Client confidentiality for agency staff: what to put in writing and how to enforce it kindly

A junior designer at a branding studio is proud of a packaging concept. She posts a corner of it to her personal profile the night before the client launch. The client has not yet announced the product. A competitor's marketing manager sees it. By morning the client is on the phone to the founder, and nobody is sure whether to blame the designer, the process or the founder.

The designer meant no harm. The studio had never told her when a project becomes public. This post explains what to put in writing, how to teach it and how to respond when something slips.

An agency sees things that even the client's own staff may not: launch dates, price changes, unreleased names, campaign budgets, customer lists and raw footage. Staff also use freelancers, shared drives, chat groups and personal phones. Each is a place where a secret can leak. Your first step is to list what is confidential and where it lives.

• Client information: plans, dates, contacts, budgets and data given for a project.
• Work in progress: drafts, concepts, scripts, designs and cuts that have not been approved or released.
• Agency information: pitches, pricing, rate cards and internal processes.
• Credentials: logins to client accounts, ad platforms and social handles.
• Third party material: files and data supplied by the client's own vendors.

Two documents do different jobs. A signed agreement carries the legal terms and is drafted or reviewed by your own legal adviser. A plain staff guide explains daily habits. Staff read the guide. They sign the agreement and rarely look at it again. The confidentiality and NDA policy service helps agencies draft both in a consistent way.

Your guide should answer the questions staff really have. Can I show this in my portfolio? When? Can I use my phone to approve a post? What if a friend asks about a client? Short answers on one page work better than a chapter.

1. 1

   Map where client material lives

   List drives, chat groups, email, design tools, project boards and personal devices. Mark which are allowed for client files.

2. 2

   Define what is secret and when it stops

   Say when a project becomes public and who confirms it. For portfolio use, require approval from the account lead and the client.

3. 3

   Set simple handling rules

   Cover file naming, sharing links, passwords, screenshots, guest access and what to do on a shared computer.

4. 4

   Cover people outside the team

   Freelancers, interns and vendors should see the same rules before they receive any file. Keep a record of who has access to what.

5. 5

   Name a person to ask

   Give staff one contact for doubts, and promise that asking early is always welcome.

Why this matters to our clients and to us, in two sentences.
What counts as confidential, with five concrete examples from our work.
Where client files may be stored and shared, and where they may not.
Social media and portfolio: when work can be shown and who approves.
Working with freelancers and vendors: what they may see and how access ends.
What to do if you think something has leaked: who to tell and how fast.
Contact for questions, date of the guide and who owns it.

Walk new joiners through the guide in their first week, using a real example of a near miss from your own studio with names removed. Repeat the main points before each big launch. Remind freelancers when they start and when they finish. The branding studios overview explains why launch secrecy is such a common concern in that part of the sector.

Most breaches are errors. Treat the first response as an incident, not a trial. Find out what happened, contain it, tell the client early and fix the cause. Ask the person to describe it in their own words. Then look at the process: was the rule written, was it clear, was it trained?

A written process helps because it makes responses fair and consistent. Decide in advance what counts as minor, serious or repeated, who investigates, how the person can respond and who decides. Apply it the same way to a senior and a junior.

When someone leaves, close their access the same day, collect files from personal devices if the rules allow and remind them in writing of their continuing obligations. Check what they may say about past work. Ask the account lead to review any portfolio post they plan to make. Handle this alongside your reviews of creative staff, so that expectations about shared work are clear before anyone leaves.

Account managers and business development staff hold client contacts and pricing, so give them particular attention. The post on incentives for account managers touches on how targets can push people to share more than they should.