Confidentiality in a consultancy agreement

A consultant sees a business from the inside, and the confidentiality clause is what governs what they may do with what they have seen, during the engagement and after it. The law protects trade secrets and information shared in confidence without a clause, but it does so uncertainly and after the event; the clause defines the information, states the obligations and the exceptions, lasts as long as the information matters, and sits alongside the data protection terms that personal data needs. This page explains the law and the drafting. I draft consultancy and contractor agreements for a fixed fee of £595, delivered in five working days.

Who this is for

Businesses in England and Wales engaging consultants and contractors who will see their clients, pricing, plans, systems and data, and consultants who want to know what they may use and what they may not.

What matters in the confidentiality clause

What the law protects without a clause and why a clause is still needed

Information that has the necessary quality of confidence and was imparted in circumstances importing an obligation of confidence is protected by the law of confidence without any contract, and trade secrets have additional protection under the Trade Secrets (Enforcement, etc.) Regulations 2018; but the law's protection depends on proving those elements after the breach, and a clause that defines the information, states the obligations and sets the period removes the argument. A clause also allows the business to show a buyer or an investor that its contractors were bound, which the general law does not.

Defining confidential information

The clause should define confidential information by category (business and financial information, client and supplier information, pricing, plans, products in development, systems, software, data, know-how, the terms of the engagement) and by marking or circumstance, so that the consultant knows what is covered without the business having to label everything; it should cover information in any form, information derived from it, and information about the business's clients, which the business may itself hold under confidentiality obligations it must flow down.

The obligations and the exceptions

The consultant should be required to use the information only for the engagement, to keep it secure, to disclose it only to those who need it for the engagement and are bound by equivalent obligations, not to copy it beyond what the engagement needs, and to tell the business of any unauthorised use; the exceptions should cover information that is or becomes public without breach, information the consultant already had or receives independently, and disclosure required by law or a regulator, with notice to the business where lawful. The clause should also preserve the consultant's right to make protected disclosures under Part IVA of the Employment Rights Act 1996 where it applies and should not purport to prevent reporting to regulators.

Personal data and the processor terms

Confidentiality is not data protection: where the consultant processes personal data on the business's behalf, Article 28 of the UK GDPR requires a written contract containing specified terms (instructions, confidentiality of personnel, security, sub-processors, assistance, deletion, audit), and the confidentiality clause should sit alongside a data processing schedule containing them rather than be relied on in its place; where the consultant determines the purposes of processing (a consultant keeping their own records of advice), they are a controller with their own obligations, and the agreement should say which applies.

Confidentiality after the engagement

Trade secrets should be protected for as long as they remain secret, and other confidential information for a stated period after the engagement (a few years, reflecting how long the information retains value), with the clause saying that the obligations survive termination; a clause that ends with the engagement protects the business only while the consultant is being paid. The consultant's general skills, knowledge and experience are not confidential information and the clause should say so, because a clause that purports to cover them is a restraint of trade and may fail.

Remedies, return of information and enforcement

The clause should require the consultant to return or destroy the business's information and materials on ending the engagement and to certify it, subject to retention required by law or the consultant's professional obligations, and should record that damages may not be an adequate remedy so that the business can seek an injunction; where the consultant is a company, the individual should give the undertakings too. Enforcement in practice is about evidence (what was disclosed, when and to whom), and the business's own practices (access controls, marking, logs) are what make the clause worth having.

What it costs

Consultancy or contractor agreement, £595. Drafted for your business. Five working days.

Template set for repeat use, £895. One master agreement plus a short-form schedule you can reuse for every engagement. Five working days.

Buying online forms the engagement on payment. The scope is what the consultancy and contractor agreements page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A clear, express assignment of intellectual property to your business
• Confidentiality provisions that protect your business information
• Restrictive covenants drafted at a scope a court will uphold
• Clear treatment of status, so the arrangement is not accidentally something else
• Payment, deliverables and termination provisions that match how you work
• A reusable structure, so the next engagement costs you nothing

What is not included

• Employment status determinations and off-payroll working assessments, which need your accountant
• Tax advice
• Disputes with a contractor you have already engaged
• Immigration and right to work compliance

Questions I am often asked

Does a consultant owe confidentiality without a clause?

They do, under the law of confidence, for information that is confidential and was shared in confidence. The clause defines the information, sets the obligations and the period and removes the argument about what was protected.

Can we stop a consultant using what they learned with us for other clients?

Confidential information, yes; general skills, knowledge and experience, no. The clause draws that line, because a clause covering the consultant's experience is a restraint of trade and may fail.

Is a confidentiality clause enough for personal data?

It is not. Personal data processed on the business's behalf needs the processor terms the UK GDPR requires, in a data processing schedule. The confidentiality clause covers the rest.

Related guidance and services

• Consultancy and contractor agreements, £595, the service this page describes
• Contract review, £495
• Employment contracts and handbooks, £595
• Intellectual property in a consultancy agreement
• One-way NDA for a freelancer or contractor

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.