Information barrier guidelines in Australia, what to include and how to implement them

A marketing agency that works for your business has just signed a competitor as a client. A co-founder is leaving with two years of pricing, supplier and customer knowledge in their head. A freelancer you rely on also does project work for the business down the road. Each situation carries the same risk: information that matters to your competitive position ends up somewhere it should not. Information barrier guidelines are the written internal rules that manage that risk, and for most small businesses they can be a short, practical document rather than a corporate policy suite.

What information barrier guidelines are (and where Chinese walls came from)

Information barrier guidelines are written procedures that set out what information is restricted in your business, who may access it, how it is stored, shared and discussed, and what happens when something goes wrong. Larger organisations often call the same thing a "Chinese wall". The term comes from law firms and financial institutions, where a firm acting for two clients with competing interests would separate the teams so confidential information could not flow across.

The idea is not foreign to Australian law. Courts have examined whether effective information barriers protect a former client's confidential information when deciding whether a firm should be prevented from acting against that client, for example in PhotoCure ASA v Queen's University at Kingston [2002] FCA 905 and Asia Pacific Telecommunications Ltd v Optus Networks Pty Ltd [2007] NSWSC 350. The same logic scales down to a small business: if you can show you actively separated information flows, you are in a much better position than a business that relied on goodwill alone.

Why the law cares whether you have them

There is no statute that says a business must have an information barrier policy. The legal weight comes from the underlying obligations the guidelines help you meet. Four areas do most of the work for a small business.

Protecting confidential information

To be protected as confidential, information must have the "necessary quality of confidence" about it, and Australian courts have made clear that secrecy is relative rather than absolute: information that is not generally known in the industry can still be confidential. In Artedomus v Del Casale [2006] NSWSC 146, the court held that information about the sources and suppliers of a particular stone was confidential even though it was not secret in any absolute sense, and that what counts as commercially sensitive is assessed against the usage and practices of the industry concerned. The case also illustrates the "springboard" idea: a departing employee or director cannot use confidential information as a springboard to get a head start in competition.

That is where your guidelines become evidence. If you can show you treated information as confidential, by labelling it, restricting access and requiring approvals before it leaves the business, you are in a strong position to argue the information retained its confidential character. If you cannot show any of that, an ex-employee or contractor can credibly say they did not know, or did not agree, that the material was restricted. Directors and employees also owe statutory duties, including under s 183 of the Corporations Act 2001 (Cth), not to misuse information obtained through their position.

Privacy obligations if you handle personal information

If your business is covered by the Privacy Act 1988 (Cth), Australian Privacy Principle 11 requires you to take such steps as are reasonable in the circumstances to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. The principle expressly says those steps include technical and organisational measures, which is a direct legal hook for your access rules, folder permissions and training.

The Act does not apply to every business. Under s 6D of the Privacy Act 1988 (Cth), a business is a "small business" if its annual turnover for the previous financial year was $3 million or less, and small businesses are generally exempt from the Australian Privacy Principles unless an exception applies, for example where they provide health services or are involved in credit reporting. So a startup under the threshold is not compelled to meet APP 11, but the moment you grow past it, or fall into an exception, your internal controls become a compliance requirement rather than a nice-to-have.

If a breach does happen, the notifiable data breach scheme in Part IIIC of the Privacy Act 1988 (Cth) applies to APP entities: unauthorised access to or disclosure of personal information (or loss where that is likely) that a reasonable person would conclude is likely to result in serious harm is an "eligible data breach", and the entity must notify affected individuals and the Office of the Australian Information Commissioner. A written breach response process built into your guidelines is what lets you move quickly when those notification obligations are triggered.

Conflicts of interest

If your company has directors, s 191 of the Corporations Act 2001 (Cth) requires a director who has a material personal interest in a matter relating to the company's affairs to give the other directors notice. That duty matters in the "dual hat" situations small businesses run into all the time: a founder involved in another venture, an advisor sitting on several boards, a contractor working for two businesses in the same industry. Guidelines that require disclosure of potential conflicts, allocate people to specific project teams and restrict access to certain folders and meetings do more than keep the peace. They help directors actually identify interests they are obliged to disclose. For contractors and advisers who are not directors, the obligations are mainly contractual, which is why the agreements discussed below matter.

Marketing claims and the Australian Consumer Law

Information barriers also stop teams accidentally using information in ways that create legal exposure. If marketing and sales staff make performance claims, use testimonials or publish pricing comparisons, they are dealing in representations covered by s 18 of the Australian Consumer Law (Schedule 2 of the Competition and Consumer Act 2010 (Cth)), which prohibits conduct in trade or commerce that is misleading or deceptive or likely to mislead or deceive. An approval gate in your guidelines, so high-risk communications are checked before they go out, is a practical control against that exposure.

When your small business actually needs them

Most startups run on shared folders, a single team chat channel and verbal "please don't share this" instructions. That works until the business starts collaborating with outsiders or handling higher-value information. The typical triggers are:

Contractors and agencies: a marketing agency that has access to customer data, performance metrics and your launch plan, while also working for a competitor.
Hiring from competitors: new employees bring knowledge of their previous employer with them, and without boundaries both businesses are exposed.
Departures: when a co-founder or senior employee leaves, you need clarity about what they can take, use and disclose, which ties into confidentiality and restraint clauses.
Multiple business lines: if you serve competing clients or run separate product lines, client and pricing data needs to be kept apart.
Sensitive negotiations: investor due diligence, acquisitions and joint ventures mean financials, contracts, forecasts and cap table details are sent to more parties, each one a new point of risk.
Personal information: holding customer, employee or lead data, especially if the Privacy Act 1988 (Cth) applies to you.

