What is a confidentiality policy?
A confidentiality policy is a workplace policy that defines what information employees must keep private, both about the company and the people it does business with. It sets out what counts as confidential, who the obligation applies to, and what happens if that trust is broken.
When should your company use one?
Any company that handles trade secrets, financial data, or personal information about employees or customers benefits from a confidentiality policy. It becomes especially important once you're hiring beyond a small founding team, working with outside vendors or partners, or operating in an industry where a leak of sensitive data carries real legal or competitive risk.
Free confidentiality policy template
Use the template below as your starting point. It covers what counts as confidential, who it applies to, and how long the obligation lasts, and it's ready to copy into your employee handbook.
Purpose
[Company Name] handles sensitive information about the business, its employees, and its customers. This policy explains what counts as confidential and what every employee is responsible for protecting.
Scope
This policy applies to all employees and contractors, both during their time at [Company Name] and after their employment ends. Anyone with access to confidential information as part of their role is bound by it.
What is confidential information
Confidential information includes, but isn't limited to:
- Trade secrets, product plans, and unreleased features
- Financial data, forecasts, and pricing strategy
- Employee records, including compensation and performance information
- Client and customer data
- Internal processes, code, and technical documentation not meant for public release
Employee obligations
- Do not share confidential information outside the company, including with friends and family
- Do not use confidential information for personal gain or to benefit a third party
- Store confidential information securely, and limit access to people who need it for their role
- Only discuss confidential matters in appropriate settings, not in public spaces or over unsecured channels
Third-party confidentiality
When [Company Name] shares confidential information with vendors, partners, or clients, it does so under a signed non-disclosure agreement. Employees should not share confidential information with a third party without first confirming an agreement is in place.
Data protection and IT security
Confidential information stored digitally must follow [Company Name]'s data protection and IT security requirements, including access controls and secure storage.
Duration of obligation
This confidentiality obligation continues after an employee's employment ends. Departing employees must return or securely delete any confidential materials in their possession.
Exceptions
This policy does not prevent employees from disclosing information when legally required to do so, such as in response to a valid subpoena, or from reporting suspected illegal activity through appropriate whistleblower channels.
Consequences of a breach
Breaching this policy can result in disciplinary action up to termination, and may carry further legal consequences depending on the information involved and any signed confidentiality agreement.
How to customize the template
If employees sign a separate NDA at hiring, reference it here rather than duplicating its terms, and make sure the two documents don't contradict each other.
Legal and practical considerations
Confidentiality obligations sit alongside other legal protections this policy should never override. Employees are generally free to discuss their own wages under labor law, and whistleblower protections apply when someone reports suspected illegal activity in good faith. If your company already uses a standalone NDA at hiring, confirm this policy and that agreement don't contradict each other, and have a lawyer confirm the policy holds up in every jurisdiction where you operate.
Rollout checklist
Once the template is customized, a few practical steps make sure it actually sticks:
- Fill in [Company Name] and any other bracketed details
- Have the policy reviewed by legal counsel familiar with your jurisdiction
- Add it to your employee handbook and internal policy library
- Communicate the policy to all current employees and collect acknowledgment
- Include it in new hire onboarding
- Review it annually or after any incident involving confidential information
