1 Definition and scope

Nonpublic information is information that is not freely available to the general public and is subject to some form of access limit, confidentiality duty, or legal restriction. The term is broad rather than fixed: its meaning depends on the setting, the governing law, and the reason the information is being kept from public view. In some contexts, the key issue is secrecy; in others, it is protection from misuse, unauthorized access, or compelled disclosure.

1.1 General meaning

In ordinary usage, nonpublic information is simply information not published or otherwise open to unrestricted access. It may be known to a limited group, such as employees, clients, regulators, or litigants, while remaining unavailable to outsiders. The label does not itself describe the content of the information; instead, it describes the information’s status and the limits placed on its use.

In legal settings, the phrase may cover confidential business data, personal records, privileged communications, government records with restricted access, or market-sensitive corporate information. Different fields apply different tests. A document can be nonpublic for one purpose and still be disclosable for another, depending on statutes, contracts, court rules, or administrative procedures.

1.3 Distinction from public information

Public information is generally accessible without special permission, such as published reports, public filings, or information posted for open viewing. Nonpublic information, by contrast, is not ordinarily available to everyone and may require authorization, a legal exception, or a formal request before it can be shared. The distinction often matters because the legal duties attached to the information change once it becomes public.

2 Categories of nonpublic information

Nonpublic information includes several overlapping categories. The same item can fit more than one category at once, such as a confidential business record that is also proprietary or a protected personal file that is also privileged in part. The classification usually depends on the source of protection and the type of harm that disclosure may cause.

2.1 Confidential information

Confidential information is information intended to remain private and shared only with authorized persons. It may include customer lists, internal reports, personnel records, medical data, or negotiation materials. Confidentiality may arise from workplace policy, contract, statute, or the nature of the relationship between the parties.

2.2 Proprietary information

Proprietary information is information owned or controlled by a business or organization and valuable because it is not generally known. It may include formulas, methods, software code, pricing strategies, technical designs, or business plans. The value of such information often depends on maintaining its limited distribution.

2.3 Privileged information

Privileged information is protected because the law recognizes a special relationship or purpose that justifies nondisclosure. Privilege rules commonly apply in legal practice and litigation, where certain communications or documents are shielded from forced disclosure.

2.3.1 Attorney-client privileged information

Attorney-client privileged information consists of confidential communications between a lawyer and a client made for the purpose of obtaining or giving legal advice. The privilege encourages full and candid discussion. It does not usually protect every fact a client knows, but it may protect the communication of those facts to counsel.

2.3.2 Work product material

Work product material is information prepared in anticipation of litigation or for trial. It may include notes, strategy memos, witness outlines, and similar materials created by lawyers or their agents. Protection is often designed to preserve legal preparation and prevent one side from free-riding on the other’s litigation efforts.

2.4 Sensitive personal information

Sensitive personal information is a subset of personal data that deserves heightened protection because misuse can cause significant harm or embarrassment. It may include health records, financial account details, identity numbers, biometric data, or intimate personal facts. The exact scope varies by law and regulatory scheme.

2.5 Classified and restricted government information

Classified and restricted government information includes materials designated for limited access because of security, law enforcement, or administrative concerns. Some records are classified to protect national security, while others are restricted for privacy, investigation, or operational reasons. Access is usually limited to persons with a lawful need and appropriate authorization.

Protection for nonpublic information may come from several sources at once. A single item may be covered by statute, reinforced by contract, and supported by common law or regulation. The practical effect is that disclosure can trigger multiple legal consequences.

3.1 Statutory protections

Many jurisdictions create express legal protections through legislation. Privacy laws, securities laws, trade secret statutes, public records acts, and records-management rules may define what can be disclosed and what must remain restricted. Statutes often specify penalties, procedures, and exceptions.

3.2 Common law protections

Common law may protect certain confidential relationships and information interests even when no statute directly applies. Courts may recognize duties arising from trust, fairness, misuse of information, or implied obligations. These protections tend to develop through case decisions and vary among jurisdictions.

3.3 Contractual confidentiality

Contractual confidentiality arises when parties agree to limit access or disclosure. Such terms appear in employment contracts, business partnerships, settlement agreements, vendor arrangements, and non-disclosure agreements. Contractual duties can be narrower or broader than statutory ones, depending on the language used.

3.4 Regulatory restrictions

Regulatory systems often impose disclosure limits on regulated entities. Financial institutions, health-care providers, employers, and public agencies may face rules governing storage, transfer, access, and reporting. These rules can operate even when the information is not secret in an absolute sense.

