Victims and Prisoners Act 2024

All employers will need to understand the new rules to ensure that the wording of any confidentiality clauses, including within template settlement agreements, is compliant. Otherwise, from 1 October 2025, employers risk their confidentiality clauses being void in certain circumstances involving “victims” (defined very widely in the legislation and which could encompass a number of employment scenarios). Separately, the government has also recently announced further proposals to ban the use of NDAs in certain cases of discrimination and harassment and employers should anticipate further reform in this area, although no timescales have yet been published.

What do I need to know?

What’s the current legal position on NDAs?

Currently, NDAs are generally lawful in employment cases except in certain prescribed circumstances including:

• any provision which seeks to prevent a worker from whistleblowing will be void (section 43J Employment Rights Act 1996)
• under the common law, an NDA cannot validly seek to prevent a person from making disclosures to the police or regulatory/statutory bodies in relation to a criminal offence
• from 1 August 2025, under the Higher Education (Freedom of Speech) Act 2023, registered Higher Education Providers have a duty to ensure that they do not enter into NDAs with students, staff, members or visiting speakers where they come forward with a complaint of sexual misconduct, abuse or harassment, or any other form of bullying or harassment

In addition, for those regulated by the SRA (including solicitors and in-house lawyers), a warning notice published by the SRA in 2018 (updated in 2024) makes it a breach of professional conduct rules for a regulated person to negotiate, draft, advise, enforce or be a party to an NDA that prevents certain lawful disclosures (e.g. whistleblowing, reporting an offence to a regulator, making a disclosure to a medical professional etc). This means that lawyers advising employers and employees on, for example, settlement agreements, must ensure that any NDAs within that agreement contain certain carve outs to ensure there is no attempt to prevent lawful disclosures from being made. 

What are the new rules and who do they apply to? 

From 1 October 2025, the Victims and Prisoners Act 2024 (“VPA”) makes void any provision within an agreement that purports to preclude a “victim”, or person who reasonably believes they are a “victim”, from making a disclosure of information to:

• any person with law enforcement functions, for the purpose of those functions being exercised in relation to relevant conduct
• a qualified lawyer, for the purpose of seeking legal advice about the relevant conduct
• a regulated professional, for the purpose of obtaining professional support in relation to the relevant conduct
• victim support services, for the purpose of obtaining support in relation to the relevant conduct
• a regulator, for the purpose of co-operating with the regulator in relation to the relevant conduct
• a person authorised to receive information on behalf of any of the above person for the purposes mentioned above
• a child, parent or partner of the person making the disclosure, for the purpose of obtaining support in relation to the relevant conduct

“Relevant conduct” is conduct by virtue of which the person making the disclosure is or reasonably believes they are a victim. “Victim” is defined widely as a person who has suffered “harm” as a direct result of either being subject to criminal conduct, or other prescribed circumstances including being a witness to criminal conduct. 

“Harm” includes physical, mental or emotional harm and economic loss. 

There does not need to have been any reporting of the offence, nor does anyone have to be charged or convicted.

Further draft regulations (yet to be approved by Parliament, but which are also expected to come into force on 1 October) add two further disclosures to the above list relating to the Criminal Injuries Compensation Authority.

Thinking about the application of the new rules to the workplace therefore, a worker might be a “victim” where they have been (or reasonably believe they have been) the subject of harassment amounting to criminal conduct (including serious sexual harassment), theft, fraud, physical violence or assault or criminal damage (to give a non-exhaustive list). ”Victims” may also include any workers who have witnessed any criminal conduct (where they have also suffered harm as a direct result). 

Importantly therefore, if an employer wants to ensure that they are entering into valid and enforceable confidentiality terms with a victim, or person who reasonably believes they are a victim, it will need to ensure that its confidentiality terms do not encompass the above disclosures. 

What type of disclosures can validly be included in an NDA?

The following disclosures can validly be included within an NDA (provided that they are not rendered void under other relevant laws – see above):

• Any disclosure which is made to those specified persons listed above, but not for the specified purpose
• Any disclosure to those specified persons listed above for the primary purpose of releasing information into the public domain
• Any disclosure to a person, group or body not specified on the above list

What about further reform?