Confidentiality Provisions in Employment Agreements: Drafting Beyond the Standard NDA

Your new developer just gave two weeks' notice, and on day three of the notice period, you noticed she emailed herself a 47-page client database. The confidentiality clause in her onboarding packet says, in full: "Employee agrees not to disclose any information related to the Company." Your lawyer's first question: "What exactly is 'any information'?" Your answer — silence. That is the problem with most employee confidentiality provisions: they look airtight when you create them, feel airtight when both parties sign, and dissolve like sugar in rain the moment you actually need them enforced in court.

This article is not about the standard NDA you use when pitching investors or sharing specs with a vendor. It is about the specific, frequently misunderstood clause that is the employee confidentiality provision — governed simultaneously by federal trade secret law, the National Labor Relations Act, state contract principles, and a growing patchwork of state-level restrictions that vary significantly by jurisdiction. Whether you are looking for a starting template or trying to fix an agreement that already has problems, the Employment Contract template and the full template catalog at /docs are useful baselines before you start drafting or revising.

Why the Standard NDA Is the Wrong Starting Point for Employees

The word "standard" does a lot of heavy lifting in small business contract management. A standard NDA for a vendor relationship is designed for arm's-length parties with roughly equal bargaining power and a defined transaction. An employee confidentiality provision is something entirely different: it is embedded in a long-term, ongoing, subordinate relationship governed by a separate body of law. When you simply grab a standard mutual NDA template, cross out "Party B," and replace it with "Employee," you import assumptions that do not apply — and exclude protections that should.

First, an employee NDA can never be truly mutual in the vendor sense because the employee is not disclosing their own trade secrets to you. Second, the employment relationship already creates a common law duty of loyalty that covers some basic confidentiality — your agreement needs to define what goes beyond that baseline, not merely restate it. Third, unlike a vendor NDA, an employee confidentiality agreement must coexist with the National Labor Relations Act, which protects employees' right to discuss wages, working conditions, and workplace complaints with co-workers. A provision that says "Employee shall not disclose any Company information to any third party" could violate the NLRA — and an NLRA violation does not just expose you to an agency charge; it can void the offending clause entirely and put you on the NLRB's radar for existing agreements that are already out in the field.

The practical lesson: start with an employment-specific document. A good Non-Disclosure Agreement template designed for employee use will have NLRA carve-outs, trade secret definitions that track the Defend Trade Secrets Act, and duration language that courts in most jurisdictions are prepared to accept. Once you have that baseline, you can layer in the industry-specific protections your business needs.

What Federal and State Laws Actually Govern Employee Confidentiality

Before you put a single clause on paper, you need to understand the legal landscape. Three overlapping layers of law apply simultaneously, and an agreement that satisfies one layer but ignores another is only partially protected.

• The Defend Trade Secrets Act (DTSA), 18 U.S.C. §1836 (2016): Federal statute giving employers a direct right of action in federal court for trade secret misappropriation. The DTSA defines "trade secret" as any information with independent economic value derived from secrecy, subject to reasonable protective measures. Your confidentiality agreement must mirror this definition to access federal jurisdiction and the DTSA's enhanced remedies — including exemplary damages and attorney's fees for willful misappropriation.
• The Uniform Trade Secrets Act (UTSA): Adopted in some form by 48 states; establishes parallel state-level trade secret protection. New York still uses common law. Because states have modified the UTSA language in various ways, your governing law clause determines which version applies.
• The National Labor Relations Act (NLRA), §7: Protects employees' rights to organize, discuss wages, and engage in "concerted activity." Any confidentiality clause that can reasonably be read to prohibit these activities is presumptively unlawful under McLaren Macomb, 372 NLRB No. 58 (2023), which the Sixth Circuit enforced in full in September 2024.
• State employment statutes: California Business and Professions Code §16600, Minnesota Statute §181.988 (2023), and Washington RCW 49.62 impose restrictions that can make general confidentiality clauses unenforceable if they look too much like non-competes.
• Whistleblower protection statutes: The Sarbanes-Oxley Act, Dodd-Frank Act, and DTSA §1833(b) all protect employees who report suspected legal violations to government agencies. A confidentiality clause that cannot be squared with these protections is void as against public policy.