None of these require a big-company compliance apparatus. They require enough structure that the boundary does not depend on memory or goodwill.

What to put in the guidelines

A practical set of guidelines can be short, but it should cover six areas:

Restricted information: define the categories. Confidential business information covers pricing, supplier terms and strategy decks. Client confidential information covers what you hold about a client's business. Personal information covers identifiable individuals, whether customers, employees or leads. Highly restricted information covers fundraising terms, legal disputes, security credentials and payroll records. Align the categories with what your contracts call confidential, so the policy and the agreements say the same thing.
Access rules: apply a need-to-know model rather than giving everyone access by default. Role-based access (finance documents only for founders, finance staff and your accountant), project-based access (product roadmap files only for the team building the product) and client-based access (account teams see their own client folders, not the whole client list) are the common approaches. In practice this is often just setting permissions correctly in Google Drive, Microsoft 365, Notion or your CRM, and writing the rule down.
Communication rules: most leaks do not happen through hacking, they happen through casual conversation. Cover public places, broad chat channels, designated channels for sensitive topics, screensharing in meetings and labelling documents as confidential. If you record calls or meetings, be aware the rules on consent and workplace surveillance vary between states and territories and depend on how the recording is made and used; guidelines can set a consistent internal approach but are not a substitute for checking the law that applies to you.
Conflicts and dual hats: require disclosure of potential conflicts, allocation to a specific project team, restrictions on access to certain folders and meetings, and clear boundaries about what is not shared between projects. This is not about assuming bad intentions; it removes ambiguity so people do not accidentally end up in the middle of a dispute.
Security basics: unique passwords and a password manager, multi-factor authentication on key systems, rules for personal devices, approved systems only for restricted files, and secure disposal of sensitive data. If your guidelines cover personal information, this section is where they meet APP 11's "technical and organisational measures".
Breach response: set out who to notify internally, how to contain the issue (revoke access, reset credentials, contact affected parties), how to document the incident and when to escalate to legal advice. If the Privacy Act 1988 (Cth) applies to you, this is also the process that feeds into notifiable data breach obligations.

How to implement without slowing your team down

Five practical steps keep the barrier effective without adding bureaucracy:

Map your sensitive information: Ask what would hurt the business if it leaked, where it lives (Drive, CRM, email, Slack, laptops), who has access today and who should. You will usually find quick wins, like limiting access to an "All Clients" folder or removing an old contractor's account.
Nominate an owner: Even in a small team, someone should own the guidelines, typically a founder or operations lead. They approve access to highly restricted information, handle conflict disclosures and make sure onboarding and offboarding happen consistently.
Build the barrier into your tools: Policies fail when they rely on memory. Use separate folders for leadership, HR, finance, client work and product roadmap; permission groups rather than individual permissions; template labels like "Confidential - Internal"; and restricted channels for sensitive discussions.
Train people in plain English: Cover what counts as confidential in your business, where it should be stored, who can approve external sharing and what to do if something is sent to the wrong person. Include contractors in onboarding so the expectation is set before they touch your data.
Review as you grow: Revisit the guidelines when you hire your first employee, take on agencies or offshore contractors, launch a new product line, or raise capital. A policy that fit a two-person team will not fit a ten-person one.

The contracts that make the guidelines bite

An information barrier is an internal tool, and it works best when the surrounding documents point in the same direction:

Non-disclosure agreement: the quickest way to set boundaries when you share information with suppliers, prospective partners, buyers or investors before a deal is finalised.
Employment contracts: set expectations about confidentiality, use of company information, return of property and post-employment obligations. Restraint clauses are only enforceable to the extent they protect a legitimate business interest and go no further than is reasonable, so they should be drafted and reviewed carefully.
Contractor agreements: clarify who owns what, confidentiality expectations and restrictions on misuse, which matters particularly when a contractor works across multiple clients.
Privacy documentation: if you handle personal information, your internal practices should match your external commitments in your privacy policy and collection notices.
Customer terms: if clients share sensitive information with you, your customer agreement should cover confidentiality and permitted use.
Governance documents: as your structure becomes more complex, a shareholders agreement or company constitution can align decision-making and confidentiality expectations at every level.

Where a lawyer earns their keep

The practical elements of an information barrier, the folder permissions, labels and training sessions, are things you can do yourself. The judgement calls are where a commercial lawyer earns their fee: whether the Privacy Act 1988 (Cth) actually applies to you given the turnover threshold and the exceptions; whether a restraint clause in an employment contract is likely to be enforceable; whether a director's interest is material enough to require disclosure under s 191 of the Corporations Act 2001 (Cth); and how your breach response should be structured if you are caught by the notifiable data breach scheme. A lawyer can also draft the NDA, employment and contractor documents so they match the internal rules, rather than contradicting them. Artificer Legal regularly reviews these arrangements for small and medium businesses and can tell you which obligations apply to your situation before you invest time building the wrong controls.

The difference between a policy and a defence

The most common mistake we see is treating a signed NDA as the whole answer. An NDA creates an obligation; information barrier guidelines are the evidence that you ran the business in a way that respected it. If a dispute ever reaches court, the question is not only what the contract said, but whether the information was treated as confidential in practice. Courts weigh the steps an owner took to preserve secrecy, and a business that cannot point to any restriction on access, labelling or approvals has a much harder argument than one that can produce a written policy and show it was followed.

To recap the key points: information barriers are written rules about who can see, store and discuss restricted information; their legal force comes from the law of confidential information, the Privacy Act 1988 (Cth) where it applies, directors' disclosure duties and the Australian Consumer Law; they matter most when you work with agencies and contractors, hire from competitors, manage departures or enter sensitive negotiations; and they work best when the policy, the tool permissions and the contracts all point in the same direction.