Confidentiality and NDAs With Virtual Assistants

Within a month, a good virtual assistant will have seen your customer list, your pricing, your margins, your pipeline and the inside of your inbox. That visibility is exactly what makes them useful — and exactly why confidentiality deserves ten minutes of deliberate attention at the start of the engagement rather than an awkward conversation later.

What a confidentiality agreement actually does

A confidentiality agreement — whether a standalone non-disclosure agreement or, more commonly, a confidentiality clause inside the services agreement — records what information is confidential, what the assistant may and may not do with it, and what happens when the engagement ends. Its practical value is threefold:

• Clarity. It defines the boundary explicitly, so nobody has to guess whether a customer list or a supplier price is shareable. Most breaches in small business are careless rather than malicious; clarity prevents the careless kind.
• Signal. Asking for confidentiality terms signals that you take your information seriously, which sets the tone for how it is handled. Professional VAs expect this and many include confidentiality terms in their own standard agreements.
• Recourse. If something does go wrong, a written agreement gives you contractual footing that a handshake does not.

What it should cover

• Definition of confidential information — broad enough to cover customer data, financials, pricing, methods and anything marked or reasonably understood as confidential.
• Permitted use — the information may be used only to perform the services.
• Exclusions — information already public, or already known to them, or required to be disclosed by law.
• Handling obligations — reasonable security, no unnecessary copies, and prompt notification if something is lost or exposed.
• Return or destruction — what happens to files and records when the engagement ends.
• Survival — confidentiality obligations continue after the engagement ends.

Template confidentiality clauses and NDAs are widely available, including through legal document services, industry associations and small business advisory bodies. For most engagements a standard template is adequate; if your business handles unusually sensitive information — legal files, health records, financial client data — have a professional adviser tailor the terms and check whether sector rules impose extra requirements.

What an NDA does not do

A signed document does not secure anything by itself. It sits alongside, not instead of, the practical measures covered in our access and security guide: least-privilege access, password managers, separate user accounts and disciplined offboarding. Think of the agreement as defining the standard and the security practices as enforcing it. An NDA with sloppy access management is a promise with no locks; good access management with no NDA is locks with no agreed rules. You want both, and both are cheap.

Privacy law is a separate layer

Confidentiality between you and your assistant is contractual. Your obligations regarding customers' personal information are a separate, statutory matter. The Privacy Act and the Australian Privacy Principles govern how personal information is collected, used, stored and disclosed — including disclosure to service providers such as VAs, and particularly disclosure overseas. The Office of the Australian Information Commissioner publishes guidance on when the Act applies and what it requires. Even businesses below the thresholds where the Act formally applies are well served by treating its principles as the baseline.

Raising it without awkwardness

There is nothing adversarial about confidentiality terms, and experienced assistants will not find the request unusual. A simple framing works: we ask everyone who works with our systems to sign the same confidentiality terms. Present it at the same time as the services agreement, before access is granted, and it is simply part of a professional start — which is precisely the impression a well-run engagement should give both ways.