Defining "Confidential Information" — The Clause Courts Scrutinize Most

If the definition section of your confidentiality provision is three lines that say "all non-public information about the Company," you have already lost any court fight over it. Courts in virtually every jurisdiction apply a reasonableness standard: the definition must be specific enough to give the employee meaningful notice of what is protected, must relate to legitimate business interests, and must not be so broad that it covers information any employee would naturally accumulate just by doing their job. Courts have repeatedly declined to enforce sweeping "all information" clauses on the ground that they are commercially unreasonable and deprive the employee of the ability to use general knowledge and skills in future employment.

A workable definition has three components: a general description of categories, a specific list of examples within each category, and explicit exclusions for public-domain and independently developed information. The following sample language tracks the DTSA framework while remaining enforceable in most jurisdictions:

"Confidential Information" means any non-public information, technical data, trade secrets, or know-how of the Company, including without limitation: (a) customer and prospect lists, contact information, and purchasing history; (b) pricing models, cost structures, and margin data; (c) proprietary software code, algorithms, and system architectures; (d) product development plans and unreleased feature specifications; (e) financial projections and internal accounting records not otherwise publicly filed; and (f) personnel information and compensation data of other employees to the extent not subject to NLRA Section 7 protections. "Confidential Information" does not include information that: (i) is or becomes publicly available through no fault of Employee; (ii) was known to Employee before disclosure by Company and was not subject to a prior confidentiality obligation; (iii) is independently developed by Employee without reference to Company information; or (iv) is required to be disclosed by law, regulation, or valid court order, provided Employee gives Company prompt written notice and cooperates with any protective order.

Notice that the exclusions are as important as the inclusions. A definition without clear carve-outs looks overreaching to courts, and courts in states that use the "all-or-nothing" rule — rather than the more employee-friendly blue-pencil reform approach — will throw out the entire provision rather than trim it. Including thoughtful exclusions is not a concession; it is good drafting practice that signals to courts you are trying to protect legitimate interests, not trap the employee indefinitely.

The Trade Secret Overlay: When the DTSA Gives You Extra Ammunition

Not all confidential information is a trade secret — but trade secrets get special treatment. They can be protected indefinitely under the DTSA (unlike general confidential information, which courts typically limit to a fixed post-employment period), and they unlock federal court jurisdiction, which often deters potential violators who would happily face a state small claims proceeding. To get DTSA protection, the information must meet two distinct requirements: it must derive independent economic value from not being generally known, and you must have taken reasonable measures to maintain its secrecy.

That second requirement is where small businesses most often stumble. Reasonable measures are not theoretical — courts look at actual practices, not just what the contract says. If your customer database is visible to every employee without access controls, if your pricing model is on a shared drive accessible to the entire company, or if you have never told employees what you consider confidential, you will struggle to satisfy the DTSA's "reasonable measures" element no matter how good your agreement looks. Your confidentiality clause is one piece of the puzzle; system access controls, document classification, and employee training are the other pieces.

The DTSA also contains a mandatory whistleblower immunity provision at 18 U.S.C. §1833(b) that you must include in any confidentiality agreement covering trade secrets. This is not optional boilerplate — it is a federal statutory requirement. Failing to include it costs you the ability to recover attorney's fees or exemplary damages in a DTSA action. The notice informs employees that disclosing a trade secret to an attorney or government official in connection with reporting a suspected legal violation is immune from liability under federal and state trade secret law. Including this notice takes three sentences, and failing to include it is particulary common among small business owners who rely on outdated form agreements they created years ago.

Duration Clauses: How Long Can You Keep an Employee Silent?

A clause that says "Employee's confidentiality obligations shall survive termination indefinitely" sounds maximally protective but can actually undermine your position. Courts in several states have struck down perpetual confidentiality obligations for general business information — as opposed to trade secrets — on the ground that they function as de facto non-competes and must satisfy the same reasonableness test those restrictive covenants face. In states like California, a perpetual general confidentiality clause can void the trade secret portion of the agreement by tainting the entire provision.

