It Confidentiality Agreements Template for Canada

An IT confidentiality agreement (or NDA) binds IT contractors, consultants, or employees to keep proprietary systems, source code, security configurations, client data, and technical know-how confidential. In Canada, these agreements are standard practice in technology engagements because Canadian common law provides limited automatic trade-secret protection, making contractual confidentiality obligations the primary enforcement mechanism.

Canada does not have a dedicated federal trade secrets statute equivalent to the US Defend Trade Secrets Act. Protection relies on breach of confidence as a common-law tort, breach of contract under an NDA, and, in some cases, breach of fiduciary duty. This makes a well-drafted confidentiality agreement especially important in Canadian IT engagements, as common-law remedies alone may be uncertain and costly to enforce.

The agreement should define confidential information broadly to include source code, system architecture, security protocols, network configurations, access credentials, client data, business processes, financial information, and any proprietary algorithms. Carve-outs for information that is publicly known, independently developed, or received legitimately from a third party without restriction are standard and prevent overly broad obligations.

Obligations typically survive the end of the engagement by two to five years for general business information. For highly sensitive information such as trade secrets or source code, many Canadian IT agreements include perpetual confidentiality obligations, since the information never becomes less sensitive with time. Courts in Canada have upheld perpetual obligations for genuine trade secrets provided the clause is otherwise reasonable.

Not without express authorisation. PIPEDA and the confidentiality agreement together prohibit using personal data or proprietary information for purposes beyond the contracted engagement. An IT provider using client data to train AI models without consent would likely breach both the confidentiality agreement and PIPEDA, and potentially the Criminal Code provisions around unauthorised use of computer data.

Remedies include injunctive relief (a court order to stop the breach), damages for financial loss caused by the disclosure, account of profits if the contractor profited from the confidential information, and in appropriate cases destruction or return of confidential materials. Courts in Canada have granted interlocutory injunctions in IT breach-of-confidence cases where there is an immediate risk of ongoing disclosure or competitive harm.

Yes. Where the IT engagement involves personal information, PIPEDA requires the contracting organisation to maintain accountability for that data even when it is processed by a third party. The confidentiality agreement should include specific data-processing terms: the permitted purposes for which the contractor can use the data, security safeguards required, breach-notification obligations, and data return or deletion requirements at the end of the engagement.

Yes, and it is common. Non-solicitation clauses prevent the IT contractor from approaching the client's employees or clients for a defined period after the engagement ends. Canadian courts are more willing to enforce non-solicitation clauses than non-compete clauses, provided the scope (duration, covered individuals) is reasonable. A combined confidentiality and non-solicitation agreement is standard in Canadian IT services contracting.