A board confidentiality agreement is a contract between a director and the organization they serve that defines what boardroom information must stay private, how long that obligation lasts, and what happens if it’s broken. Both for-profit corporations and nonprofits use these agreements to turn a director’s general duty of loyalty into specific, enforceable terms. A well-drafted agreement protects the organization’s sensitive information and protects the director by making the boundaries clear.
What the Agreement Covers
These agreements apply to information that isn’t publicly available and could harm the organization if it got out. Categories vary, but most agreements reach the same core material:
- Internal financial data: projections, cash flow forecasts, audit findings, and budget details that go beyond public filings.
- Strategic plans: expansion targets, market analyses, planned acquisitions, and competitive positioning.
- Merger and acquisition activity: deal terms, due diligence findings, target identities, and negotiation strategies. Organizations handling active M&A often add access controls on top of the base agreement, restricting which directors can see certain documents.
- Personnel matters: executive compensation, performance evaluations, disciplinary actions, and internal investigations.
- Intellectual property: unpatented trade secrets, proprietary processes, and product development pipelines.
- Board deliberations: how individual directors voted, what arguments were raised, and the substance of executive sessions. Keeping this private is what lets directors disagree candidly.
The agreement draws a line between internal information and anything already public, such as press releases, annual reports, or regulatory filings. That line defines what the director has to respect.
Required Whistleblower and Legal Carveouts
This is the area organizations most often get wrong, and the exposure is serious. A board confidentiality agreement cannot stop a director from reporting potential legal violations to government regulators, and several federal provisions override any contractual language that tries to.
SEC Rule 21F-17
Under SEC Rule 21F-17, no person or organization can take any action to prevent someone from communicating directly with SEC staff about a possible securities law violation, including enforcing or threatening to enforce a confidentiality agreement.1eCFR. 17 CFR 240.21F-17 – Staff Communications With Individuals Reporting Possible Securities Law Violations The rule covers directors as much as employees. An agreement that lacks a clear carveout for SEC communications, or that requires the director to notify the organization first, violates the rule on its face.
The SEC has not been subtle about enforcement. The agency has brought dozens of actions against companies whose confidentiality or separation agreements restricted whistleblower communications, with civil penalties ranging from $19,500 to $18 million in individual cases.2U.S. Securities and Exchange Commission. Whistleblower Protections These enforcement actions accelerated in 2023 and 2024. Any agreement drafted today should include an explicit statement that nothing in it restricts the director’s right to communicate with government agencies.
Defend Trade Secrets Act Notice
Federal law also requires a specific disclosure in any agreement that governs trade secrets or confidential information. Under 18 U.S.C. § 1833(b), an individual cannot be held criminally or civilly liable under any federal or state trade secret law for disclosing a trade secret to a government official or attorney solely to report or investigate a suspected legal violation, or for including a trade secret in a sealed court filing.3Office of the Law Revision Counsel. 18 USC 1833 – Exceptions to Prohibitions
The notice must appear in the agreement itself, or the agreement must cross-reference a policy document that describes reporting procedures. Skipping the notice carries a practical penalty: the organization forfeits the right to recover enhanced damages or attorney fees if it later sues the director for trade secret misappropriation.3Office of the Law Revision Counsel. 18 USC 1833 – Exceptions to Prohibitions The statute defines “employee” broadly enough to cover contractors and consultants, and many courts apply it to directors as well.
Anti-Retaliation
Federal law separately criminalizes retaliation against anyone who provides truthful information to law enforcement about a possible federal offense. Under 18 U.S.C. § 1513(e), knowingly retaliating against such a person carries penalties of up to 10 years in prison.4Office of the Law Revision Counsel. 18 USC 1513 – Retaliating Against a Witness, Victim, or an Informant An organization that removes a director for reporting securities fraud to the SEC would face exposure under this provision on top of Rule 21F-17 penalties.
