Confidentiality or non-disclosure agreements

Plain-language summary

Working out where confidentiality or non-disclosure agreements are needed — with staff, contractors, suppliers, consultants, visitors and customers — writing them to fit what you actually need protected, getting them signed, and reviewing them as relationships and information change.

What the clause is really asking

Agreements are the legal backbone for sharing information, and this control asks you to decide which relationships need one, what each must contain, and to keep them current. A useful NDA defines the information covered, how long the obligation lasts, permitted use, ownership, what happens at the end (return or destruction), how an unauthorised disclosure must be reported, any right to audit, and the remedies. Your requirements for these agreements should be reviewed periodically and whenever circumstances change. The misunderstanding is that a signed template in a drawer is enough; auditors look at whether the terms fit the information being shared and whether you can meet the obligations you signed up to. Customer NDAs are the overlooked half: an automotive OEM's or retailer's NDA often binds you to restrict access to their drawings or data, flow obligations down to your staff and suppliers, and destroy data at project end. In South Africa, an NDA does not replace the operator agreement POPIA section 21 requires when a supplier processes personal information for you; you need both.

What auditors look for

Auditors ask for the NDA register or list of agreements in force and the templates in use, then sample a supplier with access to sensitive data, a consultant, a visitor to a restricted area and a customer NDA you signed. For each they check it is signed, current and covers what is actually being shared. For customer NDAs they pick one obligation, such as restricting drawings to named people or destroying data at project end, and ask for evidence you met it. They ask who reviews the templates and when that last happened. The hard question: which customer NDAs bind you today, and who knows what they say?

Typical evidence

NDA requirements statement or policy section; approved templates (mutual, one-way, employee, visitor); NDA register with party, scope, start date, duration and owner; signed agreements; customer NDA obligation tracker with evidence of compliance such as access lists and destruction records; periodic template review records; POPIA operator agreements filed alongside where personal information is processed.

How to comply — recommendations

List the relationships that need an agreement: staff and contractors (through the contract), suppliers with access to your information, consultants, visitors to restricted areas, and customers who share their data with you. Approve two or three templates with your lawyer and keep them in one place. Build an NDA register in the same tool as your contracts, with an owner and a review or expiry date for each entry. For every customer NDA, extract the obligations into a short tracker, assign each to a person, and check them at project close. Review the templates yearly and when the law or your business changes.

Common nonconformities

No register of NDAs, so nobody knows what is in force; suppliers and consultants given sensitive information without an agreement; templates never reviewed; customer NDA obligations unknown to the people handling the data; data not destroyed at project end as agreed; NDA used in place of a POPIA operator agreement; visitors to restricted areas not signing.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.