Confidential Information and Trade Secrets in Australia: A Complete Legal Guide

Every business holds information it would rather competitors, ex-employees and the public never see. Customer databases, pricing models, source code, supplier terms, manufacturing methods and internal financial data, which are the assets that often matter most.  Yet they receive the least formal protection. Unlike trade marks or patents, confidential information is not registered anywhere. Its legal protection depends entirely on how the business treats it and the relationships in which it is shared.

This guide explains how confidential information and trade secrets are treated under Australian law, how that position compares with the United Kingdom and the United States, and the practical steps every business should be taking right now to keep its commercially sensitive information protected.

What Is Confidential Information?

There is no single statutory definition of confidential information in Australia, and no single test that determines whether information will attract an obligation of confidence (Ansell Rubber Co Pty Ltd v Allied Rubber Industries Pty Ltd [1967]). Instead, the courts examine a range of criteria, following the framework set out in Coco v A N Clark (Engineers) Ltd [1969].

As a starting point, confidential information generally has the following characteristics:

• It has commercial value to its holder.
• It is not obvious, trivial, or already apparent to someone reasonably skilled in the relevant field.
• It is not generally available in the public domain.

In CA, Inc. v ISI Pty Limited [2012] FCA 35 at [365], Bennett J explained:

“To be confidential, information must be capable of being given the attribute or quality of confidence; that is, it must be something which is not within the public knowledge … However, that something has been disclosed in a limited manner does not rob it of its confidentiality, even if the dissemination was via mass media or the internet. It is a question of degree in each case. The expression ‘relative secrecy’ has been used to describe this concept …”

Crucially, limited disclosure does not destroy confidentiality. The key concept is relative secrecy, not absolute secrecy.

Confidential information is also commonly defined in contracts — employment agreements, non-disclosure agreements (NDAs), shareholder agreements, sale of business agreements, software licences, and many others. Typical examples include:

• Business processes and methodologies
• Financial information and forecasts
• Customer and supplier databases
• Manufacturing methods and formulas
• Technical drawings and engineering data
• Source code and algorithms
• Pricing structures and commercial strategy
• Customer lists and prospect pipelines

The Duty of Confidence in Australia

The duty of confidence in Australia can arise from several overlapping sources:

Contract. Where parties have expressly agreed (e.g. in an NDA, employment agreement, or commercial contract) to keep information confidential, the duty is contractual.

Equity. Even without a written agreement, an equitable duty of confidence may arise from the nature of the parties’ relationship or the circumstances in which the information was communicated. The equitable jurisdiction was first applied in Australia in Moorgate Tobacco Co Ltd v Philip Morris Ltd (No 2) (1984).

Statute. Section 183 of the Corporations Act 2001 (Cth) prohibits directors, officers and employees from improperly using information obtained because of their position to gain an advantage for themselves or another person, or to cause detriment to the corporation. This duty continues after the person stops being an officer or employee.

Common law duty of good faith. Employees are subject to an implied duty of good faith, which includes a duty not to disclose confidential information to unauthorised third parties (Robb v Green [1895]).

A plaintiff may bring an action for breach of contract and breach of confidence in equity, although they will ultimately need to elect their remedy.

Is Confidential Information a Form of Intellectual Property?

A common misconception — repeated even by some lawyers — is that confidential information is a form of intellectual property. Under Australian law, it is not.

As Gummow J explained in Smith Kline & French Laboratories v Department of Community Services & Health [1990] FCA 206 at [166]:

“It seems clear enough that knowledge per se is not proprietary in character.”

The nature of registered IP rights is fundamentally public. Trade marks, patents, and designs are listed on public registers; copyright works are typically published. Confidential information, by contrast, must be held in relative secrecy to be protected at all. Treating confidential information as a form of property in your contracts is therefore conceptually wrong and can create unintended consequences — particularly in NDAs, assignment clauses and IP warranties.

What Is a Trade Secret in Australia?

This is where the Australian position diverges sharply from the United States and, to a lesser extent, the United Kingdom.

In Australia, the term “trade secret” has no statutory definition and no separate legal regime. Gowans J observed in Ansell Rubber that “an exact definition of a trade secret is not possible.” In GlaxoSmithKline v Ritchie [2008], the court acknowledged that the term is part of everyday English usage to imply a level of secrecy but does not carry independent legal meaning beyond the law of confidence.

Courts have nonetheless used the term to describe information of a particularly sensitive character. In Printers & Finishers Ltd v Holloway (No. 2) [1965], a trade secret was described as:

“…a separate part of the employee’s stock knowledge which a man of ordinary honesty and intelligence would recognise to be the property of his old employer, and not his own to do as he likes with.”