The better approach is a two-tier duration structure:

• Tier 1 — Trade Secrets: Indefinite duration, expressly defined as lasting for as long as the information retains its character as a trade secret under the DTSA. This is legally sound in all 50 states, provided the information actually qualifies.
• Tier 2 — General Confidential Information: A defined post-employment period, typically two to five years. Courts have generally upheld two-year post-employment confidentiality obligations for general business information when the definition is specific and the scope is limited to the employee's actual exposure.
• Tier 3 — Personal Data: Duration governed by applicable privacy statute — CCPA, state equivalent, or sector-specific law — rather than the contract. Acknowledge in the agreement that statutory privacy obligations may require disclosure regardless of the contractual confidentiality commitment.

For employees with access to particularly sensitive categories — clinical data, unreleased financial projections, source code — a three-year post-employment obligation for Tier 2 is defensible in most jurisdictions. Going beyond five years for general confidential information invites challenge and is increasingly difficult to enforce as more state courts apply heightened scrutiny to post-employment restrictions of any kind.

The "Return and Destroy" Obligation That Most Employers Forget

You have a carefully crafted definition clause and a two-tier duration structure. What you have almost certainly forgotten is the provision that specifies what happens to the confidential information when the employee walks out the door. Without a return-and-destroy clause, an employee who keeps a personal copy of your customer database is arguably not violating the agreement — they are just not disclosing it to anyone. The agreement says "do not disclose"; keeping a copy is a separate act. Courts have split on this issue, but the risk of litigation over this gap is avoidable with three paragraphs of clear drafting.

A well-structured At-Will Employment Agreement template typically includes return-of-property language that can be adapted for the confidentiality context. A complete return-and-destroy provision should include the following elements:

Upon termination of employment for any reason, or at any time upon written request by Company, Employee shall: (a) promptly return to Company all Confidential Information in Employee's possession or control, whether in physical or electronic form, including all copies, summaries, and derivative works; (b) permanently delete and destroy all Confidential Information stored on personal devices, cloud storage accounts, or any medium not owned by Company; (c) provide written certification, within five (5) business days of termination, confirming compliance with this Section; and (d) cooperate with Company's reasonable requests to verify compliance, including providing access to personal devices for inspection by a mutually agreed neutral forensic examiner, the cost of which shall be borne by Company absent a finding of breach.

The neutral forensic examiner provision is unusual but increasingly valuable in practice. It creates a path to verify compliance without first needing a court order for discovery — and employees who know that verification is available tend to be more careful about compliance. The "neutral" designation keeps it from feeling adversarial, and placing the cost burden on the employer (absent a finding of breach) makes the provision more likely to survive a challenge as unconscionable.

Carve-Outs: What Employees Are Legally Allowed to Disclose Anyway

The most important drafting move you can make — and the one most often skipped by small business owners using a basic online confidentiality form — is the explicit carve-out for legally protected disclosures. Federal and state law create several categories of information that employees have an absolute right to discuss, share, or report regardless of what the employment contract says. Including these carve-outs in the agreement does not weaken your protection; it signals to courts that you are drafting in good faith, which makes courts significantly more willing to enforce the portions that legitimately protect your business.

• NLRA §7 Protected Activity: Wages, hours, working conditions, and any information necessary for "concerted activity." Under McLaren Macomb and GC Memorandum 23-05, a confidentiality clause that can reasonably be read to chill these rights is presumptively unlawful — even if the employee never actually tries to exercise them.
• Whistleblower Disclosures: Under the Sarbanes-Oxley Act, the Dodd-Frank Act, and DTSA §1833(b), employees who report suspected legal violations to government agencies or law enforcement are protected from confidentiality liability. An agreement that purports to prevent such reporting is void as against public policy.
• Legal Process: Your agreement can require the employee to give you prompt written notice before complying with a subpoena, and it can authorize you to seek a protective order — but it cannot require the employee to refuse to comply, destroy evidence, or misrepresent the existence of the agreement.
• Professional Licensing: In regulated industries — law, medicine, accounting, financial services — professional ethical rules may require disclosure that overrides the contractual confidentiality obligation. These obligations should be explicitly preserved.

