Take the confidentiality undertaking signed by every new employee or contractor out of your binder. Check the date in the footer. If you see 2018, you have just found a document that gives you a sense of security – but not necessarily security itself.
Many IT, SaaS and e-commerce companies still use, for example, “Appendix No. X to the Personal Data Security Policy” in its 2018 version. It has been signed during onboarding without any changes since the GDPR was implemented. Meanwhile, several things have changed since 2018: an amendment to the Act on Combating Unfair Competition abolished the 3-year limit on trade secret protection after employment ends, the Whistleblower Protection Act came into force, new consolidated texts of the Labour Code and Civil Code were published, and the President of the Personal Data Protection Office (PUODO) issued decisions imposing fines for the absence of authorisations and confidentiality undertakings.
In this article, I will guide you through an audit of your confidentiality undertaking template. I will show you what still works in a typical document from 2018, what is merely decorative and what you need to change to ensure that your company is genuinely protected – rather than merely “formally compliant”.
Key terms worth knowing
Before we move on to the audit, it is worth clarifying several terms that will appear later in the article.
| Term | Explanation |
|---|---|
| Confidentiality undertaking | A document in which an employee or contractor confirms that they will not disclose information protected by the company. It is not the same as an authorisation to process data. |
| Authorisation to process data | A separate document granting a specific person the right to access personal data within a defined scope. Required under the GDPR (Articles 29 and 32). |
| Trade secret | Technical, technological, organisational or other information that has commercial value, is not generally known and in respect of which the company has taken steps to preserve confidentiality – in accordance with Article 11(2) of the Act on Combating Unfair Competition. |
| Contractual penalty | An amount that a party agrees to pay if it breaches a non-monetary obligation (such as confidentiality). Under civil law and B2B agreements, it is generally payable without the need to prove loss (Articles 483-484 of the Civil Code). |
| Offboarding | The process of ending a working relationship, including revoking access, returning equipment and data, and confirming compliance with confidentiality obligations. |
What still works in the old template
Not everything in a typical 2018 undertaking needs to be discarded. Several elements are well designed – and worth retaining while merely updating their form.
A broad definition of the “obligated person”. The template covers not only employees, but also service providers, contractors performing specific work and agents. This is the right approach – one document for an entire mixed workforce. In technology companies, where half the team works on a B2B basis, failing to extend it in this way would create a gap from day one.
An indefinite confidentiality obligation. A provision stating that confidentiality continues “for as long as the company has an interest in preserving it” – is consistent with the current law. Following the amendment to the Act on Combating Unfair Competition of 4 September 2018, the three-year limit on trade secret protection after employment ends was repealed. Protection continues for as long as the information meets the statutory criteria (Article 11 of the Act on Combating Unfair Competition – ISAP).
The obligation to return data against written acknowledgement. A provision requiring the immediate return of all data, documents and storage media after the working relationship ends provides a good foundation for an offboarding procedure. The problem is that the provision alone is not enough – you also need a checklist and enforcement within 24 hours of the departure.
Reference to personal data protection documentation. The template identifies four pillars: the Personal Data Protection Security Policy, the IT Systems Management Manual, the Physical Security Policy and the Data Breach Response Manual. This is a sound structure – provided that these documents have also been updated.
What is merely decorative – and why it does not protect your company
Now for the most important part of the audit. Below you will find elements that look good on paper in the old template but may prove worthless in a dispute, inspection or enterprise client audit.
Outdated statutory publication references
The 2018 template refers to the Labour Code as published in the Journal of Laws of 2016, item 1666, and the Civil Code as published in the Journal of Laws of 2017, item 459. The current consolidated texts are, respectively, the Journal of Laws of 2025, item 277 (Labour Code) and the Journal of Laws of 2025, item 1071 (Civil Code).
An incorrect statutory publication reference does not invalidate the document. However, it signals to business partners, auditors and inspectors that the company’s compliance system has not been reviewed for years. In an enterprise client’s security questionnaire or during investor due diligence – this is the first warning sign.
No contractual penalty
The template under review does not contain a single contractual penalty. All sanctions rely on general references to the Labour Code, Criminal Code and Civil Code.
This means that if a B2B contractor breaches confidentiality, you must:
- Prove that the breach occurred
- Prove the loss and its amount
- Prove a causal link between the breach and the loss
A contractual penalty is standard in non-disclosure agreements. If properly stipulated – in civil law and B2B agreements – it is generally payable without the need to prove loss (Article 483 § 1 of the Civil Code). In its judgment of 10 December 2019 (IV CSK 443/18), the Supreme Court considered a contractual penalty of PLN 100,000 for a breach of confidentiality under a civil law agreement.