Subpoenas and Court Orders
A well-drafted agreement also addresses compelled disclosures. If a director receives a subpoena, a civil investigative demand, or a court order, the agreement should require prompt notice to the organization so it can seek a protective order, while allowing the director to comply if no order is obtained. An agreement that tries to prohibit disclosure even under a court order is practically unenforceable and signals poor draftsmanship.
Core Terms Every Agreement Needs
Beyond the carveouts, a usable agreement has to cover several areas with enough specificity to be enforceable. Vague drafting cuts both ways: the organization can’t prove a breach, and the director can’t tell where the line is.
- Parties. The legal names of the director and the organization. If subsidiaries or affiliates share information with the board, list them.
- Definition of confidential information. Specific categories rather than a catch-all. “All information received in your capacity as a director” sounds broad, but courts more reliably enforce agreements that identify what they protect.
- Exclusions. Information already public, information the director knew before joining the board, and information received from a third party without restrictions.
- Whistleblower and regulatory carveouts. The safe harbor language above. Omitting it exposes the organization to SEC enforcement and forfeits trade secret remedies under federal law.
- Duration and survival. How long the obligation lasts after the director leaves. There is no single standard. Some agreements set a fixed period of two to six years after departure; others impose indefinite obligations on trade secrets and time-limited obligations on other categories. Indefinite survival clauses face enforceability questions in some jurisdictions, so organizations often pair a long survival period with clear definitions of what stays protected and what eventually expires.
- Remedies for breach. What the organization can pursue, including injunctive relief, damages, and indemnification for legal costs.
Directors usually get these agreements from the corporate secretary or general counsel during onboarding. The whistleblower carveouts and the survival clause are the two provisions worth reading closely before signing. That’s where most of the real risk sits, for both sides.
What Happens If a Director Breaches It
When a director leaks protected information, the organization’s first move is usually seeking an injunction, a court order prohibiting any further disclosure while the case proceeds. Many agreements include a clause in which the director acknowledges that a breach would cause irreparable harm, which is designed to make injunctions easier to get.5U.S. Securities and Exchange Commission. Interactive Data Corporation – Confidentiality Agreement Courts still conduct their own analysis of whether the harm is truly irreparable and may deny the injunction if the damage is purely financial and calculable.
Beyond injunctions, the organization can pursue monetary damages for actual losses caused by the leak. If the disclosure affected a stock price, disrupted a pending deal, or cost the organization clients, those losses are potentially recoverable. Some agreements also include liquidated damages clauses setting a predetermined penalty, which courts enforce when the amount is a reasonable estimate of anticipated harm rather than an arbitrary punishment.
A breach of this kind almost always qualifies as removal for cause, ending the director’s service immediately. Many agreements also contain indemnification provisions requiring the director to reimburse the organization’s legal fees for enforcing the agreement. In complex litigation, those costs add up fast.
Not every breach is deliberate. A director who forwards a confidential email to the wrong recipient or discusses board business where someone overhears has still technically breached the agreement. Case law in this area is limited, and the organization’s response will depend on the circumstances, the sensitivity of the information, and the actual damage. Intent matters more for the organization’s decision about whether to sue than for whether a breach legally occurred.
Why Personal Liability Matters More Than Directors Think
Directors sometimes assume that their organization’s general liability insurance or their own D&O coverage will absorb any personal exposure from a confidentiality breach. That assumption is often wrong. D&O policies typically cover defense costs for claims tied to board service, but most exclude deliberately wrongful acts. An intentional leak would almost certainly fall outside coverage, leaving the director personally responsible for the organization’s damages and their own defense.
Nonprofit directors have some additional protections. Most nonprofit bylaws promise to indemnify directors for actions taken in their board capacity, and state volunteer protection laws shield directors from personal liability for many good-faith decisions. Those protections generally evaporate when the conduct was intentional or involved a knowing violation of law. A deliberate confidentiality breach lands squarely in that exclusion.
A board confidentiality agreement creates real personal financial exposure. Signing without reading the remedies and survival sections is a risk no insurance policy is likely to cover if something goes wrong.