Confidentiality agreement review: four federal limits we check

Most companies treat the confidentiality agreement as the easy document. It's two pages, everybody signs it, and the template has lived in the shared drive longer than anyone can remember.

We don't read it that way. Four pieces of federal law can reach an NDA (nondisclosure agreement, the everyday name for the same document), and each one either takes something away from an over-broad clause or attaches a cost to a missing sentence.

What follows is how we think about a confidentiality clause before it goes out: one sorting question, then four checks, each tied to a federal statute or rule you can read for yourself. Because the sources are federal, they work the same way for an employer in Oklahoma as for one in Texas. State law also governs whether a particular clause is enforceable, and that's a separate subject we're leaving outside this article.

Sort the agreement by who's signing it

Identical boilerplate lands in different legal positions depending on who's across the table. So before we read a word of the clause, we put the agreement in one of these piles:

• A worker. An employee, or someone doing the work as a contractor or consultant. The first three checks are the ones we run.
• Your customer, on your standard terms. Check four is written for this pile, and it expressly excludes the first one.
• Another company in a negotiated deal. A sale or a joint venture, say. This pile sits furthest from the four limits, though the immunity in check one still belongs to the individuals on the other side who end up holding your information.

The sorting matters because these statutes are written around relationships, not document titles.

Check one: the immunity notice in a confidentiality agreement

A trade secret, in the federal definition, is information that has economic value because it isn't generally known and that its owner has taken reasonable measures to keep secret. Federal law lets the owner sue when one is misappropriated (roughly, acquired by improper means, or disclosed or used without consent in circumstances the statute lists), provided the secret relates to a product or service used in, or intended for use in, interstate or foreign commerce. That claim sits at 18 U.S.C. § 1836(b).

The Defend Trade Secrets Act of 2016, Public Law 114-153, approved May 11, 2016, wrote a whistleblower immunity into § 1833(b) and told employers to disclose it. Plenty of the templates we see either predate that paragraph or carry only half of it.

What the immunity covers

An individual can't be held criminally or civilly liable under any federal or state trade secret law for disclosing a trade secret in two settings. One is a disclosure made in confidence to a government official, or to an attorney, solely for the purpose of reporting or investigating a suspected violation of law. The other is a complaint or other document filed in a lawsuit or other proceeding, if the filing is made under seal.

That's tight. "In confidence" and "solely for the purpose" are both conditions, and the list of recipients stops at officials and attorneys. A reporter isn't on it, and neither is a competitor.

There's a companion rule for retaliation suits. Someone who sues an employer for retaliation over reporting a suspected violation may disclose the trade secret to their own attorney and use it in the case, so long as any document containing it is filed under seal and it isn't disclosed except under a court order.

Because the text reaches state trade secret law as well as federal, the immunity matters even to an Oklahoma or Texas company that never expects to see the inside of a federal courthouse.

What the employer has to say

The statute says an employer "shall provide notice of the immunity" in any contract or agreement with an employee that governs the use of a trade secret or other confidential information. The alternative is a cross-reference to a policy document, provided to the employee, that sets out the employer's reporting policy for a suspected violation of law.

Two words in that sentence do more work than they seem to. "Any," as we read it, means the duty isn't confined to the document titled NDA; an offer letter or a separation agreement with a confidentiality section governs confidential information too. And "employee" is defined for this purpose to include any individual performing work as a contractor or consultant for an employer.

That second word is the one we see missed most. The employee agreement picked up the notice paragraph at some point. The contractor template, drafted by someone else for a different purpose, never did.

What a missing notice costs

Here's the part owners often get backward. Nothing in the notice paragraph says that leaving the notice out voids the agreement.

The consequence the statute does state is narrower, and it can be more expensive than it sounds. An employer that doesn't comply "may not be awarded exemplary damages or attorney fees" under the federal civil remedy in an action against an employee to whom notice was not provided.

Those two remedies change the math. Exemplary damages are an extra award on top of actual loss, and § 1836(b) allows up to 2 times the damages awarded when a trade secret is willfully and maliciously misappropriated. The same willful-and-malicious finding is one of the grounds on which a court may award reasonable attorney's fees to the prevailing party.

A trade secret case against one former salesperson or engineer is rarely about collecting a large compensatory number from that person. Often the realistic recovery is a court order plus the prospect of shifting fees, and without the fee-shifting the same case can cost more to bring than it returns.

In our experience the gap doesn't show up at signing. It shows up later, when the lawyer drafting the complaint pulls the signed agreement to plead the fee claim and the paragraph isn't there.

One limit on our own point: the penalty is written against the federal remedies. What a state-law claim allows is a separate question.

The word "updated"

The notice paragraph applies to contracts and agreements "entered into or updated after" the date of enactment. That sentence doesn't say what counts as an update.

So an early date on the signature page isn't much comfort. As we read it, an agreement signed before May 11, 2016 and amended afterward at least raises the question, and we'd sooner add the paragraph than litigate the word.

What the immunity doesn't do

None of this is a license to walk out with files. The subsection says it doesn't authorize acts that are otherwise prohibited by law, and its own example is the unlawful access of material by unauthorized means.

The federal claim has limits that run the other direction as well. An injunction (a court order to do or stop doing something) under § 1836(b) can't prevent a person from entering into an employment relationship, and any conditions placed on that employment have to rest on evidence of threatened misappropriation, not merely on the information the person knows.

Put differently, the federal claim protects information; on that text, it isn't written as a route to an order barring someone from the next job. We've covered that separate problem in what happens when a key employee leaves and takes customers along.