An important caveat: the penalty must be proportionate. A court may reduce it under Article 484 § 2 of the Civil Code if it considers it grossly excessive. On the other hand, if it is too low, it will not serve as a deterrent.
| Type of working relationship | Is a contractual penalty for a confidentiality breach permitted? | Comments |
|---|---|---|
| B2B / service contract / specific-task contract | Yes | Article 483 § 1 of the Civil Code – payable without the need to prove loss |
| Employment contract (confidentiality during employment) | Risky | No explicit basis in the Labour Code; Article 300 of the Labour Code does not provide an independent basis for circumventing limitations on employee liability |
| Post-employment non-compete obligation (Article 101² of the Labour Code) | Yes | The Supreme Court permitted a contractual penalty – judgment I PK 196/04 |
Vague definition of protected information
The template lists “information about customers and suppliers, personal data, documents and correspondence, and data stored in computer memory”. This is too general. Without a closed list of specific categories – customer databases, prices, source code, architecture documentation and commercial terms – the obligated person does not know exactly what is protected, and the company cannot precisely identify a breach.
It is good practice to specify the areas that require particular care. From the company’s perspective, the aim should be to define the scope as broadly as possible. From the contractor’s perspective, the definition should be limited to data that has commercial value, has not been publicly disclosed and is subject to protective measures. Balancing both perspectives results in a document that is enforceable and understandable.
Monitoring included in the wrong document
The template contains consent to the monitoring of online activity and activity in company systems and applications. The problem is that a monitoring provision included solely in a confidentiality undertaking does not meet the requirements of Article 22³ of the Labour Code.
The law requires the purpose, scope and manner of monitoring email and online activity to be specified in a collective agreement, workplace regulations or a notice (Article 22² § 6 of the Labour Code in conjunction with Article 22³ § 3 of the Labour Code). In addition, the employee must be informed individually in writing before being permitted to start work (Article 22² § 9 of the Labour Code).
If the confidentiality undertaking is the only place where you provide information about monitoring – evidence obtained through monitoring may be challenged in a dispute.
The “intentional act” clause – questionable effectiveness
The template states that failure to comply with personal data protection documentation “will be treated as an intentional act”. This clause is of questionable evidentiary effectiveness. In a dispute with an employee, it is the court that determines whether a breach was intentional or unintentional – based on the circumstances, not on a declaration in a document.
In the case of unintentional fault, an employee’s financial liability is limited to three months’ remuneration as at the date on which the loss was caused (Article 119 of the Labour Code). In the case of intentional fault – liability covers the full loss, with no limit (Article 122 of the Labour Code). The burden of proving fault, loss and the causal link rests with the employer (Article 116 of the Labour Code).
Contact us if you would like to check whether your confidentiality undertaking template needs to be updated.
Two issues that your 2018 template does not address at all
Whistleblower protection
The Whistleblower Protection Act of 14 June 2024 (Journal of Laws of 2024, item 928) introduced protection for people who report breaches of law. A confidentiality clause cannot effectively prohibit a report made in accordance with the Act – if the whistleblower had reasonable grounds to believe that the information was true and constituted information about a breach of law (Article 6 of the Act).
The Act does not expressly contain wording to the effect that “the contractual provision is invalid” – but the conflict between a contractual prohibition and the whistleblower’s statutory right and protection leads to the conclusion that the confidentiality clause is ineffective to this extent. However, the protection does not cover disclosures that go beyond what is necessary for the report or information provided without reasonable grounds.
It is therefore worth adding an exception to the confidentiality undertaking: “The undertaking does not restrict the reporting of breaches of law to public authorities or through the internal reporting procedure.” The absence of such a provision does not invalidate the document, but it may create uncertainty for the employee and give rise to allegations that reporting is being obstructed.
Disclosure of information at the request of an authority
A non-disclosure agreement cannot effectively prohibit the disclosure of information at the request of a court or another authorised authority. However, it may provide for mechanisms that protect the company’s interests:
- An obligation to inform the company of the intended disclosure
- Limiting the scope of the data disclosed to the minimum necessary
- An obligation to notify the recipient of the data that it is confidential
Including these mechanisms in the undertaking gives the company time to respond and limits the extent of any potential disclosure.
PUODO penalties – the absence of undertakings and authorisations is a separate infringement
The absence of signed confidentiality undertakings and authorisations to process data is not merely an “administrative backlog”. PUODO treats this as a breach of the organisational obligations arising from the GDPR.
