Confidentiality policy template
Small businesses lose information through ordinary things: a roster photographed and sent to a group chat, a supplier price mentioned to a rep, a customer story told at a party. The policy worth writing covers those, not espionage.
| Section | What the policy says |
|---|---|
| Purpose | To set out what information stays inside this business and how it is looked after. |
| Who it applies to | All employees, casuals, apprentices and trainees, contractors and volunteers. Most of it continues to apply after you stop working here. |
| Customer information | Names, contact details, payment details, orders, bookings, allergies and anything a customer tells you. Do not discuss a customer outside work, and do not repeat a story that identifies them even with the name left out. |
| Employee information | Pay rates, hours, leave, addresses, phone numbers, health information and anything raised under the grievance policy. A roster shows who is working. It is not to be used as a contact list. |
| Business information | Supplier prices and terms, recipes and methods, takings and margins, what we are planning, and anything marked confidential. |
| What is not confidential | Your own pay and conditions. You are free to discuss what you earn with anybody, and nothing in this policy stops you. Nothing here stops you talking to a union, a lawyer, the Fair Work Ombudsman or a regulator either. |
| Where work can be discussed | Work matters are discussed at work, with the people who need to know. Not in the dining room, not within earshot of customers, and not in a group chat that includes people who have left. |
| Devices and accounts | Use your own password and do not share it. Lock a screen when you walk away. If you use your own phone for work, keep it locked with a passcode. |
| Printing, photos and screenshots | Do not photograph or screenshot a roster, a timesheet, a booking sheet or anything with customer details on it. If you need a copy, ask the manager on duty for one. |
| If information is lost or sent to the wrong person | Tell the owner the same day, even if it seems small. Fixing it quickly matters far more than who made the mistake, and nobody is disciplined for reporting one promptly. |
| After you leave | Return anything that belongs to the business, including keys, uniforms, documents and files. Your access to the roster and to accounts ends on your last day. The duty not to disclose what you learned here continues. |
| Breaches | Depending on what happened: a conversation, a written warning, or dismissal. Disclosing customer information or selling business information is serious misconduct. |
| Review date | Reviewed each year in March. |
What is in the file
- Template, blank, with each section down the side and room for the answer.
- Example, the same sheet filled in for Harbourside Coffee.
- How to use, with the steps and the mistakes below.
How to fill it in
- Keep the section saying pay is not confidential. Employees are entitled to discuss their own pay, and a policy that says otherwise is the wrong kind of wrong.
- List the categories you actually hold. A generic list teaches nobody what to protect.
- Make reporting a mistake safe, in writing, because a hidden breach is always the more expensive one.
- Add ending access to whatever checklist you already use when somebody leaves.
Common mistakes
- Wording that appears to stop staff discussing their own wages or contacting the Fair Work Ombudsman
- Group chats that still include three people who left last year
- A rule against photographing rosters, in a business where the roster is only ever a photo on the wall
What changes by trade
The law behind this document is the same wherever you trade, so the wording above is written once. What changes is what the trade puts in front of it.
| Disability and home care | Participant information is the most sensitive thing your staff handle, and they handle it alone. Say that notes are written in the system rather than in a personal notebook, and that nothing goes home. rostering disability support |
| Childcare | Families, children and enrolment records all sit here. Say that a family is not discussed with another family, which is the breach that actually happens. rostering an early learning service |
| Cafes and restaurants | Recipes, supplier prices and a regular’s order are the three. Say which suppliers are confidential, because staff genuinely do not know. rostering a cafe |
| Retail | Stock levels, margins and launch dates leak through casual conversation with reps. Say who is allowed to talk to a supplier about numbers. rostering a shop |
| Security | A client’s layout, staffing and patrol times are the client’s information, not yours to share. Say that it does not travel between sites or between employers. rostering a security business |
| Cleaning | Staff hold keys and alarm codes for premises you do not own. Say that codes are never written down on a phone and never shared between staff. rostering a cleaning run |
When a spreadsheet stops being enough
A roster photographed and sent to a group chat is how most of this leaks. In Roster Flow each person sees their own shifts on their own phone, so there is nothing to photograph and nothing to forward.
Questions
What is on the confidentiality policy template?
13 sections down the side, running from purpose to review date. The example beside them is filled in for Harbourside Coffee: what stays inside the business, who it covers, and what happens after somebody leaves.
Does the confidentiality policy template work anything out for you?
No. It is a document with 13 sections to answer in your own words, not a calculator. Nothing on it is a formula.
Can I use the confidentiality policy template in Google Sheets?
Yes. Open confidentiality-policy.xlsx from Google Drive, or use File, then Import, then Upload with confidentiality-policy.csv. The document and its example come across either way.
Is the wording in the confidentiality policy template ready to use as it is?
The confidentiality policy template is a starting point for Harbourside Coffee or any business like it, to adapt rather than sign. The wording was checked against the official sources on 22 September 2026, it is not legal advice, and it has not been through a workplace relations professional.