Check two: a definition that swallows a report to a regulator

Read the definitions section of almost any NDA and you'll find something like "all non-public information concerning the Company." Then read the operative promise: the signer won't disclose that information "to any third party."

A government agency is a third party. Taken literally, the clause forbids the very report the first check protects.

One Securities and Exchange Commission rule addresses the problem head-on. Rule 21F-17(a), at 17 CFR 240.21F-17, says no person may take any action to impede an individual from communicating directly with Commission staff about a possible securities law violation, "including enforcing, or threatening to enforce, a confidentiality agreement" with respect to those communications.

The exception inside the rule is slim. It covers agreements dealing with information tied to the legal representation of a client, such as information obtained through an attorney-client privileged communication.

Owners of closely held companies sometimes assume this one is for the stock-exchange crowd. The rule's text begins "No person," and, as we read paragraph (a), nothing in it limits the rule to companies with publicly traded shares. How the Commission applies the rule is beyond what we've read for this article.

Our usual drafting answer handles the regulator problem in one short paragraph: nothing in the agreement prohibits the signer from reporting a possible violation of law to a government agency. In our view it gives up nothing the company was entitled to keep.

That carve-out and the immunity notice are different sentences doing different jobs. One removes a restriction; the other tells the signer about a statutory protection, and it's the one § 1833(b) asks for by name. We look for both.

Check three: a non-disparagement promise made before any dispute

A non-disparagement clause is a promise not to make negative statements about the other party. Plenty of onboarding packets carry one right beside the confidentiality section, and it gets about as much attention.

The Speak Out Act, Public Law 117-224, approved December 7, 2022, limits what a court will do with those clauses in one category of dispute. Under 42 U.S.C. § 19403, with respect to a sexual assault dispute or sexual harassment dispute, no nondisclosure clause or nondisparagement clause agreed to before the dispute arises is judicially enforceable in instances in which the conduct is alleged to have violated federal, tribal or state law.

Timing is the hinge. The sentence is aimed at clauses agreed to before the dispute arises, which describes the boilerplate signed on the first day of work far better than terms negotiated once a dispute exists.

Scope is wider than many employers expect. The Act's definitions speak of a provision in "a contract or agreement," without confining themselves to employment paperwork.

Age doesn't shelter a template, either. The Act applies to a claim filed on or after its date of enactment, which, as we read it, keys on when the claim is filed and not on when the clause was signed.

What the Act leaves alone is just as plain. It states that nothing in it prohibits an employer and an employee from protecting trade secrets or proprietary information. It also lets a state enforce its own law on these clauses where that law is at least as protective of an individual's right to speak freely.

So the ordinary work of a confidentiality clause survives. What a pre-dispute clause can't count on is a court enforcing it in the disputes the Act describes.

Check four: customer forms that reach reviews

This one belongs to the second pile: the standard service agreement or online terms of sale that a customer gets with no real chance to change.

The Consumer Review Fairness Act, enacted December 14, 2016 as Public Law 114-258 and found at 15 U.S.C. § 45b, covers a "form contract." That's a contract with standardized terms, used by a person in the course of selling or leasing goods or services, and imposed on an individual without a meaningful opportunity to negotiate those terms.

In a form contract, a provision is void from the inception of the contract if it prohibits or restricts the individual's ability to give a review or similar assessment of the seller, or if it imposes a penalty or fee for doing so. A further category voids provisions that transfer intellectual property rights in the review, other than a non-exclusive license to use it.

Offering a form contract with one of those provisions is itself unlawful under the statute. Enforcement is assigned to the Federal Trade Commission, with a violation treated as a violation of a rule defining an unfair or deceptive act or practice, and to state attorneys general.

The link to confidentiality drafting is one overreaching sentence: "Customer agrees to keep all aspects of its dealings with Company confidential." Between two companies that negotiated their deal, that may be unremarkable. In standard terms imposed on an individual customer, it can operate as a restriction on reviews.

Congress drew the boundaries with legitimate confidentiality in mind. Employer-employee and independent contractor contracts aren't form contracts under the definition at all. The voiding rule doesn't apply to the extent a provision bars disclosure of trade secrets or of commercial or financial information considered privileged or confidential, and the statute expressly preserves both duties of confidentiality imposed by law and civil claims for defamation.

When the template was last opened

Three of the four sources are statutes with enactment dates, two in 2016 and one in 2022. A form drafted earlier and never reopened was written without them. So the last thing we ask about any template is its age, and the usual answer is "nobody knows."

We think of a confidentiality clause as a fence, and of these four limits as the gates the law requires you to leave in it. The fence is still yours.

That's worth saying plainly, because none of the four makes a confidentiality agreement unenforceable. Recall that the federal definition of a trade secret turns on reasonable measures to keep the information secret, and a signed agreement is often part of how a company shows it took them. Apart from the immunity itself, the federal statute also leaves other trade secret remedies in place.

Whether the fence holds is then a question of state contract law and proof, the subject of our piece on what it really takes to enforce a contract in Oklahoma. A confidentiality template is a contract question until someone leaves. After that it's a dispute question, and the missing paragraph gets priced in dollars.

If you're about to send out a confidentiality agreement, or you've inherited one that hasn't been reopened in years, that's a sensible moment to have it read against these limits. You can reach us through the contact page or at our Oklahoma City office. A review before the form goes out is almost always cheaper than finding the gap in the middle of a dispute.

This article is general information about Oklahoma, Texas, and federal law, not legal advice, and it does not create an attorney-client relationship. Facts matter; talk to a lawyer about yours.