing obligations. The most preventable breach is a former team member quietly retaining access to a shared drive.
Regular, scenario based training makes confidentiality stick. People rarely leak secrets on purpose. They share something because they did not realise it was sensitive. Working through what can be said at a networking event, how to handle a customer asking about internal pricing, what to do with a suspicious access request, and how to store files when working remotely turns an abstract policy into habit.
Managing confidentiality with suppliers, contractors and partners
External help is normal and often essential, but it moves sensitive information outside your direct control. Where possible, put a confidentiality obligation in place before you share details. Once information is disclosed, you cannot undo the disclosure, you can only manage the consequences.
A practical approach is to use an NDA for early discussions such as quotes, scoping and pitch decks, a services agreement with confidentiality and intellectual property clauses for the actual delivery work, and customer or supplier terms where you exchange sensitive information on an ongoing basis.
Confidentiality and intellectual property frequently overlap. If a contractor builds software, designs branding or creates training material, you need clarity on who owns those outputs and whether they can reuse your materials elsewhere. And be wary of informal partnerships where businesses share leads, resources or jointly build a product without defining boundaries. If you are partnering, even temporarily, document the purpose of sharing, the restrictions on use, ownership of outputs, and what happens when the relationship ends.
The disclosure risks that are easy to miss
The most common confidentiality failures are predictable. As you grow, marketing becomes more detailed, with case studies, testimonials and behind the scenes content. Before publishing, ask whether the material reveals supplier pricing or margins, customer information that should stay private, internal strategy, or third party information you used without permission. When unsure, generalise rather than publish exact numbers.
Departing employees and contractors taking information with them is another recurring flashpoint. Solid contracts, quick access removal, keeping critical information in controlled systems rather than on local devices, and an exit checklist all reduce the risk. If you suspect misuse, act quickly, because delay makes it harder to contain.
Confidentiality also overlaps with consumer law if your business markets to customers. Conduct that is misleading or deceptive in trade or commerce is prohibited by s 18 of the Competition and Consumer Act 2010 (Cth), which contains the Australian Consumer Law in its second schedule. Overstating a product claim, mishandling a subscription or publishing misleading marketing when you are trying to promote the business can create legal exposure well beyond a confidentiality concern.
When to get a lawyer involved
Some confidentiality judgements are not safe to make on your own. Deciding whether the Privacy Act applies to your particular turnover, data and activities, and whether the exemptions have shifted for your industry, is one. Drafting an NDA or a confidentiality clause that is actually enforceable, rather than decorative, is another. Working out who owns the intellectual property a contractor creates, and how that interacts with confidentiality, is a decision a practitioner should review. And if you suspect a breach, the choice of whether to send a cease and desist letter, seek an injunction, or pursue damages, and how quickly, is a judgement call best made with legal advice rather than on the fly.
The real cost of casual confidentiality
The single most damaging mistake is not a lack of paperwork. It is treating your own confidential information casually while expecting a court to treat it seriously later. Information you share widely, store where anyone can reach it, or hand over without clear written terms will struggle to meet the standard a court applies when it decides whether a duty of confidence ever arose. Consistency is the whole game: define what matters, put it in your contracts, and run the business in a way that visibly matches those commitments.
In short, protecting confidential information comes down to clarity about what is confidential, contracts that create an enforceable duty, and day to day practices that back the paperwork up. Confidentiality is not the same as privacy, so confirm whether the Privacy Act applies to your customer and staff data. Use NDAs and confidentiality clauses before you share information with outsiders. Limit access, train your team, and offboard properly. Where the law is uncertain, or a dispute has already arisen, a lawyer can help you assess the position and act before the damage becomes permanent.