And in Del Casale v Artedomus, the New South Wales Court of Appeal observed:

“The notion of a trade secret is sometimes used to indicate whether an obligation of confidence exists.”

The practical takeaway in Australia: a “trade secret” is best understood as a description of the degree of sensitivity of certain confidential information — not as a separate cause of action. Protection still comes through the law of confidence (in contract and equity) and through the Corporations Act duties.

How Australia Compares with the United Kingdom

The United Kingdom now has a dedicated statutory regime alongside its common law of confidence: the Trade Secrets (Enforcement, etc.) Regulations 2018 (SI 2018/597), which implemented EU Directive 2016/943 and remain in force after Brexit.

Under those Regulations, a “trade secret” is defined as information that:

• is secret in the sense that it is not, as a body or in the precise configuration and assembly of its components, generally known among, or readily accessible to, persons within the circles that normally deal with the kind of information in question;
• has commercial value because it is secret; and
• has been subject to reasonable steps under the circumstances, by the person lawfully in control of the information, to keep it secret.

The UK Regulations operate in parallel with the long-established common law action for breach of confidence — they do not displace it. Where the common law gives a trade secret holder wider protection than the Regulations, the holder can rely on the common law instead. UK case law still distinguishes between “trade secrets” and “mere confidential information,” a distinction drawn in Faccenda Chicken Limited v Fowler [1986] FSR 291 that affects what obligations survive after employment ends.

How Australia Compares with the United States

The United States has the strongest statutory trade secrets regime of the three jurisdictions.

At the state level, almost every U.S. state has adopted some version of the Uniform Trade Secrets Act (UTSA), which provides a uniform definition of “trade secret” and “misappropriation” and a uniform remedies framework.

At the federal level, the Defend Trade Secrets Act of 2016 (DTSA) (18 U.S.C. § 1836) created a federal civil cause of action for trade secret misappropriation. The DTSA introduced significant remedies that are unavailable in Australia, including:

• Federal court jurisdiction (in addition to state law claims);
• Ex parte seizure of property in extraordinary circumstances to prevent dissemination of the trade secret;
• Exemplary damages of up to double the compensatory damages for wilful and malicious misappropriation;
• Attorney’s fees in cases of bad faith or wilful misappropriation;
• A three-year limitation period from discovery; and
• Whistleblower immunity provisions (which employers must reference in their employment and consulting agreements to obtain the full benefit of the DTSA’s remedies).

A Side-by-Side Comparison

For Australian businesses operating internationally — particularly those licensing technology into the US or UK — this divergence matters. An NDA drafted only for Australian conditions may leave significant remedies on the table in the US. We discuss this further in our International Technology Licensing and IP Strategy guide.

The Equitable Cause of Action for Breach of Confidence

Where there is no contract — or where a plaintiff prefers to run an equitable claim — Australian courts apply a four-element test, following the Full Federal Court’s decision in Optus Networks Pty Ltd v Telstra Corp Ltd [2010] FCAFC 21:

1. The information must be identified with specificity.
2. The information must have the necessary quality of confidence.
3. The information must have been received in circumstances importing an obligation of confidence.
4. There must be an actual or threatened misuse of the information without the confider’s consent.

(Note: in Thales Australia Limited v Madritsch KG & Anor [2022] QCA 205, Freeburn J observed that whether detriment is a strictly essential element remains an open question.)

1. The Information Must Be Identified With Specificity

The High Court’s decision in O’Brien v Komesaroff [1982] HCA 33 remains the leading authority on the need to identify confidential information precisely.

Mr Komesaroff, a solicitor, claimed confidentiality over documents containing tax minimisation strategies involving unit trusts, and alleged that O’Brien, an accountant, had used that information to benefit O’Brien’s own clients. The High Court found that:

• The contents of the trust deed and articles of association were matters of common knowledge;
• Komesaroff had not specified in his pleadings precisely which information he said was confidential; and
• Unlike technical or scientific knowledge, the kind of structuring described was difficult to commercialise as proprietary information.

Komesaroff’s confidence claim failed. The case is also a reminder of the equitable maxim that “he who comes to equity must do so with clean hands” — particularly relevant where the subject matter has an anti-social purpose, such as tax avoidance.

2. The Information Must Have the Necessary Quality of Confidence

In Wright v Gasweld Pty Ltd (1991) 22 NSWLR 317, Kirby J listed a range of factors that help determine whether information has the necessary quality of confidence, including:

• The extent to which the information is known outside the business;
• The extent to which it is known by employees and others within the business;
• The measures taken to guard secrecy;
• The value of the information to the holder and to its competitors;
• The amount of effort or money spent developing the information;
• How easily it could be properly acquired or duplicated by others;
• Whether the employee was told the information was confidential;
• Industry usages and practices;
• Whether the information is shared only with senior employees;
• The reasonableness of the holder’s belief about confidentiality; and
• Whether the information can be readily identified.

