Confidentiality agreement with a consultant: what should it contain?

When you hire an external consultant, freelancer or adviser, they typically get access to knowledge your business does not want spread further, customer data, business strategies, price lists, technical solutions or internal processes. A confidentiality agreement (NDA) is the primary way to protect this knowledge.

But a consultant is not an employee, and that gives rise to some special considerations you should know.

Note: This guide is for information. Individual situations may require individual legal advice.

Why is a separate NDA important with consultants?

For employees there is a degree of protection of confidential information through the employment contract and the duty of loyalty. For consultants and freelancers these do not apply automatically, they are self-employed with their own interests and their own customers.

An external consultant can:

• Work for competitors on other assignments
• Pass on information (deliberately or inadvertently) to other customers
• Use your knowledge to improve their own systems or position themselves in the market

Without a written NDA you have limited legal protection, apart from the protection given by the Marketing Practices Act and the Trade Secrets Act (lov om forretningshemmeligheder, 2018).

What is the Trade Secrets Act?

The Trade Secrets Act (which implements EU Directive 2016/943) already protects certain types of confidential business information, provided that:

• The information is secret (not generally known or publicly available)
• The business has taken reasonable measures to keep it secret
• The information has commercial value precisely because it is secret

An NDA documents precisely that you actively keep the information secret, and this strengthens your protection under the Act.

What must a consultant NDA contain?

1. The parties

Describe clearly:

• The business's full name and CVR number
• The consultant's full name (or company name and CVR number for a company)

Many consultants operate through companies. The agreement should ideally apply to both, the company and the individual consultant.

2. Definition of confidential information

A precise definition is crucial. Typical categories:

• Business strategy and business plans
• Customer lists and customer information
• Price structure and contracts
• Technical specifications and source code
• Internal processes and procedures
• Accounts and financial information
• Employee information

It is normal to add a catch-all clause: "... as well as any other information marked as confidential, or which from the context naturally should be treated as confidential."

3. What is not confidential?

The agreement should explicitly exclude information the consultant cannot be bound by:

• Information that is already publicly available
• Information the consultant knew before the collaboration started
• Information the consultant receives independently from a third party
• Information the consultant is legally obliged to disclose (for example to authorities)

These exceptions are standardised and reasonable, they protect the consultant against unreasonably broad obligations.

4. The consultant's obligations

Specifically, the consultant must undertake to:

• Not disclose confidential information to third parties
• Not use the information for purposes other than the agreed assignment
• Only give access to the information to employees or subcontractors who need access, and only against a corresponding confidentiality obligation
• Return or destroy confidential information at the end of the agreement

5. Duration

The agreement should state:

The duration of the agreement: typically the collaboration period plus a period afterwards.

The duration of the confidentiality obligation: how long is the consultant bound? Typically 2 to 5 years after the collaboration ends. For especially sensitive information (for example key technology or actual trade secrets), a longer or unlimited duration can be considered, but a very long commitment can be hard to enforce in practice.

6. Consequences of a breach

The agreement should describe:

• The right to claim damages for documented losses
• A contractual penalty (a fixed amount on breach that does not require proof of a loss), this is strong and should be considered
• The right to seek an injunction on an imminent or ongoing breach

A contractual penalty is especially useful, because it is hard to document exactly what a breach of confidentiality has cost.

7. Ownership of the information

It is important to make clear that all confidential information, and any material based on it, belongs to the business and never to the consultant.

Unilateral vs. mutual NDA

Most consultant NDAs are unilateral, only the consultant is bound. This is reasonable when it is your business that shares information.

If the consultant also shares their own confidential working methods, technology or processes with you, a mutual NDA can make more sense. Here both parties bind each other.

The NDA as part of the consultancy agreement

Many choose to include the confidentiality clause in the consultancy agreement itself instead of creating a separate document. This is possible, but:

• A separate NDA is easier to see and sign independently
• It can be used across several assignments with the same consultant
• It signals that you take confidentiality seriously

When should the NDA be signed?

Ideally before the consultant receives any confidential information at all, that is, typically before the first meeting or briefing. An NDA signed after the information is shared is still valid going forward, but does not protect the already shared information as strongly.

Many businesses use an NDA as a fixed part of their onboarding for all external partners.

Does the NDA apply to the consultant's subcontractors?

Not automatically. The agreement only binds the consultant, not their assistants or subcontractors. Insert a clause that obliges the consultant to ensure that any subcontractors are bound by corresponding confidentiality obligations.

GDPR and the consultant's access to personal data

If the consultant processes personal data on your behalf (for example customer registers, employee data, patient information), you as the data controller are obliged to enter into a data processing agreement with the consultant, in addition to the NDA. The two documents cover different things:

• NDA: protects trade secrets and confidential information generally
• Data processing agreement: governs the processing of personal data under GDPR

Create a confidentiality agreement with LegalDock

With LegalDock you can quickly create a confidentiality agreement adapted to the consultant relationship, including the most important clauses on definition, duration and the consequences of a breach.