Employee Confidentiality Agreement

An Employee Confidentiality Agreement in the United States obliges the receiving party to keep the disclosing party's proprietary information secret. It restricts disclosure and use of designated confidential information between the disclosing and receiving parties.

The primary federal legal framework for trade secret protection is the Defend Trade Secrets Act of 2016 (DTSA), codified at 18 U.S.C. § 1836. The DTSA created a federal civil cause of action for trade secret misappropriation, allowing employers to file suit in federal district court and seek injunctive relief, damages, exemplary damages (up to two times actual damages for willful misappropriation), and attorney's fees. Before the DTSA, trade secret protection was exclusively a matter of state law under statutes modeled on the Uniform Trade Secrets Act (UTSA), adopted in some form by 48 states. Both the DTSA and state UTSA statutes define a trade secret as information that derives independent economic value from being secret and is subject to reasonable measures to maintain its secrecy.

A critical DTSA requirement that distinguishes employee confidentiality agreements from general NDAs is the mandatory whistleblower immunity notice under 18 U.S.C. § 1833(b). Every confidentiality agreement signed on or after May 11, 2016, must notify the employee that they cannot be held liable under any federal or state trade secret law for disclosing a trade secret to a government official or an attorney for the purpose of reporting a suspected legal violation, or in a court filing made under seal. Employers who fail to include this immunity notice lose the right to seek exemplary damages and attorney's fees in any DTSA civil action against that employee.

At the state level, California presents the most significant departure from the general rule. Under California Business and Professions Code Section 16600, every contract restraining a person from engaging in a lawful profession, trade, or business of any kind is void — a rule that California courts have applied to both non-compete agreements and overly broad confidentiality clauses that effectively prevent an employee from working in their field. California courts do protect trade secrets under the California Uniform Trade Secrets Act (CUTSA, Cal. Civ. Code § 3426 et seq.), but any confidentiality clause that goes beyond protecting genuine trade secrets risks invalidation.

The Employee Confidentiality Agreement differs from a standalone NDA in that it is specifically tailored to the employment relationship. It addresses the implied duty of fidelity that employees owe during employment — reinforcing and extending that duty by contract — and creates explicit post-employment obligations. Courts across the United States have consistently enforced reasonable post-employment confidentiality obligations that are directed at genuine trade secrets, distinguishing them from non-compete agreements that restrict the employee's right to work. A confidentiality agreement that is integrated into an employment contract or a Confidential Information and Invention Assignment Agreement (CIIA or PIIA) provides the most complete protection for the employer's intellectual property.

US employers need an Employee Confidentiality Agreement whenever employees have access to information that gives the business a competitive advantage and that would be harmful if disclosed to competitors, clients, or the public.

Technology and software companies need confidentiality agreements for engineers, product managers, and business development staff who work with source code, algorithms, product roadmaps, and customer technical data. In the software industry, trade secrets often represent the company's core competitive value, and the Defend Trade Secrets Act of 2016 provides a federal civil action for misappropriation.

Healthcare employers need confidentiality agreements for employees who access patient records, clinical trial data, and proprietary treatment protocols. HIPAA (45 C.F.R. Parts 160 and 164) requires covered entities and business associates to implement safeguards for protected health information, and a confidentiality agreement supports the workforce training and sanction policy requirements under the HIPAA Security Rule.

Financial services firms — broker-dealers, investment advisers, hedge funds, and banks — need confidentiality agreements for employees who handle proprietary trading strategies, client portfolios, and non-public financial information. The SEC and FINRA have enforcement authority over misuse of material non-public information, and confidentiality agreements support compliance programs.

Manufacturing and life sciences employers use confidentiality agreements to protect formulas, manufacturing processes, research and development data, and pre-patent inventions. For inventions conceived or developed by employees during their employment, a confidentiality agreement is typically paired with an invention assignment clause to confirm that the employer owns the intellectual property.

Professional services firms — law firms, accounting firms, management consultants, and marketing agencies — need confidentiality agreements for staff who have access to client information, client lists, pricing strategies, and competitive intelligence. Client list protection is one of the most litigated areas of trade secret law, with courts in states including New York, Texas, and Illinois generally protecting client lists from disclosure by former employees.

Small businesses and startups often rely on confidentiality agreements as their primary mechanism for protecting business plans, investor presentations, financial projections, and customer relationships before formal IP registrations are in place. The agreement should be signed at the start of employment, before any confidential information is disclosed.

A well-drafted Employee Confidentiality Agreement for US employment must contain several essential provisions to protect the employer's interests and withstand judicial scrutiny.

The definition of confidential information is the most critical provision in the agreement. The definition should be broad enough to cover all genuinely sensitive business information — including trade secrets as defined under the DTSA (18 U.S.C. § 1839(3)), technical data, business strategies, customer and supplier lists, pricing information, financial data, marketing plans, and personnel information — while being specific enough to put the employee on notice of what is protected. Overly broad definitions that purport to make all information confidential risk being found unenforceable in states like California and Massachusetts.

The DTSA whistleblower immunity notice required by 18 U.S.C. § 1833(b) must appear in the agreement or in a cross-referenced whistleblower policy. The notice must state that the employee will not be held criminally or civilly liable under federal or state trade secret law for disclosing a trade secret to a government official or attorney in connection with reporting a suspected law violation, or in a court filing under seal. Omitting this notice forfeits the employer's right to exemplary damages and attorney's fees under the DTSA.

The employee's confidentiality obligations must specify what the employee must do: keep confidential information secret; use it only for the employer's business purposes; not disclose it to any third party without written authorization; exercise at least the same degree of care used to protect the employee's own confidential information (but no less than reasonable care); and limit access to coworkers with a need to know.

The post-employment obligations clause is one of the most critical provisions. For information that qualifies as a trade secret, the confidentiality obligation should survive indefinitely — as long as the information retains its trade secret status. For other confidential information, a time-limited post-employment obligation (typically two to five years) is appropriate and more defensible. Courts in Texas, New York, and Florida regularly enforce reasonable post-employment confidentiality obligations directed at genuine trade secrets.

The return-of-materials clause requires the employee to return all physical and electronic copies of confidential information on termination or demand, and to certify in writing that no copies have been retained. With remote work now common, the clause should address personal devices, cloud storage accounts, and email forwarding.

The invention assignment clause, often included in the same agreement, assigns to the employer all inventions, discoveries, and work product conceived or developed by the employee during employment that relate to the employer's business or result from the employee's work. California Labor Code Section 2870 and similar statutes in Delaware, Illinois, Minnesota, North Carolina, and Washington limit the scope of mandatory invention assignment — the employer cannot claim ownership of inventions developed on the employee's own time without using employer resources and unrelated to the employer's business.

The remedies clause should acknowledge that a breach may cause irreparable harm not fully compensable by monetary damages, and that the employer is entitled to seek injunctive relief from the appropriate US district court or state court of competent jurisdiction under the DTSA or applicable state law without posting bond. This acknowledgment facilitates the grant of a temporary restraining order or preliminary injunction.

The governing law and dispute resolution clause should specify the state whose law governs and, ideally, a forum selection clause identifying the venue for disputes. For multi-state employers, the choice of governing law can significantly affect enforceability — New York, Delaware, and Texas law are generally favorable to employers; California law is significantly more employee-protective.