In Del Casale v Artedomus (Aust) (2007) NSWCA 172, Hodgson JA observed that the stronger these factors are in any given case, the more likely the information will be treated as a trade secret that an ex-employee cannot use or disclose.

3. The Information Must Have Been Received in Circumstances Imparting an Obligation of Confidence

This element looks at the relationship between the parties and the circumstances of disclosure. Megarry J in Coco v A N Clark (Engineers) Ltd [1969] RPC 41 explained:

“It seems to me that if the circumstances are such that any reasonable man standing in the shoes of the recipient of the information would have realised that upon reasonable grounds the information was being given to him in confidence, then this should suffice to impose upon him the equitable obligation of confidence.”

He also noted that equity will not be invoked to protect “trivial tittle-tattle, however confidential” — the subject matter must be of sufficient gravity to warrant intervention.

4. Actual or Threatened Misuse Without Consent

This element is largely self-explanatory: the plaintiff must show that the recipient has used, or is threatening to use, the information in a way the confider did not authorise.

Practical Steps to Protect Confidential Information

The single biggest mistake businesses make is treating confidentiality as a drafting issue rather than an operational one. The strongest NDA in the world will not save you if you cannot prove what the information was, that it was treated as confidential, or that the other party knew it was confidential.

Courts in Australia (echoing the “reasonable steps” requirement that now appears expressly in the UK and US regimes) look at how the holder actually behaves. Here is what every business should be doing.

1. Identify and Inventory Your Confidential Information

You cannot protect what you have not identified. Maintain a register of categories of confidential information — customer data, source code, pricing models, supplier terms, methodologies, financial information — and classify each by sensitivity (e.g. “Confidential,” “Strictly Confidential,” “Restricted”).

This register is the foundation of the Optus Networks element 1 requirement: the information must be capable of being identified with specificity if you ever need to litigate.

2. Segregate Data Access on a Need-to-Know Basis

Apply role-based access controls in your systems. Sensitive documents should sit in separate drives, folders, or secured vaults — not on shared drives accessible to the entire organisation. Sales teams generally do not need access to source code; engineers generally do not need access to commission structures.

Remove access promptly when an employee changes roles or leaves the business. A common failing in breach of confidence cases is the ex-employee whose VPN credentials were never deactivated.

3. Mark Confidential Information as “Confidential”

This sounds basic — and it is — but it remains one of the simplest and most effective steps. Documents containing confidential information should:

• Carry a clear header or footer such as “Confidential” or “Strictly Confidential — [Business Name]”;
• Have appropriate metadata in version control or document management systems; and
• Be accompanied by clear language in covering emails when sent externally.

Don’t over-label, though. If everything is marked “Confidential,” nothing is. Marking should be meaningful and tied to your sensitivity classifications.

4. Take Reasonable Steps to Secure the Information

“Reasonable steps” is the language used by Kirby J in Wright v Gasweld, by the UK Regulations, and by the DTSA in the United States. In practice it means:

• Encryption at rest and in transit for sensitive data;
• Multi-factor authentication on systems containing confidential information;
• Audit logs of access to sensitive folders;
• Physical security for any hard-copy materials;
• Clean-desk policies and secure document destruction (shredding, not bin disposal);
• Restrictions on use of personal devices and removable storage; and
• Outbound email policies and data loss prevention (DLP) tools.

These measures are increasingly relevant under Australia’s evolving privacy and data protection compliance obligations as well — particularly where personal information overlaps with commercially confidential data.

5. Use Properly Drafted NDAs and Employment Agreements

Every NDA and employment agreement should clearly:

• Define what is “confidential information” (avoid conflating it with intellectual property);
• Specify permitted purposes and authorised recipients;
• Set out obligations during and after the engagement;
• Address return and destruction of materials on termination;
• Include post-employment restraints proportionate to the role; and
• Reflect the duties already imposed by section 183 of the Corporations Act for directors and officers.

For high-value engagements with overseas counterparties — particularly in the US — consider whether the agreement should also reference the DTSA’s whistleblower immunity notice to preserve full federal remedies. We cover the Australian-side drafting essentials in our Drafting Effective Non-Disclosure Agreements in Australia article.

