Confidentiality agreement template for volunteers, trustees, governors and staff

What a confidentiality agreement is, and the law that applies without one

A confidentiality agreement, sometimes called a confidentiality undertaking or statement, is the document in which a volunteer, trustee, governor or member of staff acknowledges how they will treat the organisation's confidential information, usually signed at the start of the role. It is not the commercial non-disclosure agreement (NDA) that most templates under the same name are written for: there are no parties trading confidential business information or know-how, no mutual obligations, no investors and no damages clause, and a volunteer's version should not read like one.

Three legal duties already apply to each of those people, whether or not they sign anything:

• The common law duty of confidence. NHS England Digital's guide to confidentiality in health and social care states it plainly: “Common law confidentiality is not codified in an Act of Parliament but built up from case law through individual judgments. The key principle is that information confided should not be used or disclosed further, except as originally understood by the confider, or with their subsequent permission.”
• Article 29 of the UK GDPR. Article 29 of the UK GDPR says that “any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by domestic law.” A volunteer, trustee or governor who handles personal data for the organisation is such a person.
• Section 170 of the Data Protection Act 2018. Under section 170 of the Data Protection Act 2018 it is a criminal offence for a person knowingly or recklessly to obtain or disclose personal data without the consent of the controller, to procure its disclosure to another person, or, after obtaining it, to retain it without the controller's consent. The defences include that it was necessary for preventing, investigating or detecting crime (“investigating” was added from 5 February 2026 by the Data (Use and Access) Act 2025), was required or authorised by law or a court, or was justified in the public interest.

Article 32(4) of the UK GDPR then puts a duty on the organisation itself: the controller “shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller”. A signed agreement is one of those steps, and the plainest evidence that the instructions were given. Induction and training are others.

The law does not, however, require the document itself in the sources this guide relies on. Article 28(3)(b) of the UK GDPR requires a processor's contract to ensure that “persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality”, and Article 38(5) binds a data protection officer to confidentiality “concerning the performance of his or her tasks”. Neither requires a charity, school or care provider to have its own volunteers or trustees sign anything. Neither the Charity Commission's guidance for trustees (CC3) nor its safeguarding guidance requires one, and the Department for Education's governance guides expect a code of conduct, not a separate agreement.

Is a confidentiality agreement legally binding?

Whether a confidentiality agreement is legally binding depends on who signs it. For an employee or other worker, a confidentiality clause sits in an agreement with the employer, usually the contract itself, and section 43J of the Employment Rights Act 1996 limits what it can do (section 04 below).

For a volunteer, usually not as a contract. In X v Mid Sussex Citizens Advice Bureau [2012] UKSC 59, the Supreme Court recorded that the volunteer had signed “a volunteer agreement headed: ‘This agreement is binding in honour only and is not a contract of employment or legally binding’”, and that “The Employment Tribunal concluded that no legally binding contract came into existence, and the contrary is no longer suggested.” The no-contract finding was the employment tribunal's; the Supreme Court decided a different question, about discrimination law. The volunteer agreement guide explains the wording and payments that keep a volunteer a volunteer.

So the consequence of a volunteer ignoring the undertaking is the one the organisation controls: a conversation, and if it comes to it, ending the role. The legal consequences come from the duties in section 01, which do not depend on the signature. Write the volunteer version in the same voice as the volunteer agreement – “we ask”, “please” – and leave out “you must”, “breach”, “damages” and “indemnify”, which cut against the binding-in-honour wording.

Trustees and governors sign alongside duties they already hold. The Charity Commission's The essential trustee (CC3) says “Trustees must act collectively (jointly)”, and a trustee confidentiality agreement is a way of saying what that asks of each trustee outside the meeting. For governors, the DfE's maintained schools governance guide says “Effective governing bodies create and maintain a code of conduct which is agreed by all governors” and “Breaching the code of conduct could result in the governor suspension, or in more severe cases, the removal of a governor”; the academy trust governance guide says “Effective boards create and maintain a code of conduct.” Both are non-statutory guidance, and the confidentiality section of that code can be where a governor's undertaking lives, rather than a separate document.

