Policy Register
Every policy type · People

Confidentiality and non-disclosure agreement

The standard confidentiality terms staff, contractors and visitors sign, what they cover and how long they last.

How the register reads it

Also calledNDA, confidentiality undertaking
FamilyPeople
Document typeRecord. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Folds intoThe regimes accept it folded into the hr security policy (joiners, movers, leavers); when neither is listed, the gap is counted once, under the parent.
Expected ownerLegal or the compliance officer.
Review cadenceAnnual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list whennever on its own: the register recognises it and names the clauses, but no ticked regime lists it as a separate document (its parent, hr security policy (joiners, movers, leavers), is).
TemplateNo template yet. The clauses below say what the document is expected to contain.

Which standards require it, and what each expects it to contain

2 requiring clauses, 2 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 6.6 Confidentiality or non-disclosure agreements

Identify, document, review and sign NDAs that reflect the organization's protection needs.

What the ISO 27002 guidance expects the document to say: Requires confidentiality or non-disclosure agreements matching the organisation's need to protect information to be identified, documented, reviewed on a regular basis and signed by personnel and by other relevant parties.

Evidence an auditor accepts: The confidentiality or non disclosure agreements in use, and the assessment showing they reflect the organisation's protection needs; signed agreements for personnel and for third parties with access, held and retrievable; evidence of regular review of the agreement terms and of who is covered
Common gap: NDAs not refreshed when data classification changes
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

ISO/IEC 27701:2025

ISO 27701 A.3.18 Confidentiality or non-disclosure agreements

Individuals operating under the organization's control with access to PII shall be subject to a confidentiality obligation, the agreement, whether part of a contract or separate, specifying the length of time the obligation lasts; when the organization is a PII processor, the confidentiality agreement in whatever form between the organization, its employees and its agents shall ensure they comply with the policy and procedures on data handling and protection.

Evidence an auditor accepts: Confidentiality clauses or agreements covering everyone with access to PII, with duration stated; evidence agents and contractors are bound as well as employees; processor agreements binding staff to the data handling policy
Common gap: Confidentiality obligation that ends at termination when the PII obligation does not
Source: ISO/IEC 27701:2025

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Clear desk and clear screen policy · Disciplinary process