"Can you keep this in confidence?" That question usually arrives just before someone shares a pricing schedule, a customer list, or a product plan. It is shorthand for an understanding: the information is being given for a limited purpose, and the recipient will keep it private and not use it beyond that purpose.
But "in confidence" is not a magic phrase. Whether the law will actually protect information depends on the circumstances in which it was disclosed, and on whether there is a contract, such as a non-disclosure agreement (NDA), behind the words. This article explains what "in confidence" means in Australian law, the three elements a court checks in a breach of confidence claim, how those elements play out in a realistic business scenario, and the misconceptions that cost businesses the most.
What "in confidence" means in Australian law
Australia has no single statute that protects confidential information generally. Protection comes from two sources. The first is contract: an NDA, or a confidentiality clause inside another agreement, creates express obligations that are comparatively straightforward to enforce. The second is equity: a long-standing doctrine that protects information shared in circumstances of confidence, even when nothing was signed.
The High Court has described the equitable obligation as an "obligation of conscience arising from the circumstances in or through which the information was communicated or obtained" (Moorgate Tobacco Co Ltd v Philip Morris Ltd (No 2) (1984) 156 CLR 414). The point of that description is that the obligation is not about owning information like property. It is about how the information was shared, and what a reasonable recipient would have understood at the time.
Privacy law does not do this work. The Privacy Act 1988 (Cth) regulates how businesses handle personal information about individuals, meaning information about an identified or reasonably identifiable person. It does not protect commercial information such as pricing models, formulas or supplier arrangements. Those are protected, if at all, by contract and the law of confidence.
There are also targeted rules that overlap with confidentiality in particular relationships. Directors, officers and employees must not improperly use information obtained through their position: s 183 of the Corporations Act 2001 (Cth).
The three elements of a breach of confidence claim
Australian courts apply a three-part test for breach of confidence, stated in Coco v A N Clark (Engineers) Ltd [1969] RPC 41 and applied in Australian decisions such as Del Casale v Artedomus (Aust) Pty Ltd [2007] NSWCA 172 and Sports Data Pty Ltd v Prozone Sports Australia Pty Ltd [2014] FCA 595. A claim succeeds only if each element is made out, so it helps to understand what each one requires.
The information must have the necessary quality of confidence
The information must not be public property or public knowledge. It can still be confidential if it is a compilation built from materials that are individually public, provided real skill and effort went into assembling the result. A formula, a design, or a list assembled through work on publicly available materials is the classic example. The High Court added that the information must be significant, not necessarily commercially valuable in a strict sense, but in the sense that preserving its secrecy is of substantial concern to the person claiming protection (Moorgate Tobacco).
A court will also expect the information to be identified with precision. Describing it vaguely as "our business information" will not do; the claimant needs to say exactly what the confidential information is, as the Federal Court confirmed in Sports Data v Prozone. If you cannot point to the specific thing, you cannot easily protect it.
The information must be imparted in circumstances importing an obligation of confidence
The test is whether a reasonable person in the recipient's position would have realised, on reasonable grounds, that the information was given in confidence. That formulation from Coco was adopted in Australia in Commonwealth v John Fairfax & Sons Ltd (1980) 147 CLR 39 and applied in Del Casale v Artedomus.
Marking documents "Confidential", signing an NDA, stating the purpose of the disclosure, and limiting who is in the room all point towards an obligation. So do the steps the discloser took to guard secrecy: restricted access, password protection, and a practice of not sharing the material broadly. The less you did to signal and protect confidentiality, the harder this element becomes. In Sports Data v Prozone, the Federal Court doubted an obligation of confidence existed where the claimed confidential material had been shared with customers without any confidentiality notice at all.
Courts also draw on a list of factors when deciding whether information is truly confidential, including how widely it is known inside and outside the business, the value of the information to competitors, the effort spent developing it, and how difficult it would be for others to acquire or duplicate it. These factors were collected in Wright v Gasweld Pty Ltd (1991) 22 NSWLR 317 and applied in Del Casale v Artedomus.
There must be unauthorised use or threatened use
The recipient must have used or disclosed the information for a purpose outside the permitted one, or threatened to do so. The classic statement of the test also refers to use "to the detriment of the party communicating it", although Australian courts have questioned whether detriment is a separate requirement of the cause of action (see Smith Kline & French Laboratories (Australia) Ltd v Secretary, Department of Community Services and Health (1990) 22 FCR 73).
