Employers' Duty to Maintain Confidentiality

Maintaining confidentiality in the workplace is a fundamental legal and professional obligation for employers in England and Wales. Employers must protect sensitive information - including business data and employees' personal details - to comply with legal duties, uphold trust, and minimise the risk of claims in employment tribunals, civil courts, or data protection enforcement actions. This article explains those duties in clear, accessible terms, setting out how confidentiality arises, what employers must do, and how to manage risks.

What Confidentiality Means in Employment

Confidentiality refers to the duty to keep certain information private and not disclose it without lawful authority. In an employment context, confidentiality responsibilities arise from contractual terms, common law, statutory obligations such as data protection law, and professional or ethical standards. Breaching confidentiality can have legal consequences, including compensation claims, injunctions, or enforcement action under data protection law.

Confidential information may include:

• Personal data relating to employees, clients or customers;
• Commercially sensitive business information such as pricing, marketing plans or trade secrets; and
• Information disclosed in confidence by another party.

Legal Basis for Confidentiality Duties

1. Common Law Duty of Confidence

Under UK common law, a duty of confidence arises when information is shared in circumstances where it is reasonable to expect confidentiality. Employers and employees typically owe each other such duties where confidential information is disclosed in the course of work. A breach of this duty can lead to legal action for damages or injunctions to protect confidential information.

2. Contractual Obligations

Employment contracts often include express confidentiality clauses that specify what information is confidential, how it must be protected, and the consequences of unauthorised disclosure. These clauses reinforce implied duties and can extend confidentiality obligations beyond the period of employment. Without express clauses, a general duty of fidelity and good faith still imposes confidentiality obligations, but only to protect genuine trade secrets or confidential information.

3. Data Protection Law

When confidentiality involves personal data about employees or third parties, employers must comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. These laws require employers to process personal data lawfully, securely and transparently, and only for specified purposes. Employers must implement appropriate security measures to protect this data.

Key Employer Duties in Practice

Identify and Classify Confidential Information

Employers should first identify what information is confidential. Not all workplace information is confidential; public knowledge and trivial details are usually not protected. Typical categories for protection include:

• Trade secrets and commercially valuable data.
• Employee personal information such as health or disciplinary records.
• Client or customer data and contractual information.

Putting clear definitions in policies or contracts helps employees understand what must be protected.

Incorporate Confidentiality into Contracts and Policies

Employment contracts should include clear and enforceable confidentiality provisions that:

• Define what counts as confidential information.
• Require employees not to disclose or misuse such information.
• Specify the period during which confidentiality must be maintained, including after employment ends (where appropriate).

Contracts without such clauses rely on implied duties that may be weaker and harder to enforce. Post‑termination obligations are more effective when set out expressly.

Comply With Data Protection Requirements

When dealing with employee personal data - such as contact details, payroll information or health records - employers must follow data protection rules. This includes:

• Processing personal data lawfully and transparently.
• Limiting access to authorised personnel only.
• Implementing appropriate security measures (e.g., secure storage, encryption, access controls).
• Providing privacy information to employees explaining how their data will be used and protected.

Treating personal data confidentiality and security as a priority supports both data protection compliance and confidentiality duties.

Train Staff and Communicate Expectations

Confidentiality is a practical responsibility that requires awareness and training. Employers should:

• Provide training for employees on handling confidential information.
• Explain which types of information are sensitive and how they should be protected.
• Update training when processes or information types change.

A culture of confidentiality supports compliance and reduces accidental breaches.

Establish Clear Internal Policies

Beyond contracts, employers should develop internal confidentiality and data protection policies that:

• Set out procedures for storing, sharing and disposing of confidential information.
• Address secure handling of documents and electronic data.
• Explain how to report suspected breaches.

Policies should be easily accessible and integrated into onboarding and regular communications.

Respond Promptly to Breaches

When a confidentiality breach occurs, employers must respond promptly and proportionately:

• Investigate the circumstances objectively.
• Take disciplinary action if appropriate.
• Assess any wider risks to the organisation or individuals affected.
• Review and revise policies to prevent future breaches.

Employers should also consider legal advice, as serious breaches involving trade secrets or personal data may require injunctive relief or regulatory reporting.

Exceptions and Limitations

Confidentiality duties are not absolute. There are lawful exceptions, including:

• Disclosures required by law, such as responding to a court order.
• Whistleblowing disclosures protected under the Public Interest Disclosure Act 1998, allowing employees to report wrongdoing in the public interest without losing protection for breach of confidentiality.
• Consent by the individual whose information is disclosed.

Employers must balance confidentiality obligations with employees' rights and statutory duties.

Risks and Consequences of Failing to Protect Confidentiality

Failing to maintain confidentiality can result in:

• Employment tribunal or civil claims for breach of contract or breach of confidence.
• Regulatory enforcement under data protection law, including fines and corrective notices.
• Compensation claims where individuals suffer loss due to the improper disclosure of their personal data.
• Reputational harm and loss of trust with employees, clients or partners.

Taking proactive steps to protect confidential information helps reduce these risks.

Common Questions

Can confidentiality obligations continue after employment ends?
Yes. Express contractual terms can create post‑employment confidentiality obligations lasting a specified period, and common law or statutory protections may apply to trade secrets even after employment ends.

Can an employer prevent all disclosures?
Not all information can be restricted. Employers cannot use confidentiality clauses to prevent lawful whistleblowing, reporting crime, or disclosures required by law. After 1 October 2025, confidentiality clauses that prevent disclosures by crime victims to specified persons will be unenforceable to that extent.

Key Takeaways

Employers have a clear duty to maintain confidentiality in the workplace, grounded in common law, contractual terms and statutory obligations. Protecting confidential information - including personal data and commercially sensitive material - requires clear contracts, robust internal policies, training, secure handling and prompt responses to breaches. Employers must also respect lawful exceptions such as whistleblowing rights and data protection obligations. Where employers take reasonable and proportionate steps to protect confidentiality, they reduce legal risks, protect business interests and foster trust with employees and stakeholders.