On 1 October 2025, new legislation will come into force affecting the use of non-disclosure agreements (NDAs) in England and Wales.

Below, we set out a brief reminder of the current position on NDAs and the changes of which employers should be immediately aware. For further background on these changes, and for full information on the broader changes to NDAs expected under the Employment Rights Bill, see our full briefing here).

What is the current law on NDAs?

NDAs have become an increasingly common feature of employment related agreements, often used as part of settlement agreements on an employee’s exit or to otherwise bring disputes to a close. From both an employer and employee’s perspective, they can provide security regarding the use of confidential information and the privacy of a dispute, in many cases providing much needed closure for those involved. However, campaigns have highlighted concerns that such provisions are being misused to silence victims of serious workplace misconduct or cover up other wrongdoing.

Whilst the existing law prevents NDAs from prohibiting individuals from whistleblowing, or from making disclosures to the police and/or regulatory bodies where the complaint relates to a criminal offence, their use is otherwise broadly unregulated.

What is changing on 1 October 2025?

Under the Victims and Prisoners Act 2024, individuals will be able to make a “permitted disclosure” in specified circumstances, even if they signed an NDA that would ordinarily prevent their doing so. To the extent that the NDA purports to restrict this, the relevant term will be void..

This will come into force on 1 October 2025 and apply to all NDAs that are signed on or after that date. NDAs that already exist or which are signed before this date will not be caught.

What is a permitted disclosure?

A “permitted disclosure” is a disclosure made by a “victim of crime” (or a person who reasonably believes that they have been a victim of a crime) about criminal conduct, where that disclosure is made to certain specified persons or regulatory bodies.

A “victim of crime” means someone who has suffered harm as a direct result of being subjected to conduct constituting a criminal offence in England and Wales, or as a direct result of witnessing the criminal conduct. There are also other limited categories of connection with the criminal conduct, concerning familial relationships. The offence in question does not have to have been reported and no charge or conviction is required to have occurred. The harm suffered can be physical, mental, emotional or economic.

The specified categories to whom a permitted disclosure can be made about the relevant conduct are:

• Law enforcement.
• Qualified lawyers.
• Any regulated professional or regulator of professionals.
• Victim support services.
• Any individuals who are authorised to receive information on behalf of the above categories.
• Any child, parent or partner of the individual making the disclosure.

In each case, the disclosure is only a qualifying permitted disclosure where it relates to the relevant criminal conduct and is made for the purposes of obtaining support from the relevant function (or, where relevant, co-operating with their functions). For instance, sharing information with a qualified lawyer will only be a permitted disclosure where it is for the purpose of seeking legal advice about the relevant conduct. Where the recipient is a child, parent or partner, the disclosure must be for the purposes of obtaining support from that person.

Importantly, an NDA will not be prohibited to the extent that it precludes disclosures made for the primary purpose of releasing information into the public domain, for example to the media.

What does this mean for employers?

In many cases, employers are already prepared for employees not to be bound by NDAs when it comes to criminal or potentially criminal conduct. Such cases would often already be caught by whistleblowing exceptions.  Further, any NDAs negotiated by legal advisers must not prohibit reports to professional advisers, co-operation with a criminal investigation or reports to regulatory bodies and law enforcement agencies.

However, there are some important differences between the current restrictions and those which will be in force from 1 October 2025. Employers should particularly bear in mind the following:

• A worker may be considered a victim where they have been, or reasonably believe they have been, subject of criminal conduct. In the workplace, this could include serious acts of harassment (including sexual harassment), theft, violence or fraud. Any witnesses to such conduct would also be included, and the fact that no police report was ever made will not affect their protection. This could capture a broader range of individuals than employers may anticipate, particularly in cases of unproven allegations or disputed accounts of events.

• Unlike in the existing whistleblowing exceptions, there is no requirement for the permitted disclosure to be made in the ‘public interest’. This broadens the scope of what can be permissibly shared, particularly where information is shared for the purposes of obtaining legal, medical or personal support. Disclosure of criminal conduct to any of the regulatory categories of recipient is generally likely in any case to be in the public interest.

In light of these changes, employers will therefore need to review their current confidentiality clauses such as those contained in settlement agreements, employment contracts and any stand-alone NDAs, and remove (or clarify) any provisions that appear to preclude permitted disclosures under this new legislation.

BDBF is a leading employment law firm based at Bank in the City of London. If you would like to discuss any issues relating to the content of this article, please contact Rose Lim (RoseLim@bdbf.co.uk), Amanda Steadman (AmandaSteadman@bdbf.co.uk) or your usual BDBF contact