Alex is Sprintlaw's co-founder and principal lawyer. Alex previously worked at a top-tier firm as a lawyer specialising in technology and media contracts, and founded a digital agency which he sold in 2015.
Contents
If you run a small business, you’re probably sharing information all the time - with staff, contractors, suppliers, potential investors, and even customers.
Some of that information is routine. But some of it is commercially sensitive - the kind of detail that gives you an edge in the market, and could seriously hurt you if it ended up in the wrong hands.
This is where protecting commercially sensitive information becomes more than a buzzword. It’s a practical risk-management issue, and it’s something you can (and should) protect from day one.
In this article, we’ll break down what “commercially sensitive information” means in a New Zealand business context, what counts as confidential information, what the key legal risks are, and the practical steps you can take to protect what makes your business valuable.
What Does “Commercial Sensitivity” Mean For A Small Business?
Commercial sensitivity generally refers to information your business holds that:
- has commercial value because it isn’t public; and
- would be useful to a competitor (or harmful to you) if disclosed.
In real life, it’s not only big companies that have commercially sensitive information. Small businesses often have more at stake, because one leaked client list or pricing formula can be enough to wipe out your advantage.
Commercially sensitive information can sit across different parts of your business, including:
- Sales and pricing (pricing models, margin structures, discount rules, tender bids)
- Customer and supplier relationships (client lists, supplier terms, contact databases)
- Operations (processes, workflows, checklists, internal systems)
- Product and IP (designs, formulas, software, prototypes)
- Strategy (marketing plans, launch timelines, growth plans)
- Financials (cash flow forecasts, budgets, funding plans)
Sometimes it’s obvious (like a recipe, codebase, or unreleased product). Other times, it’s a combination of information that becomes valuable when aggregated - like how you segment customers, what you charge, and how you pitch.
Is “Commercially Sensitive” The Same As “Confidential”?
They overlap, but they’re not always identical.
Confidential information is information you intend to keep private and that you treat as private. Commercial sensitivity is about the business impact of disclosure - the “so what?” factor.
So, commercially sensitive information is usually confidential, but confidential information might also include things like personal data (which brings privacy obligations into the picture).
What Types Of Information Are Commonly Commercially Sensitive?
A good way to think about commercial sensitivity is: what would you be worried about if a competitor got a copy tomorrow?
Here are some of the most common categories we see for NZ small businesses.
Customer Lists, Leads, And Relationship Details
For many businesses, the customer database is the business. Even if customer names are publicly available, the way you’ve built and organised those relationships (contact people, buying habits, deal history, contract renewal dates) can be commercially sensitive.
If you collect and store customer information, remember this may also be “personal information” under the Privacy Act 2020. That means protecting it isn’t just good business - it can also be a compliance issue, so having a properly drafted Privacy Policy can matter a lot (especially if you collect data via your website or online store).
Pricing, Quotes, And Tender Information
Your pricing approach can be one of the most commercially sensitive parts of your business, especially if you’ve worked hard to refine it.
This might include:
- your standard pricing and discount rules
- how you quote for projects
- internal pricing calculators
- supplier costs and margins
- tender bids (including drafts and supporting assumptions)
If pricing data leaks, a competitor can undercut you strategically - not just “be cheaper”, but be cheaper only where it hurts most.
Marketing Plans And Launch Strategies
Marketing often involves timing. If someone else knows your next campaign theme, launch date, or product roadmap, they can beat you to market, replicate your messaging, or try to poach your customers.
This kind of commercial sensitivity often comes up when you’re dealing with external service providers (like marketing contractors, agencies, or designers), which is why clear confidentiality clauses in your agreements matter.
Product Designs, Processes, And Know-How
Not every business has registered IP (like patents or trade marks), but almost every business has know-how:
- the way you deliver your service
- your internal SOPs and checklists
- your product sourcing and manufacturing approach
- your training materials
This information often becomes sensitive because it represents time, experimentation, and money you’ve invested.
Financials And Funding Information
Even within your team, financial details should be treated with care. Forecasts, budgets, investor decks, funding terms, and cash flow positions can be commercially sensitive because they affect:
- your negotiating leverage with suppliers
- employee expectations and stability concerns
- your ability to compete for deals
If you’re raising capital or negotiating a sale, controlling how this information is shared (and with whom) becomes even more important.