A worked example: the distributor who went behind your back
Imagine a Melbourne food manufacturer that has spent years developing a signature spice blend and a list of wholesale customers. A national distributor asks for a meeting to discuss stocking the range. The manufacturer signs a one-way NDA before the meeting, marks the pricing schedule and customer list "Confidential", and states the purpose: evaluating a distribution partnership.
During the meeting the distributor is given the customer list so it can size up the opportunity. Six months later the distributor starts contacting those customers directly, offering rival products at a discount, and the manufacturer's sales drop. The manufacturer wants to sue for breach of confidence. Walk the situation against the three elements.
First, the customer list and the blend recipe are not public knowledge, and the recipe is a compilation developed through years of effort, so preserving its secrecy is of substantial concern to the manufacturer. Second, the NDA, the "Confidential" marking and the stated purpose mean a reasonable distributor would have realised the information was given in confidence, and in fact it made an express promise. Third, using the list to poach customers is an unauthorised use to the manufacturer's detriment.
If the claim succeeds, the remedies can include an injunction stopping the distributor from using the information, damages, or an account of the profits the distributor made from the misuse. What the NDA adds is a contractual claim alongside the equitable one: the distributor promised, and proving a broken promise is usually simpler than running the full equitable test.
Common misconceptions about "in confidence"
The phrases that get repeated in meeting rooms are usually only half right, and each one misstates the law in a specific way:
- "We said it was confidential, so we're covered": A verbal statement can create an equitable obligation, because the reasonable recipient test does not require a document. But proving what was said, when, and to whom is far harder than producing a signed NDA, and the NDA adds a contractual claim. Treat verbal assurances as a starting point, not a substitute.
- "It's in my head, so it's not protected": Written form is not required. Trade secrets carried in an employee's memory can be protected. There is a real limit though: courts distinguish genuine trade secrets from an employee's general skill and know-how, which the employee is free to use after leaving (Wright v Gasweld; Del Casale v Artedomus). If the information can be readily separated from ordinary know-how and is hard to acquire by enquiry or experiment, it is more likely to be protected. If it is really the employee's own skill and experience, it is not.
- "If the other side breaches, I own their IP": A breach gives you remedies; it does not transfer ownership. If ownership matters, deal with it expressly in an assignment or licence clause, not by hoping a confidentiality breach will fix it.
- "Confidentiality and 'without prejudice' are the same": They are different tools. Confidentiality restricts use and disclosure of information. The "without prejudice" label protects settlement communications from being used as evidence in a dispute. Reaching for one when the other is needed leaves you exposed.
- "My privacy policy protects my commercial secrets": It does not. A privacy policy and the Privacy Act 1988 (Cth) protect personal information about individuals. Commercial information such as pricing, formulas and supplier arrangements needs NDAs and confidentiality clauses.
- "Once the information is public, the game is over": Not quite. Under the springboard doctrine, a person who gained a head start through confidential information can be restrained from exploiting that advantage for a limited period, even after the information itself becomes public (Sports Data v Prozone). The protection is time-limited, but it is not nothing.
When you need a lawyer for confidentiality
There are three situations where professional help pays for itself:
- Drafting the protections: An NDA should define the information, state the purpose of disclosure, limit who can see it, require return or destruction when the purpose ends, set a duration (trade secrets are often protected indefinitely), and spell out the standard exceptions such as public domain information, independent development, and disclosure required by law. Confidentiality clauses in employment and contractor agreements need tailoring too: post-employment restraints are only enforceable if they protect a legitimate interest and are reasonable, and the line between trade secret and know-how is technical.
- Testing your position before a dispute: A court will ask you to identify the precise information and show how it was disclosed. A lawyer can assess whether your practices, including marking, access controls and NDAs, actually support each element before you commit to litigation.
- Responding to a breach: Time is critical. Urgent or interlocutory injunctions require showing a serious question to be tried, that damages would not be an adequate remedy, and that the balance of convenience favours stopping the use, the framework applied in Sports Data v Prozone. Acting quickly to contain the leak, preserve evidence and seek undertakings or urgent orders is where a lawyer earns their fee.
The question to ask before you share anything
The most expensive mistake businesses make with "in confidence" is treating the words as the protection. Before you hand over anything commercially valuable, ask yourself the two questions a court would ask: Can I identify the specific information I am protecting, and would a reasonable recipient have realised it was given in confidence? If you cannot answer both with confidence, the words will not do the work for you. An NDA, clear marking, and restricted access will.