4 Securities law and market misuse

In securities regulation, nonpublic information has special importance because unequal access can distort market fairness. The law often focuses on whether information is material, whether it has been broadly disseminated, and whether a person improperly used it in trading or tipping others.

4.1 Material nonpublic information

Material nonpublic information is information that a reasonable investor would consider important and that has not yet been made public in a manner sufficient for market participants to absorb it. Examples may include merger plans, earnings surprises, major contracts, or significant financial problems. Materiality and public availability are often evaluated together.

4.2 Insider trading rules

Insider trading rules restrict trading on the basis of material nonpublic information when the trader has a duty not to use or disclose it improperly. The rules also commonly address tipping, misuse of confidential corporate information, and deceptive conduct involving market access. Enforcement usually turns on both the nature of the information and the relationship of the person using it.

4.3 Disclosure obligations

Public companies and other regulated entities may have duties to disclose certain information through periodic reports, prospectuses, press releases, or other filings. Until disclosure occurs properly, the information may remain nonpublic. Delayed or selective disclosure can raise compliance concerns if it gives some recipients an unfair advantage.

4.4 Corporate information barriers

Companies often use information barriers, sometimes called “Chinese walls,” to limit the spread of sensitive data within an organization. These controls separate departments, restrict access, and document who may see particular information. They are designed to reduce conflicts of interest, misuse, and accidental leaks.

5 Privacy and data protection

Privacy and data protection law governs the collection, handling, and sharing of nonpublic personal information. The central concern is usually not only secrecy but also fairness, notice, consent, security, and lawful purpose. Compliance often requires both technical safeguards and administrative procedures.

5.1 Personal data handling

Personal data handling includes the collection, storage, use, disclosure, and deletion of information linked to an identifiable person. Laws may require data minimization, secure retention, access controls, and limits on secondary use. Organizations often classify information by sensitivity to determine the level of protection needed.

Consent and authorization may permit disclosure that would otherwise be restricted. Consent rules vary widely, but valid permission generally depends on clarity, knowledge, and voluntariness. In some systems, authorization may also come from statute, guardian approval, employment necessity, or another lawful basis.

5.3 Data breach implications

A data breach can expose nonpublic information to unauthorized parties and trigger notice duties, mitigation steps, and possible enforcement action. The consequences may include identity theft risk, reputational damage, and contractual or regulatory liability. Institutions typically respond by investigating the incident, containing the exposure, and preserving evidence.

5.4 Cross-border information transfer

Cross-border transfer rules govern the movement of nonpublic data between jurisdictions. Different legal systems may impose varied standards for adequacy, safeguards, transfer mechanisms, or government access. Organizations engaged in international operations often need written controls and transfer assessments.

6 Trade secrets and business information

Trade secret law protects valuable business information that is kept confidential and derives economic value from its secrecy. More broadly, business information may be nonpublic even if it does not meet the strict definition of a trade secret. Protection often depends on both the information’s value and the steps taken to guard it.

6.1 Elements of a trade secret

A trade secret generally requires information that is not generally known, has economic value from remaining secret, and is subject to reasonable efforts to maintain secrecy. Common examples include formulas, manufacturing processes, source code, and customer analytics. If secrecy is lost, protection may weaken or disappear.

6.2 Misappropriation

Misappropriation is the improper acquisition, use, or disclosure of protected business information. It can occur through theft, industrial espionage, breach of duty, or unauthorized copying. Remedies may include injunctions, damages, and in some systems enhanced relief for willful conduct.

6.3 Employee confidentiality obligations

Employees often owe duties to protect employer information learned in the course of work. These duties may arise from contracts, policy manuals, loyalty obligations, or statutory rules. Obligations usually continue after employment ends, especially for truly confidential or proprietary material.

6.4 Non-disclosure agreements

Non-disclosure agreements are contracts requiring parties to keep specified information confidential. They define what information is covered, who may receive it, how it may be used, and when disclosure is allowed. Such agreements are common in hiring, negotiations, research, and technology licensing.

7 Government and administrative law

Government records are often subject to public access principles, but many categories remain nonpublic for defined reasons. Administrative law typically balances transparency against privacy, security, law enforcement, and effective administration. Access rules depend heavily on the document type and the requesting procedure.

7.1 Public records exemptions

Public records laws usually include exemptions for materials that should not be released automatically. These may cover personal privacy, internal deliberations, sensitive commercial data, ongoing investigations, or attorney communications. Exemptions are often interpreted case by case.

