How non-disclosure agreements work in Australia

Every business in Australia shares information to get things done. You pitch to an investor, brief a supplier, hand a contractor your pricing model, or show a prospective buyer your client list. Each of those moments carries the same risk. The person you are sharing with could use what they learn against you.

A non-disclosure agreement (NDA), also called a confidentiality agreement, is the standard tool for managing that risk. It is a contract in which one party promises to keep the other party's information confidential and to use it only for an agreed purpose. This guide explains how NDAs actually work in Australia: what they rest on, what makes them enforceable, the clauses that do the heavy lifting, the situations where they fail, and when you need a lawyer's help.

Who sits on each side of an NDA

Every NDA has two roles, and it helps to be clear which one you occupy.

Discloser: the party sharing information. Their interest is in the widest practical protection: a clear definition of what is confidential, tight limits on use, and obligations that survive the end of the relationship.
Recipient: the party receiving it. Their interest runs the other way. They want to know exactly what they are bound by, to stay free to use their own knowledge and experience, and to avoid obligations that last forever.

The two interests are not irreconcilable. Most NDAs work because both sides want the same outcome: information shared with confidence, and a clear line drawn around what cannot be used or repeated. The drafting challenge is where that line sits, and the answer usually comes down to how specific the agreement is about the information and the purpose.

What an NDA rests on: contract and equity

An NDA is enforced as an ordinary contract. There is no Australian statute that regulates confidentiality agreements and no registration system for trade secrets. Australia has no dedicated statutory cause of action for trade secret misappropriation; as this overview of the Australian position explains, trade secrets and confidential information are protected through contract and through the law of confidence instead. Protection therefore comes from two layers.

The first layer is the contract. If the NDA is properly formed, the recipient's promises are directly enforceable against them.

The second layer is equity. Australian courts have long protected confidential information through the equitable action for breach of confidence, which applies even where no NDA was signed. The classic formulation, adopted in Australia, requires three things: the information must have the necessary quality of confidence, it must have been imparted in circumstances importing an obligation of confidence, and there must be unauthorised use of it.

The practical consequence is that the law's protection is broader than the piece of paper. Even a badly drafted or unsigned agreement does not necessarily leave you unprotected, because equity can step in where the circumstances of the disclosure plainly imported an obligation of confidence. The NDA's real job is to make the position certain, to define the information precisely, and to convert a general equitable duty into clear, enforceable promises.

What makes an NDA enforceable

Because an NDA is a contract, the ordinary contract requirements apply. There must be an offer, acceptance, consideration, and an intention to create legal relations. A well drafted NDA satisfies all of these on its face. The harder questions arise at enforcement, when a court decides whether the obligations are clear and reasonable.

Courts weigh several factors when asked to enforce an NDA:

Clarity: what exactly is confidential, and what it can be used for. A definition that covers everything is often worse than one that is carefully scoped.
Reasonableness: whether the obligations are proportionate to the risk and the commercial context. Perpetual secrecy for information that is not a true trade secret may be hard to defend.
Conduct: whether the discloser actually treated the information as confidential. Courts notice when a business marks documents, limits access and keeps a register, and they notice when it does not.

The conduct point is often decisive. In Forkserve Pty Ltd v Pacchiarotta [2000] NSWSC 979, a forklift servicing company alleged that former service technicians took notebooks of customer names and addresses when they left to set up a competing business. The case turned on whether the identity of customers was confidential information at all, and on how far a former employee may use what they learned in the job. That is the question at the heart of most NDA disputes: separating information the business genuinely protected from the ordinary skill and knowledge a person is free to take with them.

If a breach happens, the remedies available include urgent interlocutory injunctions to stop further use or disclosure, final injunctions, damages, an account of profits, and orders for delivery up or destruction of the information. Because confidentiality disputes are time sensitive, speed matters, and the courts' equitable jurisdiction is built for exactly that situation.

The three shapes an NDA can take

An NDA takes one of three shapes, depending on who is disclosing and how many parties are involved:

One-way (unilateral): only one party discloses. This suits a pitch to a supplier or manufacturer, or a founder showing a deck to a prospective investor. Only the recipient is bound.
Two-way (mutual): both parties will disclose and receive information, for example in a potential partnership, a joint venture discussion or a distributor negotiation. The obligations run in both directions and are usually identical.
Multilateral: several parties join a project and each will share information. One agreement binds everyone, which avoids a web of separate bilateral NDAs that may not all say the same thing.

Choosing the right shape is mostly about who is disclosing. When in doubt, mutual is the safer default for a negotiation where both sides will end up sharing something.

The clauses that do the work

The enforceability of an NDA turns on a handful of clauses. Each one involves a drafting choice, and each has a trap.

Definition of Confidential Information: the heart of the document. It should describe what is in and what is out: information already public, already known to the recipient, independently developed, or lawfully obtained from someone else. The trap is drafting this too broadly, so a court cannot tell what the parties actually meant to protect. The other side will push to widen the exclusions, so the definition and the exclusions should be drafted together.
Permitted Purpose: the specific reason the recipient may use the information, for example to evaluate a potential supply arrangement. This is what stops the recipient using your pricing to undercut you or your client list to solicit. The trap is a purpose so wide it authorises the very conduct you want to prevent.
Obligations of protection: the recipient must keep the information confidential, apply reasonable security, and only share it with people who need to know and who are bound by similar obligations. This clause is where need-to-know control lives.
Term and survival: how long the obligations last. Two to five years is common for commercial information. Longer or indefinite protection is reserved for genuine trade secrets, such as a formula or algorithm, and even then a court will look at whether the protection is proportionate.
Return and destruction: what happens at the end of discussions or on request. The recipient should return or destroy the material and confirm in writing. This clause is easy to forget and difficult to rely on later if it was never agreed.
Intellectual property: a statement that disclosing information does not transfer any intellectual property rights. This prevents a recipient claiming that a shared document gave them a licence to use or build on it.
Remedies: an acknowledgement that damages may not be an adequate remedy and that the discloser may seek injunctions. It does not create new rights, but it makes the position explicit and can smooth the path to urgent relief.
Governing law and jurisdiction: which state's law applies and which courts hear disputes. For Australian dealings, nominate a state, for example New South Wales. For cross-border deals, this choice is where the practical enforceability of the whole document is decided.