Whoever signs, the signature does two concrete things: it is evidence that the organisation gave the instructions Articles 29 and 32(4) are about, and it records which version the person received, and when.

A confidentiality agreement template, clause by clause

This example confidentiality agreement is illustrative. It is written for a fictional charity, Saltmarsh Family Support, whose volunteers run a weekly drop-in for parents and visit families at home. Replace the names and the bracketed details with your own, and keep its verbs: the charity asks and explains; it does not threaten. Put the version number and the date it was last reviewed at the foot.

1. About this undertaking. “This undertaking explains how we ask you to treat confidential information in your role with us. It is binding in honour only and is not a contract. The law on confidentiality and data protection applies to you whether or not you sign it; this undertaking is how we tell you what that means here.”
2. What is confidential. “Confidential information means anything you learn through your role about the families we support, including the fact that they use our service; any worry about a child's or an adult's safety; personal information about our staff and volunteers; and anything we tell you is confidential. Information that is already public, such as our leaflets and annual report, is not confidential.”
3. Using it for your role. “Please use confidential information only for your role, and share it only with people at Saltmarsh who need it for theirs. If you are not sure whether someone needs to know, ask [name] first.”
4. Where it is kept. “Please keep notes and papers about families in [the locked drawer at the centre / the system we provide], not at home or in your bag. Please do not keep photographs, notes or messages about families on your own phone or discuss them in personal group chats; use [the channel or system we provide] instead.”
5. Talking about your volunteering. “You are welcome to tell people that you volunteer with us and what the work is like. Please do not say anything, in person or online, that could identify a family or anything about their circumstances.”
6. If something goes wrong. “If confidential information is lost, sent to the wrong person or seen by someone who should not see it, please tell [name] the same day, even if it seems minor, so that we can put it right.”
7. When your role ends. “When you stop volunteering, please return any papers, keys and equipment, and delete any information about families from your own phone, email and computer. The confidentiality of what you learned continues after you leave.”
8. What this undertaking never stops. “Nothing in this undertaking stops you, or asks you to wait before, telling [name of safeguarding lead] or the police about a worry for someone's safety, reporting to the local authority or a regulator such as the Charity Commission, getting legal advice, or getting support as a victim of crime. If someone tells you something worrying, do not promise to keep it to yourself; tell them you will need to pass it on.”
9. Questions. “If you are unsure whether something is confidential, or whether you can share it, ask [name] or [deputy]. Our confidentiality policy and privacy notice explain more.”
10. Receipt. “Signed to show that you have received and read this undertaking, version [number] of [date].” The signature records receipt; it is not a promise enforceable as a contract.

Three adjustments for the other people who sign one:

• Trustees. Add board papers and discussions, until the board agrees what can be shared, and say how papers reach trustees and how they are returned or deleted when a trustee steps down, including copies in a personal email account (the trustee email retention guide covers the mailbox). Conflicts of interest belong in the conflict of interest policy, not here.
• Governors. For a maintained school, base the board-business clause on what the governing body may withhold from its published minutes under regulation 15(3) (section 05), name the designated safeguarding lead in clause 8, and consider placing the whole undertaking in the governors' code of conduct.
• Staff. In a member of staff's contract the clause is a contract term, so drop “binding in honour only”, keep clause 8 and widen it to protected disclosures (section 04), and take legal advice before using a confidentiality clause in a settlement agreement. In a care provider, the same clauses cover residents' and service users' information; the Caldicott principles and when to share sit in the confidentiality policy.

Clause 8 is the one most templates leave out, and the next section explains why it belongs in every version.

What a confidentiality agreement cannot stop

In England and Wales a confidentiality agreement cannot stop a victim of crime reporting it to the police, and nowhere in the UK can it stop a worker making a protected disclosure: a clause that tries is void so far as it does. For schools, statutory safeguarding guidance makes the same point about sharing information to keep children safe.