7.2 National security and classification

National security classification limits access to information whose disclosure could harm defense, intelligence, or security interests. Such systems often use graded levels of classification and require formal authorization for access. Declassification procedures may later move information from restricted to public status.

7.3 Law enforcement records

Law enforcement records may be withheld when disclosure could interfere with investigations, reveal methods, endanger witnesses, or compromise prosecutions. Some records become public later, while others remain restricted for privacy or operational reasons. Access rules commonly vary by stage of the case.

7.4 Access requests and disclosure limits

Individuals may seek nonpublic government information through formal access requests, administrative petitions, or court review. Agencies may disclose only portions of a record, redact sensitive content, or deny access under an applicable exemption. Appeals and oversight procedures often exist to challenge refusals.

8 Litigation and evidence

In litigation, nonpublic information may become relevant even though it would not normally be open to public view. Courts therefore manage disclosure through procedural tools that seek to balance truth-finding, fairness, privacy, and protection of sensitive interests.

8.1 Discovery of nonpublic information

Discovery allows parties to request relevant nonpublic information from each other or from third parties. The requested material may include documents, emails, records, and testimony. Relevance, privilege, burden, and confidentiality often determine whether disclosure is required.

8.2 Protective orders

Protective orders restrict how discovered information may be used, shared, or filed. They can limit access to attorneys, experts, or named individuals and may require secure handling or return of materials after the case ends. These orders are especially common when business secrets or personal data are involved.

8.3 Sealing records

Sealing records keeps certain court filings or exhibits from public inspection. Courts may permit sealing when openness would expose confidential information, privacy interests, or protected business data. Because public access to judicial proceedings is important, sealing is generally treated as an exception rather than the rule.

8.4 In camera review

In camera review is a judge’s private examination of disputed material to determine whether it should be disclosed. This procedure helps resolve claims of privilege, confidentiality, or exemption without broad public exposure. It is often used when the court needs to inspect the content before ruling.

9 Compliance and enforcement

Organizations that handle nonpublic information typically adopt compliance programs to reduce misuse and demonstrate diligence. Enforcement may come from regulators, courts, contracting parties, or criminal authorities, depending on the type of information and the conduct involved.

9.1 Internal information controls

Internal controls may include access restrictions, classification labels, training, password systems, logging, retention schedules, and approval workflows. Effective controls help limit accidental disclosure and make misconduct easier to detect. They also support later claims that the organization took reasonable protective steps.

9.2 Monitoring and auditing

Monitoring and auditing identify whether information handling practices match policy and legal requirements. Reviews may examine access logs, email activity, document sharing, or retention practices. Audits can reveal weak points before a breach or violation becomes serious.

9.3 Civil liability

Civil liability may arise from breach of contract, privacy violations, trade secret theft, negligence, or fiduciary misconduct. Remedies can include damages, injunctions, accountings, and other equitable relief. The exact remedy depends on the source of the duty and the harm caused.

9.4 Criminal penalties

Certain forms of unauthorized disclosure or misuse can lead to criminal penalties, especially when the conduct involves theft, fraud, espionage, or intentional breach of protected systems. Criminal exposure is more likely when statutes specifically define the conduct and require proof of wrongful intent. Penalties may include fines, imprisonment, or both.

10 Exceptions and authorized disclosure

Not all disclosure of nonpublic information is wrongful. Laws and policies often recognize circumstances in which disclosure is permitted, required, or justified. These exceptions are designed to balance confidentiality with legal process, accountability, and public safety.

Disclosure may be authorized when the person or entity with control over the information gives valid consent. Consent can be express or, in some settings, implied from the relationship or circumstances. The scope of consent matters; information may be shared only to the extent permitted.

Courts, regulators, subpoenas, and statutory reporting rules can compel disclosure of information that would otherwise remain restricted. Even then, the disclosing party may have duties to limit production, notify affected persons, or seek protective measures. Compliance with the order or rule is usually essential.

10.3 Whistleblowing protections

Whistleblowing protections may allow disclosure of certain nonpublic information to report wrongdoing, danger, or unlawful conduct. These protections often require good-faith reporting through specified channels or under defined conditions. They do not always authorize unrestricted public release.

10.4 Public interest exceptions

Some legal systems recognize public interest exceptions when disclosure serves a significant societal need, such as preventing harm or exposing misconduct. These exceptions are usually narrow and fact-specific. They often require balancing the value of disclosure against the injury that confidentiality aims to prevent.