A provision that does not explicitly carve out these categories risks being voided in its entirety by a court that views the agreement as an attempt to suppress legally protected activity. The NLRB has made clear, in the guidance following McLaren Macomb, that a generic "savings clause" tacked onto an otherwise overbroad provision is usually not enough — the carve-outs need to be specific and integrated into the definition section, not appended as a disclaimer.

Confidentiality vs. Non-Disparagement: Two Different Animals

Many small business owners try to fold non-disparagement obligations into confidentiality provisions, treating them as variations on the same theme. They are not. Confidentiality governs facts — keeping specific information secret. Non-disparagement governs speech — prohibiting certain categories of statements about the company. The two have different enforceability profiles, different NLRA implications, and different remedies in the event of breach. Mixing them in a single clause creates ambiguity that undermines both.

The most significant recent development is the NLRB's 2023 decision in McLaren Macomb (372 NLRB No. 58), subsequently enforced by the Sixth Circuit in September 2024, which found that non-disparagement clauses that can reasonably be read to restrict NLRA-protected activity are unlawful — even if the employee signs willingly. The Board's reasoning is that employees cannot waive future rights under the NLRA by contract. The Trump administration rescinded several NLRB guidance memos in 2025, creating some uncertainty about enforcement priorities, but the underlying legal principle from McLaren Macomb — as affirmed by the Sixth Circuit — remains intact and binding precedent.

If you want non-disparagement protection, draft it in a clearly labeled separate section, make explicit that it does not limit NLRA §7 rights, and tie it to objectively false and defamatory statements rather than any negative statements. "Employee agrees not to make knowingly false and defamatory statements about the Company or its officers" is defensible. "Employee agrees not to disparage the Company in any manner to any person" is almost certainly not. You can review the structure of the Non-Compete Agreement template for how post-employment restrictions are separated and limited — the same structural principle applies to non-disparagement provisions.

Tail Coverage: Protecting Secrets After the Employee Leaves

The moment of maximum risk is not when the employee is active — it is in the sixty to ninety days after departure, when they are transitioning to a new employer and most likely to use what they learned. Your confidentiality provision's "tail" — the post-employment portion — needs specific language that addresses real-world departure scenarios, not just the abstract principle that obligations survive termination.

Two provisions are commonly overlooked in small business confidentiality drafting. The first is the "no-use" clause, which extends protection beyond non-disclosure. A standard non-disclosure clause prohibits sharing the information with others. A no-use clause also prohibits using it personally — for example, calling former clients from a list the employee memorized, or applying a pricing model the employee internalized to build a competing service. Courts in most jurisdictions have upheld no-use obligations as a reasonable extension of trade secret protection, as long as the information itself qualifies under the DTSA definition.

The second overlooked provision is the notice-to-new-employer clause, which authorizes the company to send a copy of the confidentiality agreement directly to any subsequent employer the departing employee identifies. The purpose is not to threaten the new employer — it is to create actual, documented knowledge of the confidentiality obligations. A new employer that benefits from misappropriated information after receiving that notice faces its own potential DTSA liability for "knowing receipt" of misappropriated trade secrets. The existence of that risk often motivates new employers to take compliance more seriously than a vague warning letter would. The Remote Work Policy template contains useful language about information access and exit procedures that can inform how you structure the tail provisions for remote employees whose data exposure may differ from on-site staff.

Remedies and Injunctions: What the Contract Must Say to Get Emergency Relief

You will not obtain an emergency injunction — a court order to stop the employee from using or disclosing your information — unless your agreement explicitly acknowledges that monetary damages are inadequate and that injunctive relief is appropriate. This acknowledgment is not automatic. Federal courts, in particular, require an independent showing of irreparable harm that cannot be compensated in money. If your agreement is silent on remedies, you waste critical time at the outset of litigation arguing about the legal standard while the employee is on day three at the competitor and already reaching out to your clients.