• Victims of crime (England and Wales). Section 17 of the Victims and Prisoners Act 2024 says: “A provision in an agreement is void in so far as it purports to preclude the making of a disclosure falling within subsection (2).” Those disclosures are by a victim, or a person who reasonably believes they are one, about the criminal conduct, to: anyone with law enforcement functions; a qualified lawyer, for legal advice; an individual entitled to practise a regulated profession, for professional support; a victim support service; a regulator of a regulated profession; the Criminal Injuries Compensation Authority, and a court or tribunal in a dispute about its decisions (both added from 12 December 2025 by the Victims and Prisoners Act 2024 (Permitted Disclosures) Regulations 2025, S.I. 2025/1303); a person authorised to receive information for any of those; or their child, parent or partner, for support. It does not protect a disclosure “made for the primary purpose of releasing the information into the public domain”. It applies to a provision in any agreement, not only an employment contract, and has been in force since 1 October 2025 (S.I. 2025/616).
• Workers (the whole UK). Section 43J of the Employment Rights Act 1996 says: “Any provision in an agreement to which this section applies is void in so far as it purports to preclude the worker from making a protected disclosure.” It applies to “any agreement between a worker and his employer (whether a worker's contract or not)”, and article 67J of the Employment Rights (Northern Ireland) Order 1996 is in the same terms. In Great Britain, since 6 April 2026, a disclosure “that sexual harassment has occurred, is occurring or is likely to occur” can qualify for protection (Employment Rights Act 2025, section 23), provided the worker reasonably believes it is in the public interest. The protection covers workers, not volunteers without a contract; the whistleblowing policy guide explains who is protected.
• Safeguarding children (schools in England). Keeping children safe in education 2026, in force from 1 September 2026, says at paragraph 63: “Data protection laws do not prevent the sharing of information for the purposes of keeping children safe and promoting their welfare. If in any doubt about sharing information, staff should speak to the designated safeguarding lead (or a deputy). Fears about sharing information must not be allowed to stand in the way of the need to safeguard and promote the welfare of children.” In Part five, on child-on-child sexual harassment and sexual violence, paragraph 559 adds: “Staff should never promise confidentiality when receiving a report”. A school's undertaking that says otherwise contradicts the guidance its staff and volunteers are trained on. Care providers' sharing rules under the Care Act guidance are in the confidentiality policy guide.

Two wider rules have been enacted but are not yet in force. Section 24 of the Employment Rights Act 2025 inserts a new section 202A into the 1996 Act, making void any provision between an employer and a worker “in so far as it purports to preclude the worker from making– (a) an allegation of, or a disclosure of information relating to, relevant harassment or discrimination”, or about the employer's response to it. At 1 November 2026 only the power to make regulations under it has been commenced, so that rule does not yet apply. And section 6 of the Victims and Courts Act 2026 would replace section 17 with a wider rule covering any allegation or disclosure of the criminal conduct, subject to excepted agreements set by regulations, but it has no commencement date. Both reach an allegation or disclosure to anyone, not only to the people clause 8 names, so when either comes into force, check clauses 3, 5 and 8 against the final text and any regulations made under it.

Trustees and governors: board confidentiality, and the record to keep

For a maintained school in England, the law itself sets out what a governing body may keep confidential. Regulation 15 of the School Governance (Roles, Procedures and Allowances) (England) Regulations 2013 requires the governing body to make its agendas, signed minutes and papers available for inspection “as soon as reasonably practicable”, but it “may exclude from any item required to be made available in pursuance of paragraph (2) any material relating to– (a) a named person who works, or who it is proposed should work, at the school; (b) a named pupil at, or candidate for admission to, the school; or (c) any other matter that, by reason of its nature, the governing body is satisfied should remain confidential.” That list is a sound basis for the board-business clause in a governor confidentiality agreement. It reaches people only proposed to work at the school and candidates for admission as well as current staff and pupils, and it leaves the rest of the minutes open to inspection.