Why Commercial Sensitivity Matters (And Where Businesses Usually Get Caught Out)
Most confidentiality problems don’t come from a dramatic “data breach” scenario. They come from everyday business realities - growth, staff turnover, collaboration, and informal conversations.
Here are some common risk points for commercial sensitivity in small businesses.
Employees Moving On (Or Being Reassigned)
It’s normal for employees to move on. The risk is when a departing employee takes commercially sensitive information with them - intentionally or accidentally.
This is why your Employment Contract should clearly address confidentiality, and why your offboarding process should include practical steps (like returning devices, removing access, and confirming deletion of company data).
Also keep in mind: confidentiality obligations often continue after employment ends, but restraints of trade (like non-competes) are a separate topic and need to be handled carefully to be enforceable.
Contractors And External Providers
Many small businesses rely on contractors - developers, consultants, designers, sales contractors, virtual assistants. They might have broad access to sensitive information, but they aren’t employees, so you can’t rely on the same assumptions.
This is where a tailored Contractor Agreement (or other services agreement) can do a lot of heavy lifting around confidentiality, ownership of work product, and restrictions on use of your information.
Informal Discussions Before A Deal Is Signed
If you’ve ever pitched a partnership, discussed a potential distribution deal, or explored selling your business, you’ve probably shared sensitive information early - because the other side “needs to understand the opportunity”.
That’s a tricky spot: you want the deal to progress, but you don’t want to give away your playbook.
Often, the simplest solution is to use a properly drafted Non-Disclosure Agreement before you hand over anything substantial.
Poor Information Handling Internally
Sometimes the risk isn’t a person - it’s a system.
For example:
- shared passwords across the team
- customer data stored in personal email accounts
- no access restrictions on sensitive folders
- staff forwarding work emails to personal addresses
- no clear rules about using personal devices for work
Even if you have great contracts, weak internal practices can make it hard to prevent leaks and even harder to prove what happened if there’s a dispute.
What Laws And Legal Concepts Protect Commercially Sensitive Information In NZ?
Commercial sensitivity is protected in New Zealand through a mix of contract law, equitable obligations (like breach of confidence), and specific legislation depending on the type of information involved.
Because this can get technical quickly, it’s usually best to think of it in two layers:
- Prevention: what you put in place upfront (contracts, policies, access controls)
- Enforcement: what you can rely on if something goes wrong
Confidentiality Clauses And Contract Law
The most practical protection for commercial sensitivity is a clear, tailored confidentiality clause in your agreements.
Well-drafted confidentiality terms usually cover things like:
- what “Confidential Information” includes (and excludes)
- how the recipient can use the information (and what they can’t do)
- who they can share it with (if anyone)
- how long confidentiality obligations last
- what happens at the end of the relationship (return, deletion, certification)
- what remedies apply if there’s a breach (including injunctive relief where appropriate)
If you’re dealing with customers, suppliers, contractors, or business partners, it’s common to include confidentiality in a broader Service Agreement rather than relying on email promises.
Breach Of Confidence (Even Without A Contract)
In some situations, New Zealand law can protect confidential information even if there isn’t a signed agreement, based on the concept of “breach of confidence”.
But relying on this is risky for a small business, because disputes become fact-heavy: what was said, what was implied, what was “obviously” confidential, what steps you took to protect it, and whether the information was already public.
In other words: you may still have rights, but enforcement can be more expensive and uncertain.
Privacy Act 2020 (When Confidential Information Is Also Personal Information)
If your commercially sensitive information includes personal information (like customer contact details, employee files, or health data), you’ll also need to comply with the Privacy Act 2020.
The Privacy Act focuses on how personal information is collected, stored, used, disclosed, and kept secure. Even if your main concern is commercial sensitivity, a privacy compliance issue can create legal exposure and reputational damage.
This is why having the right privacy documentation and practices matters, especially as you grow and handle more data.
Fair Trading Act 1986 (Be Careful With How You Use Information)
Commercial sensitivity can also intersect with marketing and sales conduct.