The remedies section should address three elements. First, an express acknowledgment that breach of the confidentiality provision will cause irreparable harm for which monetary damages are an insufficient remedy — courts treat this as an admission that removes one of the four preliminary injunction factors from dispute. Second, an explicit authorization for injunctive relief without requirement of a bond, which is often enforceable and eliminates the requirement to post potentially large sums before the court enters the order. Third, a prevailing-party attorney's fees provision, which makes frivolous defenses more expensive and helps level the playing field when the violating party has more resources than the small business plaintiff.

On the DTSA's fee-shifting option: under 18 U.S.C. §1836(b)(3)(D), a court may award fees if misappropriation was willful and malicious, or if a claim was made in bad faith. Including the DTSA §1833(b) immunity notice is what preserves your eligibility for this remedy — courts have held that failing to include the notice forecloses exemplary damages and fee-shifting even when the underlying misappropriation is egregious. This is a one-paragraph fix that costs nothing and potentially saves you six figures in litigation costs.

State-Specific Limits: California, Minnesota, and the NLRA Shadow

If you have remote employees in multiple states, the governing law clause in your confidentiality agreement is not just a formality — it is a substantive decision that determines which version of your agreement survives. Choosing to apply Texas or Delaware law to an agreement signed by a California employee does not automatically protect you; California courts apply California law to California employees regardless of what the contract says.

California: Business and Professions Code §16600 voids agreements "in restraint of trade," and California courts have applied this provision to confidentiality clauses that, in practice, prevent employees from working in their industry. What survives in California is limited to protection under the California Uniform Trade Secrets Act (CUTSA), which largely preempts common-law claims. A confidentiality clause tied to CUTSA-qualifying trade secrets is enforceable; a general "keep everything secret for five years" clause is not. California employees can also recieve additional protection under state privacy law that may create disclosure obligations conflicting with your agreement.

Minnesota: Minn. Stat. §181.988, enacted in 2023, bans non-compete agreements outright and adds heightened scrutiny to confidentiality provisions that operate as effective non-competes. The law specifically targets provisions designed to prevent employees from using general skills and knowledge acquired on the job. Minnesota courts are more receptive to narrowly drawn provisions tied specifically to documented trade secrets than to broad confidentiality clauses covering anything the employee encountered during employment.

Washington: RCW 49.62, amended in 2022, prohibits post-employment non-compete agreements for employees below a salary threshold and requires that any post-employment restriction be supported by independent consideration beyond initial employment if agreed to after the first day of work. Courts in Washington have applied similar scrutiny to confidentiality provisions that function as non-competes, particularly those covering general industry knowledge.

Across all states, the NLRA shadow remains. The Board's reasoning in McLaren Macomb extends beyond severance agreements to any employer communication with employees — including onboarding documents, offer letters, and standalone confidentiality agreements — if the language can reasonably chill §7 protected activity. With GC Memorandum 23-05 now rescinded by the Trump administration, enforcement priorities have shifted, but the Sixth Circuit's September 2024 affirmance of McLaren Macomb means the underlying principle is judicially established, not just administrative policy.

Common Drafting Mistakes That Void or Weaken the Provision

Most confidentiality provisions fail not because of sophisticated legal arguments but because of avoidable drafting errors. Here is what a thorough online contract generator review should catch, and what your employment lawyer should flag before the document goes out:

• The "all information" trap: Defining confidential information to include anything an employee learns during employment makes the clause unenforceable in almost every jurisdiction. It also makes the provision useless in practice — no employee can function if every conversation triggers a legal obligation.
• Missing the DTSA immunity notice: A one-paragraph omission that costs you exemplary damages and attorney's fees under federal law. Every employment confidentiality agreement covering trade secrets must include it.
• Signing after the first day without new consideration: In most states, an agreement signed during employment requires more than continued employment as consideration. A raise, promotion, additional equity, or specific benefit can cure this gap. A routine HR review that produces a new confidentiality agreement with nothing new in return gives the employee a strong unenforceability argument.
• No NLRA §7 carve-out: Still the most common mistake in small business confidentiality drafting. Any provision without an explicit carve-out for legally protected concerted activity is vulnerable to an NLRB unfair labor practice charge — and those charges now apply retroactively to agreements already in circulation.
• Using a vendor NDA template without adapting it: A vendor NDA template lacks the NLRA carve-outs, DTSA immunity notice, two-tier duration, and return-and-destroy provisions that employment-specific agreements require. Starting from the wrong template and making cosmetic changes is one of the most common ways small businesses create agreements that look professional but provide minimal actual protection.

