Confidentiality and non-disclosure policy: classification, sharing and AI tools

A sales manager pastes a customer's renewal quote and its pricing grid into a public chatbot to get a tidier email. The text leaves the company's control in one click. Nobody broke a rule, because the company never wrote one. A confidentiality policy exists to turn that sort of moment into a known, decided thing.

This guide covers what the policy should say, what the company must decide, and how the work runs. It belongs with the other policies in the HR policies and governance set, and pairs with the data privacy and security guide, which deals with personal data in more depth.

Define confidential information broadly enough to catch real harm and narrowly enough to be enforceable. Typical groups are pricing and margins, the customer list and lead database, source code and design files, product roadmaps, financial results, supplier terms, and personal details of staff. Also name what is not confidential: information already public, or what a person knew before joining.

• Public: cleared for anyone, such as published blog posts and the brochure.
• Internal: ordinary working material, shared inside the company but not outside, such as meeting notes and process documents.
• Confidential: damaging if leaked, such as quotes, contracts, customer data and source code.
• Restricted: limited to named people, such as salary records, investigation files and encryption keys.

Four labels are enough. More than that and nobody uses them. Decide who assigns a label, where it appears (the document footer, the folder name or a tag in the drive) and what happens to unlabelled files. A sensible default is Internal until someone labels it otherwise.

Access follows need to know. The owner of a system or folder approves each request, and HR reviews staff access when a person changes team. Decide who the approver is for each category, and keep a record of approvals in an access authorisation log.

Sharing with outsiders needs its own rule. Will a non-disclosure agreement be signed before every vendor demo, or only for Confidential material? Who signs it for the company? Which template is the standard, and who may change its terms? Keep a register of signed agreements with the party, date, purpose and expiry or review date.

Personal devices and storage are a recurring weak point. Decide whether work files may sit on personal phones, whether personal cloud drives and chat apps are banned for Confidential material, and what the company can do to remove data from a device. The IT and internet usage policy holds the device rules; this policy should point to it.

State plainly what may be put into an AI tool. One workable position: Public and Internal material may go into company-approved tools; Confidential and Restricted material may not go into any tool unless IT has approved it, with a contract that covers retention and training use. Name the approved tools, who approves new ones, and how a prompt containing customer data is reported. Review the list each quarter, since tools change quickly.

1. 1

   Report at once

   Any person who sees or causes a disclosure tells their manager and the named incident contact the same day. A reporting mailbox is shown in the policy.

2. 2

   Contain

   IT revokes shared links, resets credentials and asks the recipient, in writing, to delete the material.

3. 3

   Assess

   The incident owner decides what was disclosed, to whom, and whether customers or the regulator must be told, with advice from a qualified professional.

4. 4

   Investigate

   A small restricted team reviews logs and statements. The file is held under confidential case handling and not in the general ticket queue.

5. 5

   Remedy and learn

   The company decides on corrective action under the disciplinary policy, fixes the control that failed and records the lesson.

Obligations apply during and after employment. The appointment letter and a signed undertaking should say so. On exit, the leaver returns or securely deletes company material and confirms in writing, as in the exit process. Decide how long a post-employment obligation runs for different categories, and have the wording checked, since enforceability depends on the terms.

State that breaches can lead to disciplinary action and, where justified, legal steps. Keep the NDA register, access log, incident register and signed undertakings. Review the policy every year and after any incident that exposed a gap.

Title, ID and owner: HR-POL-011, [role].
Aim: protect information belonging to the company, its customers and its staff.
Reach: [staff, contractors, interns, board advisers].
Terms: confidential information, need to know, third party, AI tool.
Labels: Public, Internal, Confidential, Restricted, assigned by [role].
Sharing: with outsiders only under NDA [template ref] signed by [role].
AI tools: approved list at [location]; Confidential material only with [role] approval.
Devices: no Confidential files on [personal storage].
Leaks: report to [mailbox] within [number] hours.
After employment: obligations continue for [duration set with advice].
Records: NDA register, access log, incident register.
Version and review: v[number], [date], yearly.
Acknowledgement: name, date, version, signature.

If you need the policy and the NDA template drafted together, describe your setup in the requirements form, and read the order in which to write all 30 policies.