Codification and expansion of the rules limiting confidentiality provisions in Non-Disclosure Agreements for victims of crime

The Government has announced that it will be codifying and expanding the rules limiting the application of confidentiality provisions in Non-Disclosure Agreements (“NDAs”) to victims of crime, in order to give the latter greater protections. 

Section 17 of the Victims and Prisoners Act 2024 will come into force on 1 October 2025, and will clarify that confidentiality clauses are unenforceable to the extent that they preclude the disclosure of information by a victim of crime to law enforcement, regulators, lawyers, regulated professionals, victim support services and/or family, for the purposes of reporting criminal conduct (or cooperating in an investigation) or seeking advice or support in relation to it.  The primary exception to this rule, will be in relation to disclosures which are made for the primary purpose of releasing the information in question into the public domain.

The Government has also published detailed guidance outlining how section 17 will be implemented.

We explore the upcoming changes in more detail, below.

What are NDAs and why are these provisions significant?

NDAs are legal contracts which require confidentiality regarding sensitive information shared between the parties, in exchange for something of value (typically money). They can be stand-alone agreements, or clauses within larger agreements (such as Settlement Agreements, which are commonly used in an employment context).

NDAs (or Settlement Agreements) are often used in an employment context – either at the start of someone’s employment, to protect the employer’s commercial information, or at the end, to keep the details of any dispute and/or the circumstances of the employee’s exit confidential.

Changes to the rules governing NDAs will therefore be relevant for employers and employees alike, particularly in circumstances where allegations of harassment, sexual misconduct, and discrimination have been raised, and those allegations are capable of amounting to a criminal offence or regulatory breach.

What is the current position on confidentiality clauses?

There are already legal protections in place to ensure that individuals can report crimes to the police, report breaches to regulators, and/or disclose information for the purposes of “whistleblowing” at work. However, these protections do not extend to a broader support network.  There is therefore, currently, scope for individuals to be penalised if they share such information with victim support services or close family members – key individuals who it might otherwise be assumed are acceptable to speak with in confidence in such circumstances.

By way of example, if an employee has signed an NDA (or Settlement Agreement) following an incident at work, in respect of which they reasonably believe they have suffered harm as a result of being subjected to criminal conduct, and the NDA does not include a carve out allowing them to share their experience with their partner or a victim support service, their employer could seek to enforce the confidentiality clause against them to prevent them from, or penalise them for, doing so.

In practice, many NDAs do already include carve outs to allow for such disclosures, for example to immediate family or counsellors. These have been introduced largely as a result of the shifting tide in the wake of the “Me Too” movement, regulatory obligations on the legal professionals drafting them, and evolving best practice.  In particular, the Solicitor’s Regulatory Authority published a “Warning Notice” in 2018, which expressly stated that lawyers would be in breach of their professional obligations if they allowed “improper use” of NDAs by restricting an individual’s ability to report offences to law enforcement, regulators, professional advisers (including medical professionals and counsellors) and/or blow the whistle.  However, practices here still vary, and are not necessarily consistent across the board.

How is this changing?

The new statutory provisions in Section 17, coming into force in October 2025, will put key existing confidentiality exemptions on a statutory footing (thus strengthening them) whilst also expanding them slightly. 

In relation to existing exemptions; Section 17 expressly states that confidentiality provisions in NDAs will not be enforceable to the extent that they preclude victims of crime from disclosing information to law enforcement, regulators, lawyers and regulated professionals, for the purposes of reporting criminal conduct (or cooperating in an investigation) or seeking legal advice in relation to it.

In relation to expanded exemptions; Section 17 also expressly prevents confidentiality provisions in NDAs from being enforceable in the circumstances outlined above, where the information is shared with certain close family members (including children, parents or partners), and/or any individual who provides a service to support victims, in order to obtain support in relation to the criminal conduct in question.

Victims do not have to have reported the criminal conduct in question to the police, and there does not need to have been a formal investigation or conviction, in order for these provisions to apply.

Why is this changing?

These changes come as a result of the Government’s promise in 2019 to introduce legislation to clarify and ensure that NDAs cannot prevent individuals from making disclosures to the police, regulated health and care professionals or legal professionals. Section 17 of the Victims and Prisoners Act 2024 is more limited than the 2019 proposal however, in that it only applies to victims of criminal conduct

Reflections

Though the new legislative provisions will undoubtedly help to clarify and strengthen the protections given to victims of crime going forward, they will not be retroactive, meaning that people who have signed confidentiality agreements or NDAs before 1 October 2025 will not necessarily be protected to the same extent.

There also remains a level of complexity in relation to making disclosures to close family.  Victims may disclose information to their partner (defined as the person to whom they are married, with whom they are in a civil partnership or with whom they are in an intimate personal relationship which is of significant duration) as well as their children and/or parents. However, the government guidance notes that other family members or close friends are not included.  This means that victims of crime may still be in breach of their NDAs if they tell siblings or intimate but platonic friends about criminal conduct that they have been subjected to.

The upcoming changes, outlined above, reflect the ongoing direction of travel when it comes to confidentiality clauses and NDAs.  They will hopefully provide some welcome clarity to employers and their workforces, reinforcing that such arrangements cannot be used to prevent individuals who have been subjected to criminal conduct from sharing their experiences with some of the people who might best support them.

Employers who use confidentiality clauses, NDAs and/or Settlement Agreements should carefully consider their enforceability on a case-by-case basis, and should ensure, with the assistance of their legal advisers, that any confidentiality provisions are reasonable and justifiable to use in the circumstances.

If your organisation needs further advice on any of the issues outlined in this article, please get in touch and our team of experienced Employment Lawyers would be happy to help.