NDAs and your people: employees, contractors and whistleblowers

The NDA's job changes when the recipient is someone inside your business.

Employees owe their employer an implied duty of good faith and fidelity during the employment, but that duty does not last forever. After employment ends, the law distinguishes between confidential information, which remains protected, and the general skill and knowledge the person legitimately takes with them. That distinction, applied in Forkserve, is why a standalone NDA is not the right instrument for an employment relationship. The confidentiality obligations should sit in the employment contract, supported by policies and training.

If you need to stop a departing employee from competing or poaching clients and staff, confidentiality obligations will not do that work. Post-employment restraints are separate, and are governed by the common law rule that a restraint is enforceable only where it protects a legitimate business interest and is reasonable in scope, geography and duration. The New South Wales Court of Appeal applied that rule in Del Casale v Artedomus (Aust) Pty Ltd [2007] NSWCA 172. Restraints need careful drafting and genuine thought about what the business actually needs to protect.

There is one limit on confidentiality clauses that surprises many employers. Under s 1317AB of the Corporations Act 2001 (Cth), a person who makes a disclosure that qualifies for protection under the whistleblower provisions is not subject to any civil, criminal or administrative liability for making it, and no contractual remedy may be enforced against them on the basis of the disclosure. In practical terms, an NDA cannot stop an employee reporting suspected misconduct to ASIC, and a clause that tries to is unenforceable in that situation. Drafting should acknowledge the exception rather than pretend it does not exist.

Contractors and consultants sit between employees and strangers. Their engagement agreement should deal with confidentiality, intellectual property ownership and the return of materials at the end of the project, rather than relying on a standalone NDA that may say nothing about who owns what was created.

Where an NDA is not enough

An NDA is a narrow instrument, and there are several risks it simply does not cover:

Competition: an NDA stops misuse of information; it does not stop a former employee, contractor or business partner competing with you. If that is the risk, you need properly drafted restraints.
Intellectual property: an NDA does not transfer rights in work product. If someone is creating material for you, ownership must be dealt with in the underlying services or consulting agreement.
Personal information: if the information you share includes personal information, the Privacy Act 1988 (Cth) applies on top of the NDA. Australian Privacy Principle 8 requires an APP entity to take reasonable steps to ensure an overseas recipient does not breach the Australian Privacy Principles, and under s 16C the overseas recipient's acts can be treated as the entity's own. An NDA does not displace those obligations.
Cross-border enforcement: if the other party is overseas, a governing law clause choosing Australia is only the start. Enforcing an Australian judgment against a foreign party can be complex, and some jurisdictions treat confidentiality obligations differently, so the drafting should be aligned with the other party's legal system where possible.
Ongoing relationships: for employment, supply, distribution or services relationships, confidentiality should be embedded in the main contract, not left in a one-off NDA signed at the first meeting and forgotten.

The common ways NDAs fail

The same mistakes recur, and they are all avoidable.

Signing too late: information disclosed before the NDA is signed is not covered by it. If a conversation is urgent, send the NDA first and share details only once it is executed.
Vague definitions: a definition that is too broad or too narrow makes enforcement unpredictable. Tailor it to the deal and the actual information being shared.
No need-to-know control: an NDA that lets the recipient circulate information internally without limits is close to useless. The clause should restrict sharing to people who genuinely need access and who are bound by similar duties.
Unrealistic duration: perpetual secrecy for ordinary commercial information invites a court to treat the whole document sceptically. Match the term to the risk.
Forgetting the exclusions: standard carve-outs for public information, independently developed information and disclosures required by law are what make a definition workable, and the other side will expect them.
Treating the NDA as a complete strategy: an NDA protects information, nothing more. Trade marks, contracts and internal policies are separate layers of protection.

When to bring in a lawyer

A lawyer adds the most value at two points: drafting and enforcement.

At the drafting stage, an Artificer Legal practitioner will tailor the definition of Confidential Information and the Permitted Purpose to the actual deal, push back on clauses that overreach and will not survive scrutiny, and decide whether the document needs restraints, IP assignment or cross-border provisions. For an employment relationship, the lawyer's work is in the employment contract and policies rather than the NDA itself.

At the enforcement stage, the value is speed and strategy. If information has been used or disclosed, a lawyer can assess whether the conduct breaches the NDA or the equitable duty of confidence, gather the evidence that courts look for, and move for an urgent injunction to stop further damage while the dispute is resolved. Acting within days rather than weeks is often what preserves the value of the information.

The risk in an NDA concentrates in one moment: the disclosure that happens before the document is signed. Every hour of careful drafting is wasted if the information is already out, because an NDA only protects information that was shared after it was executed and within the definition it describes. The other concentration point is the definition of Confidential Information, because that is what a court will enforce, and it can only be as good as the thought that went into it.

Getting in early costs little. A short, well scoped NDA prepared before the first meeting, and a clear internal rule that sensitive material is never sent without one, will protect more value than almost any other piece of commercial paperwork. If you are unsure whether your existing NDA, employment contracts or restraints are doing the job, a conversation with a lawyer is a cheap way to find out, and a consultation with Artificer Legal can tell you where the gaps are before they cost you.