Limitation Period: Breach of Confidentiality Claims

Breach of confidentiality claims arise when a person or organisation discloses, uses, or mishandles confidential information without lawful authority. These claims commonly occur in employment disputes, commercial relationships, medical confidentiality, and data handling contexts. In England and Wales, such claims are subject to statutory limitation periods, which determine the time limit within which court proceedings must be issued.

The applicable limitation period depends on how the claim is framed legally, typically as breach of contract, breach of equitable duty of confidence, or misuse of private information. Identifying the correct classification is essential because it directly affects the time limit for bringing a claim.

Legal Basis for Breach of Confidentiality Claims

Breach of confidentiality is not a single statutory cause of action. It usually arises under one or more of the following legal bases:

Breach of contract

Confidentiality clauses in employment contracts, commercial agreements, or non-disclosure agreements create contractual obligations. Breach gives rise to a contractual claim.

Equitable breach of confidence

Courts in equity recognise a standalone duty of confidence where:

• Information has the necessary quality of confidence
• It was disclosed in circumstances importing an obligation of confidence
• There was unauthorised use or disclosure

Misuse of private information

This modern tort protects privacy rights, particularly under Article 8 of the European Convention on Human Rights, as incorporated by the Human Rights Act 1998.

Limitation Periods Applicable to Confidentiality Claims

1. Contractual breach (most common in commercial and employment contexts)

Where confidentiality obligations arise from a contract, the Limitation Act 1980 applies. The limitation period is:

• 6 years from the date of breach
  (Limitation Act 1980, section 5)

The time starts when the breach occurs, not when the claimant discovers it, unless specific exceptions apply.

2. Tort-based claims (including misuse of private information)

If the claim is framed as a tort, such as misuse of private information, the general limitation rule applies:

• 6 years from the date the cause of action accrued
  (Limitation Act 1980, section 2)

In privacy-related cases, this is usually the date of disclosure or publication.

3. Equitable breach of confidence

Breach of confidence is historically an equitable claim. However, courts generally apply limitation periods by analogy to comparable causes of action:

• Commonly treated as 6 years, aligned with tort or contract principles

There is no standalone limitation period in statute specifically for equitable breach of confidence. Instead, courts determine the appropriate period based on the substance of the claim.

4. Claims involving fraud, concealment, or deliberate hiding of breach

Where confidentiality has been deliberately concealed, the limitation period may be extended:

• Under section 32 of the Limitation Act 1980, time does not begin to run until the claimant discovers (or could reasonably have discovered) the breach

This is particularly relevant where confidential information is unlawfully disclosed in a concealed manner, such as covert data leaks or hidden misuse of commercial secrets.

5. Human Rights Act claims (public authorities only)

Where the defendant is a public authority and the claim is brought under the Human Rights Act 1998 (for example, unlawful disclosure of personal data by a public body):

• 1 year limitation period applies
• The court may extend this if it considers it equitable

This is significantly shorter than the general civil limitation period.

When the Limitation Period Starts

The starting point depends on the legal classification:

• Contract: date of breach
• Tort: date of disclosure or damage
• Misuse of private information: date of publication or communication
• Fraud/concealment: date of discovery (if section 32 applies)

In most confidentiality disputes, the clock begins at the moment information is first improperly disclosed or used.

Continuing Breaches and Ongoing Disclosure

Confidentiality breaches can be:

• Single acts (e.g., one disclosure email)
• Continuous breaches (e.g., ongoing publication or repeated use of confidential material)

In continuous breach cases, each act of disclosure may trigger a separate limitation period. This can extend the practical timeframe for bringing a claim, but older disclosures may still become time-barred.

Practical Legal Process

1. Identifying the cause of action

A claimant must determine whether the claim is contractual, equitable, or privacy-based.

2. Establishing the breach date

Evidence is required to identify when disclosure or misuse occurred.

3. Checking limitation expiry

If more than 6 years (or 1 year for HRA claims) has passed, the claim may be statute-barred.

4. Considering exceptions

Potential extensions may apply under:

• Fraud or concealment (section 32)
• Continuing breaches
• Disability or lack of capacity (limited circumstances)

5. Issuing proceedings

A claim is only “brought” when issued at court, not when letters before action are sent. This is critical for limitation compliance.

Relevant courts include the High Court of Justice and County Court of England and Wales, depending on claim value and complexity.

Risks of Missing the Limitation Period

If the limitation period expires:

• The defendant gains a complete legal defence
• The court will usually dismiss the claim
• Settlement leverage is significantly reduced
• Evidence may become harder to obtain over time

Limitation rules are strictly applied and rarely waived outside statutory exceptions.

Common Situations Involving Confidentiality Limitation Issues

• Former employees disclosing trade secrets after leaving employment
• Data breaches involving customer or client information
• Misuse of confidential commercial documents in business disputes
• Publication of private information by media or individuals
• Internal leaks within organisations

Each scenario requires careful classification to determine the correct limitation rule.

Key Takeaways

Breach of confidentiality claims in England and Wales are generally subject to a 6-year limitation period, most commonly under contract or tort principles. The period usually begins at the point of disclosure or breach. Exceptions exist where fraud or concealment is involved, which can delay the start of the limitation period. Claims against public authorities under the Human Rights Act typically have a 1-year limit. Correctly identifying the legal basis of the claim is essential to determining whether proceedings can still be brought.