Silence Has Limits: Drafting Confidentiality Clauses Around Protected Disclosures in 2026

A legitimate tool with a statutory boundary

Confidentiality clauses serve a proper commercial purpose. They protect trade secrets, sensitive negotiations and personal information. Non-disparagement clauses can likewise support an orderly exit or settlement. The difficulty arises when those clauses are drafted so broadly that they appear to prevent a worker from raising a concern with a regulator, a prescribed person or, in some circumstances, the employer itself. Under the Public Interest Disclosure Act 1998, protected disclosures occupy a statutory space that private drafting cannot close.

The legal position is not new, but it is easily overlooked in template agreements. Section 43J of the Employment Rights Act 1996 renders void any contractual provision that purports to preclude a worker from making a protected disclosure. That applies to settlement agreements as much as to standard employment contracts. A clause that says the worker must not disclose any information about the company, or must not make derogatory remarks, may be read as an attempt to do precisely what the statute prohibits. The clause may be unenforceable in that respect, but the damage can already have been done: a worker may be deterred from reporting wrongdoing, and the employer may face regulatory and reputational consequences.

Where the drafting goes wrong

Most problems arise from overreach rather than from any deliberate attempt to gag a whistleblower. A confidentiality clause may define confidential information so widely that it captures information about suspected misconduct. A non-disparagement clause may prohibit any statement that could damage the company's reputation, without distinguishing between malicious comments and a regulatory disclosure. An investigation clause may require the worker to keep the fact of an investigation confidential and to direct all enquiries to the company, which can read as a prohibition on contacting a regulator.

Notification requirements are a particular trap. A clause that requires the worker to obtain consent before making a disclosure, or to notify the company before contacting a prescribed person, is likely to conflict with the statutory protection. So is a clause that requires the worker to use an internal reporting channel as the only route. Internal channels are valuable, but they should not be drafted as an exclusive gatekeeper. Regulators expect workers to be able to raise concerns without fear of detriment, and they do not generally regard an internal line as the only permissible destination.

Commercial contracts can raise similar issues. A consultancy agreement, agency arrangement or supplier terms may include confidentiality obligations that apply to individuals who are workers for PIDA purposes. Even where the counterparty is a company rather than an individual, a clause that prohibits cooperation with a regulator or the reporting of suspected offences may be unenforceable, or at least inconsistent with public policy and regulatory expectations. The safe approach is to assume that any confidentiality clause might one day be read by a worker, a regulator or a tribunal.

What regulators expect

Regulated firms should also consider the expectations of their supervisors. In the financial services sector, whistleblowing rules require appropriate internal arrangements, protection for whistleblowers and board-level oversight. Professional regulators similarly expect firms to maintain effective speak-up arrangements. Those expectations do not mean that every concern must be routed internally. They mean that workers should have clear, accessible channels and should not be penalised for using them, or for going to a prescribed person where the law permits.

When a worker raises a concern, the focus should be on handling it consistently rather than on enforcing silence. That means recording the disclosure, assessing whether it falls within PIDA, protecting the worker from detriment and keeping the investigation confidential on a need-to-know basis. Confidentiality around the investigation is legitimate. Confidentiality that prevents the disclosure of the underlying wrongdoing is not.

Drafting points for 2026

First, include an express, non-exclusive carve-out. The clause should state, in plain terms, that nothing in the agreement prevents the worker from making a protected disclosure, cooperating with a regulator or prescribed person, or exercising any statutory right. It should also make clear that no prior consent or notification is required. Relying on an implied carve-out is risky; an express one is clearer for workers and easier for the employer to defend.

Second, define confidential information narrowly. Carve out information that is already public, information the worker is required to disclose by law, and information that concerns wrongdoing or a regulatory breach. Avoid definitions that capture everything the worker has seen or heard during the engagement.

Third, separate non-disparagement from whistleblowing. A clause that prohibits derogatory statements should expressly exclude protected disclosures and communications with regulators. It should not prohibit a worker from making a good-faith report simply because the report is critical of the company.

Fourth, remove permission and notification requirements. A worker should not have to ask before contacting a prescribed person. An employer can encourage internal reporting first, but it should not make that a condition of protection.

Fifth, review settlement agreements carefully. Settlement agreements often contain detailed confidentiality and non-disparagement provisions. They should include the statutory carve-out and should not include warranties that the worker has not made, or will not make, a protected disclosure. Independent legal advice remains essential, and the wording should be clear enough for the worker to understand what is and is not restricted.

Sixth, train those who use the templates. HR teams, line managers and in-house counsel should understand that a confidentiality clause is not a substitute for a speak-up culture. A clause that is technically unenforceable may still deter a worker from reporting a serious issue.

A review worth doing now

Confidentiality clauses are not going away, and they should not. The objective is to make them precise. A clause that protects genuine confidential information while preserving protected disclosures is more defensible, more consistent with regulatory expectations and less likely to become the subject of a tribunal claim or a supervisory conversation. In 2026, that is not merely good practice. It is the minimum standard for any organisation that expects its confidentiality regime to be taken seriously.

This article is general commentary and does not constitute legal advice.