6. Educate Employees About Confidentiality

A duty of confidence is hard to enforce against an employee who can credibly say “no one ever told me this was confidential.” Build confidentiality into:

• Induction and onboarding (with written acknowledgements);
• Periodic refresher training, particularly for sales, product and engineering teams;
• Project-specific briefings before access to sensitive materials is granted; and
• Exit processes — including a formal confidentiality reminder, return of devices and materials, and removal of system access.

This is also the most practical way to bring the third Optus Networks element home: the more clearly your people are told that information is confidential, the easier it is to show that any recipient was on notice of that obligation.

7. Have an Incident-Response Playbook

Despite best efforts, leaks happen. Have a written plan that covers:

• Internal escalation paths (legal, IT, HR, executive sponsor);
• Preservation of evidence (system logs, devices, email);
• Cease-and-desist correspondence;
• Urgent injunctive relief where dissemination is threatened; and
• External communications — including any obligations under the Notifiable Data Breaches scheme administered by the Office of the Australian Information Commissioner.

Frequently Asked Questions

Is confidential information automatically protected in Australia?

Not automatically. Protection arises from contract, equity, or statute (such as section 183 of the Corporations Act), and only where the information has the necessary quality of confidence and has been treated as confidential. There is no register, and there is no separate “trade secrets” right.

What is the difference between confidential information and a trade secret in Australia?

There is no separate legal category of “trade secret” under Australian law. The term is used to describe confidential information that is particularly sensitive — for example, manufacturing processes, formulas or source code — but the legal protection still comes from the law of confidence and the Corporations Act, not from any standalone trade secrets statute.

Can I sue for breach of confidence without a written NDA?

Yes. The equitable cause of action for breach of confidence does not require a written agreement. You will, however, need to satisfy the four Optus Networks elements — including that the information was received in circumstances importing an obligation of confidence. A well-drafted NDA makes that much easier to prove.

How long does the duty of confidence last?

It depends on the source of the duty. Contractual obligations last for as long as the contract specifies. The equitable duty generally lasts for as long as the information retains its quality of confidence — that is, until it enters the public domain. Section 183 of the Corporations Act expressly continues to apply after a person ceases to be an officer or employee.

Does disclosure to a small group destroy confidentiality?

No. Australian law applies a standard of relative secrecy. Information disclosed under obligations of confidence to a defined group of recipients (employees, advisers, joint venture partners) can still be confidential. Even disclosure via mass media or the internet does not necessarily destroy confidentiality if the dissemination has been limited and the information has not become genuinely public.

Are customer lists confidential?

They can be, but it depends on how the business treats them. A customer list compiled from public directories may not be confidential. A list that reflects significant investment in identifying prospects, includes private information such as pricing or buying preferences, and is treated as restricted within the business is much more likely to be protected.

What remedies are available for breach of confidence in Australia?

Equitable remedies include injunctions (often the most important practical remedy), account of profits, equitable compensation, and delivery up or destruction of materials. Where there is a contract, contractual damages may also be available. Unlike the US under the DTSA, exemplary damages and ex parte seizure are generally not available as distinct trade secrets remedies in Australia.

Should our NDAs treat confidential information as intellectual property?

Generally, no. As discussed above, Australian law does not treat confidential information as proprietary. Conflating the two concepts in your NDAs and assignment clauses can create drafting ambiguities. Define “confidential information” and “intellectual property” separately and address ownership of each clearly.

How does the position differ for ex-employees?

During employment, employees owe a relatively wide duty of confidence reinforced by the implied duty of good faith. After employment ends, the duty narrows: ex-employees remain bound not to use or disclose information that is properly characterised as a trade secret (in the Faccenda Chicken / Del Casale sense) but may use general skill and know-how acquired in the role. Properly drafted post-employment restraints and confidentiality clauses are essential.

What should we do if we suspect a breach has occurred?

Move quickly. Preserve evidence (do not let IT wipe devices), engage legal advice early, and consider urgent injunctive relief if dissemination is threatened. Delay can itself become an argument against you — both in equity and on the question of whether the information truly was treated as confidential.

Final Thoughts

Australia’s law of confidence is flexible, principled, and largely judge-made — but it places the burden squarely on the holder of the information to behave as though the information is genuinely confidential. The businesses that win confidence cases are not necessarily those with the most elaborate NDAs; they are those whose conduct, systems and culture match the language of those NDAs.

If your business is sitting on commercially valuable information — and almost every business is — the time to put that infrastructure in place is now, not after a key employee resigns and joins a competitor.

If you need help auditing your confidentiality framework, drafting NDAs and employment agreements that work both domestically and across the UK and US, or responding to a suspected breach, our team is here to help. Start with our Business Legal Compliance Review for an end-to-end assessment.

This article is general legal information and does not constitute legal advice. Every situation is different — please seek tailored advice before acting.