Operational Steps That Strengthen Enforceability Beyond the Contract

Even perfect contract language cannot do all the work. The "reasonable measures" requirement of the DTSA — and the reasonableness standard courts apply to the agreement as a whole — depends on what you actually do operationally, not just what the contract recites. A few steps that significantly strengthen enforceability:

Classify your information in writing. Create a documented inventory of what the company considers confidential, what qualifies as a trade secret, and who has access to each category. If you cannot identify your own confidential information with specificity, you will struggle to prove in court that it had independent economic value derived from secrecy — the DTSA's threshold requirement. This inventory does not need to be a legal document; a spreadsheet kept in a folder labeled "Confidential Information Classification" is far better than nothing.

Restrict access to what the role actually requires. Role-based system access, password protection on sensitive files, and document classification labels ("Confidential — Internal Only") are all evidence of reasonable measures. Courts have denied DTSA protection to companies that left sensitive data accessible to entire organizations without any access controls, even where the confidentiality agreement itself was well-drafted.

Train employees at onboarding and annually. Documented training on what the company considers confidential and what the confidentiality agreement requires is evidence that your measures are "reasonable" under the DTSA. It also supports the argument that a departing employee "knew or should have known" a specific category of information was protected — which matters for both the DTSA's "misappropriation" element and for any state-law conversion or breach of contract claim.

Use annual acknowledgment renewals. At each annual review, have employees sign a one-page acknowledgment confirming they have reviewed their confidentiality obligations, are currently in compliance, and understand what the company considers confidential. This practice simultaneously refreshes the consideration question, documents continued notice, and creates a paper trail that is invaluable if you later need to establish that the employee was aware of their obligations at the time of departure. For remote employees, a well-structured Subcontractor Agreement template illustrates how to build similar ongoing acknowledgment mechanisms into independent contractor relationships, which you can adapt for the employment context.

Final Checklist: Eight Questions Before Anyone Signs

Before you hand an employee a confidentiality agreement, work through these questions. If the answer to any of the first five is "no," the agreement needs revision before it is distributed. Questions six through eight are compliance checks that should be part of every signing process, not afterthoughts.

• Does the definition of "Confidential Information" specifically describe categories of protected information, rather than using sweeping language like "anything company-related"?
• Have you included an explicit NLRA §7 carve-out that permits employees to discuss wages, hours, and working conditions with co-workers and third parties?
• Have you included the DTSA §1833(b) whistleblower immunity notice for trade secret provisions?
• Does the duration clause distinguish between trade secrets (indefinite) and general confidential information (defined term, typically two to five years)?
• Does the agreement include a return-and-destroy obligation and a written certification requirement upon departure?
• Is the employee receiving independent consideration beyond continued employment if signing after the first day of work?
• Have you checked the law of every state where your employees work, including remote employees, to confirm the agreement is compliant?
• Does the remedies clause expressly authorize injunctive relief and acknowledge that monetary damages are inadequate?

A well-drafted employee confidentiality provision is one of the most valuable legal documents a small business can hold — and one of the easiest to get wrong. The good news is that "well-drafted" does not require fifty pages or three rounds of outside counsel review. It requires being specific about what you are protecting, honest about what employees are legally allowed to discuss, and current on a legal landscape that has shifted considerably since 2022. Use an employment-specific template as your baseline, layer in your business-specific protections, and verify that the governing law for each state where you have employees is consistent with what you are asking them to sign. The cost of getting this right before anyone signs is a fraction of what it costs to discover — the morning after your best employee joins your biggest competitor — that your agreement would not survive its first hearing.

Article reviewed by: Maya S. (Attorney)