The Victims and Prisoners Act 2024 is UK legislation that limits how confidentiality clauses can be used in certain circumstances. For NDAs signed on or after the applicable commencement date in England and Wales, clauses that prevent a victim of crime from reporting to police, regulators, legal advisers, or specified support contacts are void.
What the Act changes in practice
The Victims and Prisoners Act 2024 narrows how confidentiality clauses can be used where they would stop a victim of crime from reporting to police, regulators, legal advisers, or specified support contacts. The practical effect is that some NDA wording that once appeared to close down disclosure routes can no longer be relied on.
This matters because a confidentiality clause is only effective to the extent the law allows it to operate. In the affected cases, the clause does not just become risky, it becomes void for the prohibited purpose, which means organisations should treat the drafting outcome as a compliance issue rather than a negotiation preference.
Why confidentiality clauses become unlawful
The Act targets clauses that suppress reporting or support-seeking in circumstances involving crime. That is important because NDAs are often designed to control disclosure of sensitive facts, but they cannot be used to override public-interest reporting channels or prevent a person from seeking lawful advice and support.
For employers, advisers, and anyone drafting settlement terms, the key distinction is between protecting legitimate confidentiality and attempting to silence statutory, regulatory, or victim-support communications. The Act draws a boundary around that second category.
Where a clause is drafted too broadly, the problem is not only unenforceability. Overbroad wording can also create confusion about rights, discourage lawful reporting, and undermine trust in the settlement process.
How organisations should review exposure
Exposure assessment starts with the documents themselves: settlement agreements, severance packs, compromise agreements, template clauses, and any playbook used by HR, legal, or external counsel. Organisations should look for wording that reaches police, regulators, legal advisers, and support contacts, especially where the agreement could involve allegations of misconduct or victimisation.
Review should also cover related process controls, because the legal risk is often created by reuse of old templates. Internal guidance, clause libraries, and approval workflows need to reflect the current legal position, not legacy drafting habits.
For the underlying legal text, the most reliable reference is the Act itself, alongside any official commencement or guidance material that explains when the relevant restrictions took effect in England and Wales.
Drafting, enforcement, and employee relations implications
Once a prohibited clause is included, the enforcement problem is straightforward but still disruptive: the clause cannot be relied on to prevent the protected disclosure. That can create downstream disputes if a business assumes the wording still has deterrent value after the fact.
The broader employee-relations impact is often overlooked. If a settlement agreement appears to overreach, it can increase the chance of challenge, reduce confidence in the employer’s good faith, and make negotiation more adversarial than necessary.
Good drafting therefore requires precision. A lawful confidentiality clause should be narrow, clear about what it covers, and carefully separated from any rights that the Act preserves.
When to seek legal review before using an NDA
Any settlement involving allegations of crime, misconduct, harassment, abuse, coercion, or other victim-sensitive facts should trigger legal review before signature. The more the clause tries to regulate disclosure to authorities or support services, the more likely it is to cross the line.
Practical review also matters after template updates, because one outdated clause can continue circulating across a large organisation long after the law has changed. Legal sign-off, template governance, and training for people who issue NDAs are the controls that reduce that drift.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
ISO/IEC 27001:2022 and GDPR set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| ISO/IEC 27001:2022 | A.5.31 — Legal, statutory, regulatory and contractual requirements | The Act creates a legal requirement that settlement wording must respect. |
| A.5.15 — Access control | Confidentiality clauses are a contractual control over disclosure and information access. | |
| A.5.37 — Documented operating procedures | Template use and approval procedures must reflect current lawful wording. | |
| Recommendation — Review NDA templates against statutory limits and update contract approval controls accordingly. Restrict disclosure terms so they do not override lawful reporting channels. Maintain current clause libraries and approval procedures for settlement documents. | ||
| GDPR | Art.25 — Data protection by design and by default | The term concerns legal drafting that should preserve rights and lawful disclosure paths by design. |
| Recommendation — Build lawful disclosure carve-outs into standard templates from the outset. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org