For example, if your business misuses another party’s confidential information, or makes misleading or unsubstantiated claims in advertising (including claims based on internal data), you can create risks under the Fair Trading Act 1986. The key point here is: protecting your own sensitive information is important, but you should also make sure you’re handling others’ information lawfully and ethically.
Clean processes reduce disputes on both sides.
How Do You Protect Commercial Sensitivity In Practice? (A Step-By-Step Checklist)
The best protection is layered. Think of it like locks on a door: one lock is helpful, but several coordinated protections are what really reduce the risk.
1) Identify What’s Actually Sensitive
If everything is labelled “confidential”, then nothing is. Start with a simple internal list of what you consider commercially sensitive, such as:
- pricing formulas and margin data
- key supplier terms
- customer list and CRM exports
- marketing strategy and ad accounts
- software code and product roadmaps
This helps you train your team and makes it easier to prove later that you treated the information as confidential.
2) Control Access (Need-To-Know Only)
Small businesses often run on trust - and that’s a good thing. But from a commercial sensitivity perspective, access should still be “need-to-know”.
Practical steps include:
- separate admin accounts from standard accounts
- limit export rights from your CRM or accounting platform
- use role-based permissions for shared drives
- stop using shared passwords
- remove access immediately when someone leaves
This doesn’t just reduce the chance of misuse. It can also help you demonstrate you took reasonable steps to protect the information.
3) Put The Right Contracts In Place
Contracts are usually the fastest way to make commercial sensitivity enforceable, because you can define what’s confidential and what happens if it’s misused.
Depending on who you’re dealing with, this could include:
- an Employment Contract with confidentiality and IP clauses for staff
- a Contractor Agreement for independent contractors and freelancers
- a Non-Disclosure Agreement before sharing sensitive information in negotiations
- a Service Agreement with confidentiality and data handling obligations for ongoing commercial relationships
A common mistake is relying on a generic template that doesn’t fit your business model. Confidentiality terms need to match the reality of how information is shared in your business (and the types of information that matter).
4) Train Your Team (And Make It Easy To Do The Right Thing)
Even great contracts won’t help much if your team doesn’t understand what’s sensitive and what’s not.
Consider setting clear internal rules around:
- how customer data is stored and shared
- what can be discussed outside the workplace (including on social media)
- what devices and tools can be used for business work
- how to respond if someone requests sensitive information
If you have people, you’ll usually benefit from documenting these expectations in a handbook or policy set (and ensuring it lines up with your employment agreements).
5) Build Confidentiality Into Your Processes (Onboarding, Offboarding, And Beyond)
Commercial sensitivity protection shouldn’t be a one-off event when you sign an agreement. It should be part of your business rhythm.
For example:
- Onboarding: explain what confidential information is, what systems they can access, and what’s off-limits
- Role changes: update access permissions when people move roles internally
- Offboarding: remove access, recover devices, confirm return/deletion of data, and remind them of ongoing confidentiality obligations
These steps help reduce risk and send a clear message: you take commercial sensitivity seriously.
Key Takeaways
- Commercial sensitivity is about information that gives your business an edge and could harm you if disclosed, like pricing models, customer databases, supplier terms, and strategy.
- Small businesses are especially exposed because a single leak can undermine your competitive advantage and damage key relationships.
- The strongest protection usually comes from a combination of practical controls (access management, processes, training) and legal protection (contracts with clear confidentiality obligations).
- Commercially sensitive information can overlap with personal information, so you may also need to think about compliance with the Privacy Act 2020 and have a fit-for-purpose Privacy Policy.
- Don’t rely on informal assurances - if you’re sharing sensitive information with staff, contractors, or potential business partners, make sure your agreements are tailored to your business and drafted properly.
- If a confidentiality issue arises, what you did “from day one” (contracts, labelling, access restrictions, procedures) can make a huge difference to your ability to respond and enforce your rights.
Note: This article is general information only and does not constitute legal advice. For advice about your specific situation, you should speak to a qualified lawyer.
If you’d like help protecting your business’s commercially sensitive information - whether that’s updating contracts, putting an NDA in place, or tightening up your confidentiality clauses - you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.
