Direct Answer: A non-disclosure agreement (NDA) can legally prevent tech workers from sharing trade secrets, proprietary code, and confidential business strategies. However, under US, EU, and UK law, an NDA cannot stop anyone from reporting illegal activity, workplace harassment, or safety violations to government agencies or regulators.
NDA tech workers rights are at the center of a growing legal debate, and for good reason. Picture this: a software engineer discovers their company is mishandling millions of users’ personal data. They signed an NDA on day one. Now they’re wondering does that signature mean they have to stay quiet, even about something that might break the law? The answer, across most major jurisdictions, is no. But the details matter, and the line between what an NDA can and cannot cover is not always obvious. If a company is monitoring how employees handle confidential information, that raises separate legal questions covered in Can Your Boss Watch You Work from Home?.
The Short Version
- An NDA can protect trade secrets, product roadmaps, and proprietary technology these restrictions are generally enforceable.
- An NDA cannot block reports of illegal conduct to government authorities, regardless of jurisdiction.
- In the US, the Defend Trade Secrets Act (2016) gives workers immunity for disclosing trade secrets to an attorney or government official when reporting suspected law violations.
- In the EU and UK, whistleblower protection laws override NDA restrictions when workers report breaches of law through proper channels.
What NDA Tech Workers Rights Actually Mean Under the Law
The phrase non-disclosure agreement covers a broad category of contracts. In the tech industry, these agreements typically restrict workers from sharing source code, algorithms, client lists, business strategies, and internal product plans. That part is usually enforceable — companies have a legitimate interest in protecting genuinely confidential business information.
But every major jurisdiction draws a hard boundary: an NDA cannot be used to silence reports of wrongdoing.
United States
Under the Defend Trade Secrets Act (DTSA), signed into federal law in 2016, individuals cannot be held criminally or civilly liable for disclosing a trade secret to a government official or an attorney, as long as the disclosure is made in confidence and solely for reporting or investigating a suspected violation of law (18 U.S.C. § 1833(b)). Employers are required to include notice of this immunity in any agreement that governs the use of trade secrets or confidential information. If they fail to provide that notice, they lose the right to seek exemplary damages or attorney’s fees in a trade secret lawsuit against that employee.
Beyond the DTSA, several federal statutes create additional limits. The Sarbanes-Oxley Act protects employees who report securities fraud. The Criminal Antitrust Anti-Retaliation Act (CAARA) shields workers who report antitrust violations. In January 2025, the DOJ Antitrust Division and OSHA issued a joint statement warning that companies using NDAs to deter reporting of antitrust crimes could face penalties.
At the state level, close to 20 states have enacted their own restrictions on NDAs. California’s Silenced No More Act limits NDAs from preventing workers from discussing workplace harassment, discrimination, or any illegal conduct. A California judge also ruled that overly broad confidentiality agreements at one major tech company effectively functioned as illegal non-compete clauses.
Researchers estimate that between one-third and over half of all US workers are bound by an NDA or similar mechanism. Despite that, many of these agreements contain provisions that would not hold up in court, particularly clauses that try to define general job skills or workplace conditions as “confidential.”
European Union
The EU Whistleblower Protection Directive (2019/1937), now transposed into national law across all 27 member states, provides broad protections for anyone who reports breaches of EU law. This includes employees, contractors, suppliers, and even job applicants. The directive prohibits retaliation including dismissal, demotion, and wage reduction against anyone who reports through proper channels.
Starting in August 2026, the directive will explicitly cover violations of the EU AI Act, meaning tech workers who report non-compliant AI systems will have formal legal protections.
An NDA cannot override these statutory protections. Any contractual clause that attempts to prevent a worker from reporting a breach of EU law through an internal channel, to a national authority, or publicly (when other channels have failed) is unenforceable.
United Kingdom
The UK’s Public Interest Disclosure Act 1998 (PIDA) already protects workers who make protected disclosures qualifying reports about criminal offenses, health and safety dangers, environmental damage, or miscarriages of justice. Any NDA clause that tries to prevent a protected disclosure is void.
The Employment Rights Act 2025, which received Royal Assent in December 2025, goes further. It will make any NDA void if it tries to prevent a worker from speaking about workplace harassment or discrimination. From April 2026, disclosures of sexual harassment explicitly qualify as protected disclosures under PIDA, carrying full whistleblower protections including uncapped compensation for unfair dismissal. Regulations are expected to take full effect in 2027.
NDAs protecting legitimate commercial secrets trade secrets, proprietary data, intellectual property remain valid and enforceable under UK law, as long as they do not extend into areas covered by whistleblower protections.
Real-World Examples
The engineer and the data breach. A backend developer at a mid-sized SaaS company discovers that user data is being stored without encryption, violating both company policy and applicable data protection law. Despite having signed an NDA, this individual can report the issue to a data protection authority the ICO in the UK, a national supervisory authority in the EU, or the FTC in the US without violating the agreement. The NDA covers proprietary code, not evidence of a legal violation.
