Template · Legal
Confidentiality agreement for vendors and volunteers
A plain agreement for volunteers, consultants and vendors who see donor, client or staff data: what's confidential, how to protect it, and returning it.
Three editable formats: Word (.docx), Rich Text (.rtf) and plain text (.txt). Reviewed October 22, 2026.
How to use this template
- Download it as a Word file (.docx), which opens in Microsoft Word, Google Docs, Pages and LibreOffice, or as Rich Text (.rtf) or plain text (.txt). All three are editable.
- Fill in every blank. Blanks are in square brackets, like [ORGANIZATION NAME], and are highlighted in the preview below. Delete any bracketed notes you don't need.
- Make it yours. Check it against your bylaws and your state's rules, and change anything that doesn't fit. Have your board approve it where it says so.
- Printing? Print this page: the printout leaves out the site's menus and shows the template with lines for the blanks.
Volunteers, consultants and vendors often see things that aren't theirs to share: a donor list, a client's case notes, salary figures, a board's draft plans. A short written agreement makes expectations clear before they start, and gives you something to point to if information goes where it shouldn't.
This agreement is for people who aren't your employees: volunteers, pro bono experts, consultants, contractors and service providers. For employees, confidentiality rules belong in your personnel policies, written with a lawyer. Our guide to data privacy basics explains why collecting and sharing less is the best protection of all.
What the law says, briefly
- Put expectations in writing. The FTC's Protecting Personal Information guide tells businesses to "put your security expectations in writing in contracts with service providers," to verify compliance rather than take their word for it, and to insist that service providers tell you about any security incidents they have.
- Whistleblower notice. Under federal law (18 U.S.C. § 1833(b)), a person can't be held liable under trade secret law for disclosing a trade secret in confidence to a government official or an attorney solely to report or investigate a suspected violation of law, or in a court filing made under seal. An employer must give notice of this immunity in any agreement with an employee that governs trade secrets or other confidential information, and for this purpose "employee" includes "any individual performing work as a contractor or consultant." An employer that doesn't give the notice can't recover exemplary damages or attorney fees from that person under the federal trade secret law. Section 6 of the template includes the notice.
- Harassment and assault. The federal Speak Out Act says that, for a sexual assault or sexual harassment dispute, no nondisclosure or nondisparagement clause agreed to before the dispute arises is judicially enforceable where the conduct is alleged to have broken federal, tribal or state law. Section 6 says plainly that this agreement doesn't stop anyone reporting harassment, abuse or a crime.
State laws on confidentiality agreements, trade secrets and privacy differ from state to state.
How to adapt it
- Match the information to the role. A volunteer who stuffs envelopes needs a lighter agreement than a consultant with access to your donor database. Delete what doesn't apply.
- Give access to less. Share only the records someone needs for their task, and remove their access when they finish.
- For vendors with their own contracts, such as a database or payroll provider, check that their contract already covers security, incident notice and return or deletion of data. If it does, you may not need this agreement as well. If health information is involved, other federal rules may apply; ask a lawyer.
- Explain it in person. Go through it at orientation, so people know why it matters, not just what to sign.
- Keep the signed copy with the person's volunteer or vendor file, under your document retention policy.
Preview
Confidentiality agreement
This agreement is between [ORGANIZATION NAME] ("the Organization") and [NAME OF VOLUNTEER, CONSULTANT OR COMPANY] ("you"). It applies while you [VOLUNTEER WITH / PROVIDE SERVICES TO] the Organization and after you finish.
Role or services: [DESCRIBE THE ROLE OR SERVICES]
1. What is confidential
"Confidential information" means information you see or receive because of your work with the Organization that isn't already public, in any form, including:
It doesn't include information that is already public through no fault of yours, or that you already knew before working with us.
2. What you agree to do
- Use confidential information only to do the work described above.
- Not share it with anyone outside the Organization, except people we've approved in writing who need it for the work.