For charity trustees the guidance is broader. CC3 reminds them that “Some laws apply to all charities, such as equality, data protection and copyright law”, and the Charity Commission's safeguarding guidance for charities and trustees asks charities to “be as open and transparent as possible, so that you build the charity's reputation for acting with integrity while protecting confidentiality appropriately”. A trustee undertaking that names what the board treats as confidential – named individuals, safeguarding matters and the items the board marks confidential – serves that better than one that covers everything.

The record to keep, for every volunteer, trustee, governor or member of staff who signs:

• the version of the agreement, or of the code of conduct that contains it, and the date it was signed;
• each re-issue after a revision, with the date and what changed;
• on leaving, the date papers, keys and devices were returned or papers securely destroyed, whether the person confirmed deleting copies from their own phone and email, and who checked;
• where it sits: with the person's volunteer, trustee or governor record, for as long as the organisation keeps that record. No source sets a separate retention period for a signed confidentiality agreement; the volunteer records guide and the data retention policy guide cover the record itself.

Revise and re-issue the agreement when what it describes changes, not on a calendar: a new system for papers, a group chat closed or opened, a change in who the safeguarding lead is. The trustee resignation guide covers the rest of a trustee's departure.

The clause nobody can check: return or delete when you leave

Clause 7 is the one an organisation is least able to see kept. What a volunteer, trustee or governor holds at the end of a role is rarely a folder. It is a screenshot of a referral forwarded to a volunteers' group chat, a board WhatsApp group in which a safeguarding item was discussed between meetings, a governor's personal email holding the papers for a staffing panel. When the person leaves, the undertaking asks them to delete it, and section 170(1)(c) of the Data Protection Act 2018 makes knowingly or recklessly keeping personal data without the controller's consent an offence – but the organisation has no way to know whether the deletion happened, and no copy of its own of what was said.

ComplyChat provides channels for those conversations, run by the organisation rather than on each person's own account. Everyone added to a channel is told that it is on the record, and a mobile number verified by SMS is the identity, so volunteers, trustees and governors with no work account can be in the same channel as staff. On paid plans, removing a leaver from the organisation signs them out and removes their passkeys, and the conversation stays with the organisation. Messages are recorded on the server as they are sent, and on paid plans, once the organisation's Microsoft 365 tenant is connected, conversations are kept there, under the retention schedules it already runs within its own Microsoft 365 subscription.

ComplyChat does not stop anyone taking a screenshot or repeating what they have read, and it is no substitute for the undertaking, or for the trust it rests on. What it changes is where the conversation lives when someone leaves.

A question for the next board meeting: when your last volunteer, trustee or governor left, where were the messages about the people you serve, and who has them now?

Questions people ask

What should a confidentiality agreement include?

For a volunteer, trustee or governor: what counts as confidential and what does not, that information is used only for the role and shared on a need-to-know basis, where it may be kept (including personal phones and group chats), what to do if something goes wrong, what happens when the role ends, and – just as important – what it never stops: safeguarding reports, reports to the police or a regulator and, for staff, protected disclosures. Article 29 of the UK GDPR already requires anyone acting under the organisation's authority to process personal data only on its instructions; the agreement is where those instructions are written down.

Is a confidentiality agreement legally binding for a volunteer?

Usually not as a contract. In X v Mid Sussex Citizens Advice Bureau [2012] UKSC 59 the employment tribunal found that no legally binding contract existed for a volunteer who had signed an agreement headed “binding in honour only”, and that finding was not challenged in the Supreme Court. The volunteer is still bound by the common law duty of confidence and by the section 170 Data Protection Act 2018 offence of knowingly or recklessly obtaining, disclosing or retaining personal data without the controller's consent, whatever they signed.

How do you write a simple confidentiality agreement?