The departing employee and the job interview. A product manager leaves a tech firm and interviews at a competitor. During the interview, they discuss their general skills and experience managing product launches. The former employer sends a cease-and-desist letter, claiming the NDA was breached. In many jurisdictions particularly California general job knowledge and professional experience are not considered trade secrets, and an NDA that tries to restrict discussing them may be treated as an unenforceable non-compete clause in disguise.
The whistleblower and the SEC. A financial analyst at a tech company notices irregularities in how revenue is being reported. Under the DTSA immunity provision, they can share relevant documents including those marked confidential with the Securities and Exchange Commission or their own attorney, as long as the disclosure is made in confidence and for the purpose of reporting a suspected violation of law.
What People in This Situation Typically Do
- Read the NDA carefully. Many tech workers sign NDAs during onboarding without examining the specific terms. The first step is understanding exactly what the agreement covers and what it does not.
- Identify whether the concern involves illegal activity. If the issue involves fraud, data protection violations, safety hazards, discrimination, or harassment, whistleblower protections likely apply regardless of the NDA’s language.
- Consult an employment attorney before disclosing. An attorney can confirm whether a specific disclosure qualifies for legal protection under the DTSA, PIDA, or the EU Whistleblower Directive. This consultation itself is protected under most whistleblower immunity frameworks.
- Use the proper reporting channels. Protections are strongest when disclosures go through recognized channels a government agency, a regulator, an inspector general, or (in the EU) an internal reporting channel that meets directive standards.
- Document everything. Many people in this situation keep records of what they observed, when they observed it, and how they reported it. This documentation can be critical if an employer later claims retaliation was unrelated to the disclosure.
Related Articles
- Can Your Boss Watch You Work from Home? what workplace surveillance laws actually allow
- CCPA Explained: California’s Privacy Law how California protects personal data and worker privacy
- AI Screening Job Applicants What Are Your Rights? legal limits on AI-driven hiring decisions
Frequently Asked Questions
Can an NDA prevent me from reporting illegal activity?
No. In the United States, the Defend Trade Secrets Act (2016) provides immunity for workers who disclose trade secrets to a government official or attorney for the purpose of reporting a suspected violation of law. In the EU, the Whistleblower Protection Directive (2019/1937) protects reports of breaches of EU law through proper channels. In the UK, the Public Interest Disclosure Act makes any NDA clause that blocks a protected disclosure void.
How long does an NDA last?
It depends on the agreement. Some NDAs specify a fixed term commonly two to five years. Others attempt to impose indefinite confidentiality. Courts in many jurisdictions view perpetual NDAs with skepticism, and an unreasonable duration can be grounds for a court to narrow or void the agreement entirely. Trade secret protections, however, can last as long as the information remains genuinely secret.
Can my employer sue me for violating an NDA?
Yes, if the disclosure involved genuinely confidential business information such as proprietary code, client data, or product roadmaps and the disclosure did not fall under a whistleblower protection or other legal exception. Remedies can include damages, injunctions, and in some cases, attorney’s fees. However, many NDA disputes never reach court. The financial cost of litigation itself often acts as a deterrent, regardless of whether the NDA would actually hold up.
Are non-compete agreements and NDAs the same thing?
No. An NDA restricts what information a person can share. A non-compete agreement restricts where a person can work after leaving a company. They are separate legal instruments, though they are sometimes bundled together in employment contracts. Courts in states like California, Colorado, and Minnesota have struck down NDAs that were drafted so broadly that they effectively functioned as non-competes restricting a worker’s ability to discuss general skills and job experience with future employers.
This article is for educational purposes only and does not constitute legal advice. Laws vary by jurisdiction and change frequently. For advice specific to your situation, consult a qualified attorney.
Sources & Further Reading
- 18 U.S.C. § 1833 Defend Trade Secrets Act, Whistleblower Immunity Provision federal statute providing trade secret disclosure immunity
- EU Whistleblower Protection Directive (2019/1937) full text of the EU directive protecting whistleblowers
- UK Employment Rights Act 2025 NDA Provisions section 202A voiding NDAs that silence harassment and discrimination disclosures
- DOJ and OSHA Joint Statement on NDAs and Whistleblower Protections (January 2025) federal agencies warning against NDAs that deter reporting of antitrust crimes
SEO Metadata
SEO Title:
Meta Description:
Pinterest Title 1: NDA for Tech Workers: What Your Employer Can and Can’t Silence You About Pinterest Description 1: Signed an NDA at your tech job? Know what it actually covers — and where whistleblower protections draw the line under US, EU, and UK law.
Pinterest Title 2: Tech Worker NDA Rights: When Whistleblower Laws Override Your Agreement Pinterest Description 2: NDAs can protect trade secrets but not silence illegal activity reports. Learn your rights as a tech worker under the DTSA, EU Directive, and UK PIDA.