In decision DKN.5112.11.2021, PUODO found that the failure to grant employees and contractors authorisations to process data breached the confidentiality principle under Article 5(1)(f) of the GDPR. Article 32(4) of the GDPR expressly requires persons authorised to process data to undertake to maintain confidentiality.
| GDPR provision | Infringement | Maximum fine |
|---|---|---|
| Article 32 (security measures) | No staff confidentiality undertakings | Up to EUR 10 million or 2% of annual turnover |
| Article 5(1)(f) (confidentiality principle) | No authorisations or undertakings | Up to EUR 20 million or 4% of annual turnover |
In decisions DKN.5131.44.2022 and DKN.5131.35.2021, PUODO imposed fines of PLN 10,000 and PLN 15,000 respectively for infringements including, among others, Article 5(1)(f) and Article 32 of the GDPR. In both cases, several infringements were identified together – the amounts did not result solely from the absence of authorisations, but this was one of the deficiencies identified.
An additional dimension of liability: Article 266 § 1 of the Criminal Code penalises the disclosure or use of information obtained in connection with work performed – contrary to statutory provisions or an undertaking given. The penalty is a fine, restriction of liberty or imprisonment for up to 2 years (Article 266 of the Criminal Code – ISAP). The very existence of a signed undertaking is one of the conditions for liability under this provision – without it, pursuing the criminal route is more difficult.
Checklist: 8 steps to update your confidentiality undertaking
Below is a list of actions that HR or the person responsible for documentation can complete in a single afternoon – or refer to a lawyer for review.
| No. | Action | Priority | Responsible party |
|---|---|---|---|
| 1 | Identify everyone with access. List all people with access to data and systems (employees, B2B contractors, freelancers, interns and subcontractors). Check how many of them have signed an up-to-date confidentiality undertaking and authorisation to process data. | Urgent | HR / People Ops |
| 2 | Update statutory publication references and cross-references. Replace references to the Journals of Laws of 2016 and 2017 with the current consolidated texts (Labour Code – Journal of Laws of 2025, item 277; Civil Code – Journal of Laws of 2025, item 1071). Update references to personal data protection documentation. | Urgent | Legal / HR |
| 3 | Add a contractual penalty. For civil law and B2B agreements – specify a contractual penalty in a defined amount for each breach of the confidentiality obligation. Ensure that it is proportionate (risk of reduction by the court – Article 484 § 2 of the Civil Code). | Urgent | Legal |
| 4 | Define a closed list of protected information. Instead of the vague phrase “information about customers” – specify: customer databases, prices and commercial terms, source code, architecture documentation, personal data and business correspondence. | Urgent | Legal + CTO |
| 5 | Move monitoring to a separate document. Transfer provisions on email and online activity monitoring to workplace regulations or a notice. Describe the purpose, scope and manner of monitoring, as well as the data retention period. Provide each employee with individual information before they are permitted to start work. | Urgent | HR + Legal |
| 6 | Add a whistleblower exception. “The undertaking does not restrict the reporting of breaches of law to public authorities or through the internal reporting procedure.” Add protective mechanisms for disclosure at the request of an authority (notification of the company, minimisation of scope). | Recommended | Legal |
| 7 | Implement an offboarding checklist. Include “return of data and storage media against written acknowledgement” and revoke access to all SaaS tools within 24 hours of the working relationship ending. | Urgent | HR + IT |
| 8 | Complete the package for B2B contractors. In addition to the confidentiality undertaking, check: transfer of copyright with specified fields of exploitation (Article 64 of the Copyright Act), a data processing agreement (Article 28 of the GDPR), a non-compete or non-solicitation clause, a BYOD policy and a policy on the use of AI tools. | Recommended | Legal + CTO |
An additional step for the future: schedule an annual review of personal data protection documentation and templates in the process owner’s calendar (HR or Legal Ops), with document versioning. This will prevent the template from sitting in a drawer for another seven years.
Scenarios showing why this cannot wait
To move beyond theory – below are three situations we see among clients.
Scenario 1: security questionnaire from an enterprise client. A company (approximately 30 people, half of them working on a B2B basis) receives a security questionnaire asking: “Have all individuals with access to data signed a confidentiality undertaking and been granted authorisation?” It turns out that only some employees have signed the documents, and the template dates back to 2018. Verifying the completeness of confidentiality undertakings and authorisations is a standard part of supplier assessments (Cybersecurity in procurement – gov.pl). Missing documentation may prevent the contract from being signed.