- Not copy it to personal devices, personal email or personal cloud accounts, unless we've agreed to that in writing.
- Keep it secure: use strong passwords and two-step login where available, lock your screen, and don't leave papers where others can see them.
- Not post about the people we serve, or share their photos or stories, except as our media and photo policy allows.
- Not use the information for your own purposes, or anyone else's, including selling or marketing to our donors.
3. If something goes wrong
Tell [ROLE AND CONTACT DETAILS] as soon as possible, and within [NUMBER] hours, if you think confidential information has been lost, stolen, sent to the wrong person or seen by someone who shouldn't see it. Don't try to investigate on your own. Help us respond.
4. For vendors and consultants
If you are a company or a paid consultant, you also agree to:
- Have reasonable safeguards for our information, and tell us what they are if we ask.
- Make sure anyone working for you who sees our information has agreed to keep it confidential on terms at least as strict as these.
- Not hand our information to subcontractors without our written agreement.
- Tell us promptly about any security incident that affects our information.
5. When you finish
When your role or contract ends, or when we ask, you will return or securely delete all confidential information, including copies on any device or account, and confirm in writing that you have done so. Your duties under this agreement continue after you finish [FOR [NUMBER] YEARS / FOR AS LONG AS THE INFORMATION REMAINS CONFIDENTIAL].
6. What this agreement doesn't stop
Nothing in this agreement stops you from:
- reporting a possible violation of law to a government agency, law enforcement or an attorney, or taking part in an investigation,
- reporting harassment, abuse, discrimination, or a risk to a child's or vulnerable adult's safety, or disclosing information about sexual assault or sexual harassment, or
- doing anything else the law protects.
Notice under 18 U.S.C. § 1833(b): An individual shall not be held criminally or civilly liable under any Federal or State trade secret law for the disclosure of a trade secret that (A) is made (i) in confidence to a Federal, State, or local government official, either directly or indirectly, or to an attorney; and (ii) solely for the purpose of reporting or investigating a suspected violation of law; or (B) is made in a complaint or other document filed in a lawsuit or other proceeding, if such filing is made under seal. An individual who files a lawsuit for retaliation by an employer for reporting a suspected violation of law may disclose the trade secret to the attorney of the individual and use the trade secret information in the court proceeding, if the individual files any document containing the trade secret under seal and does not disclose the trade secret, except pursuant to court order.
7. Other terms
- If you break this agreement, the Organization may end your role or contract and may take other steps the law allows.
- This agreement is governed by the laws of [STATE].
- [FOR VOLUNTEERS: This agreement doesn't make you an employee, and doesn't promise any particular role.]
Signatures
For the volunteer, consultant or company
Name: [NAME]
Title (for a company): [TITLE]
Signature: [SIGNATURE]
Date: [DATE]
For [ORGANIZATION NAME]
Name: [NAME]
Title: [TITLE]
Signature: [SIGNATURE]
Date: [DATE]
Template from Golden Hint: goldenhint.org/resources/templates/vendor-and-volunteer-confidentiality-agreement. Reviewed October 22, 2026. General information, not legal or tax advice.
General information. Not legal, tax or financial advice. Rules change and every situation is different, so check the official sources and talk to a qualified professional before you act. More about this.
Keep going
- GuideDirectors and officers (D&O) insuranceWhat D&O insurance covers and leaves out, who needs it, and how it fits with the federal Volunteer Protection Act and state rules for volunteer board members.
- GuideFiling your first Form 990Which return your charity files (990-N, 990-EZ or 990), when it's due, how to file, what's public, and what happens if you miss it.
- Founder pathwayStaying compliantThe yearly duties that keep your charity in good standing: state registration, the Form 990 family, public disclosure, donor receipts and the political rules.
- Founder toolCompliance calendarYour charity's federal and state deadlines for the year, from your year end and state.
Sources
Checked on October 22, 2026. Rules and fees change, so follow the links for the current version.
Was this page useful?
Need help with something specific? Ask a person.