Write a short list of plain clauses: what is confidential and what is not, using it only for the role, where it is kept, what to do if something goes wrong, what happens when the role ends, what the agreement never stops, who to ask, and a receipt line with the version and date – the template in section 03 is one example. You can draft your own volunteer, trustee or governor undertaking: none of the legislation this guide cites prescribes a form for one. Take legal advice before using a confidentiality clause in an employment contract or settlement agreement, because section 43J of the Employment Rights Act 1996, and article 67J of the Employment Rights (Northern Ireland) Order 1996, make void any clause between a worker and employer so far as it tries to stop a protected disclosure.

Can a confidentiality agreement stop someone reporting abuse or whistleblowing?

Not a victim of crime or a worker: a clause is void so far as it tries. In England and Wales a clause is void so far as it stops a victim of crime disclosing to the police, a lawyer, a regulated professional, a victim support service, a professional regulator, the Criminal Injuries Compensation Authority, or their child, parent or partner for support (Victims and Prisoners Act 2024 section 17, in force 1 October 2025), and any clause between a worker and employer is void so far as it stops a protected disclosure (Employment Rights Act 1996 section 43J; article 67J in Northern Ireland). For a volunteer reporting abuse of someone else, neither statute applies, but an undertaking worded as binding in honour only is usually not a contract to enforce, and section 170(2) of the Data Protection Act 2018 is a defence where the disclosure was necessary for preventing, investigating or detecting crime or justified in the public interest. For schools, KCSIE 2026 paragraph 63 says “Fears about sharing information must not be allowed to stand in the way of the need to safeguard and promote the welfare of children”.

Do trustees and governors need to sign a confidentiality agreement?

Not by law. Neither the Charity Commission's CC3 nor its safeguarding guidance requires trustees to sign one. For governors, the DfE's governance guides expect a code of conduct agreed by all governors, which is non-statutory guidance; its confidentiality section can do the same job as a separate agreement.

What are examples of confidential information in a charity, school or care home?

Personal information about the people the organisation serves and their families, safeguarding concerns, staff and volunteer personal information, and board business the board decides should remain confidential. For a maintained school governing body in England, regulation 15(3) of the School Governance (Roles, Procedures and Allowances) (England) Regulations 2013 allows it to withhold from the minutes and papers it makes available material about a named person who works, or is proposed to work, at the school, a named pupil or candidate for admission, and any other matter it is satisfied should remain confidential.

Official guidance and your next step

The primary sources are on legislation.gov.uk: Articles 28, 29, 32 and 38 of the UK GDPR, section 170 of the Data Protection Act 2018, section 43J of the Employment Rights Act 1996, article 67J of the Employment Rights (Northern Ireland) Order 1996, sections 23 and 24 of the Employment Rights Act 2025, section 17 of the Victims and Prisoners Act 2024 with its commencement regulations S.I. 2025/616 and the Permitted Disclosures Regulations 2025 (S.I. 2025/1303), section 6 of the Victims and Courts Act 2026 and regulation 15 of the 2013 school governance regulations. The Supreme Court's judgment in X v Mid Sussex Citizens Advice Bureau [2012] UKSC 59 is on Find Case Law, and NHS England Digital publishes its guide to confidentiality in health and social care. The Charity Commission's CC3 and safeguarding guidance for charities and trustees, the DfE's maintained schools governance guide and academy trust governance guide, and Keeping children safe in education 2026 (PDF) are on GOV.UK. Quotations are from those pages as published on 1 November 2026.

This guide is a summary for charities, schools and care providers, mainly in England and Wales, not legal advice about a particular agreement, contract or settlement. Section 17 of the Victims and Prisoners Act 2024 extends to England and Wales and regulation 15 to maintained schools in England; the protected-disclosure rule applies across the UK. The confidentiality policy guide covers the organisation's own rules and when confidentiality can lawfully be broken.

Then do one thing: take the confidentiality agreement your volunteers, trustees or governors signed last and check three clauses. Does it say what it never stops? Does it say where information may be kept, including phones and group chats? And when someone last left, did anyone record that their papers came back? If the volunteer version says “legally binding” or threatens legal action, rewrite it in the voice of the volunteer agreement.