Scenario 2: a developer leaves with repository materials. A senior developer on a B2B contract leaves and takes architecture documentation with them on a private drive. The company has a signed confidentiality undertaking – but no contractual penalty. To recover anything, it must prove the loss and its amount. With a properly stipulated contractual penalty – it would be enough to prove that the breach itself occurred.
Scenario 3: a salesperson contacts customers after leaving. An e-commerce salesperson leaves and contacts 15 of the company’s customers within a month. The confidentiality undertaking covered “information about customers and suppliers”, but it did not include a non-solicitation clause or a post-termination non-compete obligation. Confidential information, business relationships and personnel are assets whose protection requires not one document, but a coherent set of tools – a confidentiality clause, a non-compete obligation and a non-solicitation clause.
How we can help you
Updating a confidentiality undertaking is not simply a matter of editing a single Word file. It requires a review of how your company protects information – from onboarding through day-to-day work to offboarding.
We support technology companies in three ways:
Operational minimum. Audit of document completion and an update to the confidentiality undertaking and data processing authorisation templates. We check who has signed the documents and who has not, and provide updated templates.
Solid foundation. A consistent package for employees and B2B contractors: confidentiality, authorisation, transfer of copyright (IP), monitoring provisions in workplace regulations and an offboarding checklist. One package that works for the entire team.
Comprehensive protection. An update to all personal data protection documentation: the security policy, IT systems management manual, data breach procedure, whistleblower clause and team training when documents are signed (20 minutes explaining exactly what constitutes a company secret and how to report incidents – with a record of completion so that you can demonstrate that the undertaking was more than an empty signature).
We treat employment law and contract law as elements of organisational management. We combine them with the business context – IP, workforce structure and growth plans – so that the documents reflect how your company actually operates.
An outdated confidentiality template is a risk that grows every month
A confidentiality undertaking from 2018 may have been sufficient on the day it was signed. Seven years later – without a contractual penalty, without a precise definition of protected information, with monitoring provisions in the wrong document and no whistleblower exception – it protects your company more on paper than in reality.
The cost of reviewing and updating your onboarding document package is incomparably lower than the cost of a dispute over a customer data breach, a lost contract following a failed audit or rebuilding a customer base after a salesperson leaves.
If you would like to review your confidentiality undertakings, complete your onboarding package or organise your personal data protection documentation – contact us.
Frequently asked questions
Is one confidentiality undertaking sufficient for both an employee and a B2B contractor? One template may cover both groups – provided that the definition of the “obligated person” is broad enough (employee, service provider, specific-task contractor, agent). The difference arises in relation to sanctions: in B2B agreements, you can stipulate a contractual penalty for a breach of confidentiality, whereas its use in an employment relationship is limited. It is therefore worth having one template with different sanctions tailored to the type of working relationship.
Is a confidentiality undertaking the same as an authorisation to process data? No. These are two separate documents. An authorisation grants the right to access specific categories of personal data (Article 29 of the GDPR). A confidentiality undertaking imposes an obligation not to disclose protected information – not only personal data, but also trade secrets, know-how and commercial information. You need both.
Will the word “indefinitely” in a confidentiality clause hold up in court? Yes, provided that the information continues to meet the definition of a trade secret under Article 11(2) of the Act on Combating Unfair Competition. Following the 2018 amendment, the three-year limit on protection after employment ends was repealed. An indefinite term is therefore consistent with the Act – but it applies only to information that still has commercial value and in respect of which the company takes protective measures.
What should I do if I have dozens of people without signed documents – should they be signed retrospectively or with the current date? Use the current date. Backdating documents is legally risky and does not change the fact that the undertaking did not apply during the period when it had not been signed. Have the documents signed with the current date, record them in the register of authorised persons and ensure that new personnel sign the documents before they are first given access to data – not after the event.
Can a confidentiality clause prohibit an employee from reporting misconduct to an authority? No. The Whistleblower Protection Act of 2024 protects people who report breaches of law if they had reasonable grounds to believe that the information was true. A confidentiality clause cannot effectively prohibit such a report. It is therefore worth adding an exception to the undertaking confirming that confidentiality does not restrict the statutory right to report a breach.
What do I realistically risk if I change nothing? The absence of authorisations and confidentiality undertakings is independently identified as a GDPR infringement. PUODO has imposed fines for such deficiencies. There is also the risk of losing an enterprise contract after a failed audit, being unable to enforce confidentiality against former contractors (without a contractual penalty) and facing a more difficult route to criminal enforcement (Article 266 § 1 of the Criminal Code requires an undertaking to exist). This is not an issue to postpone until next year.
