Ask a finance broker what their most valuable asset is and the answer is usually “my book”. Ask which document protects it and you get a pause. Most brokerages have a confidentiality clause buried somewhere in the aggregator agreement, which binds the broker, and nothing at all binding the offshore assistant who opens every client’s bank statements. Claim Done generates a non-disclosure agreement built around what a brokerage actually holds, for a flat A$49, and you can start one in a few minutes.
This is not really a paperwork problem. It is a question of who can be held to something when information moves, and in broking it moves constantly.
The three counterparties, and none of them is your client
Your client never signs your NDA. They are the person whose payslips, bank statements, identity documents and loan history you are protecting. The signatures you need come from three other places.
First, anyone who processes files for you: a local para-broker, a virtual assistant, an offshore processing team, a contract loan writer. Second, referral partners. Accountants, buyer’s agents, conveyancers, financial planners and real estate agents all see something of how you work, and you see something of their client base. Third, the other side of a transaction involving the business itself: a broker buying or selling a trail book, a new broker joining under your licence, or a merger conversation that never proceeds.
Three relationships, three different documents. Treating them as one generic template is how a brokerage ends up with an NDA that protects nothing in particular.
Privacy law will not do this job for you
A common assumption is that the Privacy Act already covers it. Check the threshold before you rely on that. The OAIC states that “a small business is one with an annual turnover of $3 million or less” and that annual turnover “includes all income from all sources”. Businesses under that line sit outside the Act unless they fall into one of the listed exceptions, which the OAIC sets out on its small business page.
Read that list carefully. It names health service providers, credit reporting bodies, residential tenancy database operators, reporting entities under the AML/CTF Act, businesses accredited under the Consumer Data Right and several others. “Mortgage broker” is not a category on it. Some brokerages will be caught by turnover or by one of those exceptions. Some will not, and they are running on nothing but whatever their contractors signed.
Now suppose you are covered. The Act still regulates what you do with personal information. It does not hand you a remedy when a contractor walks out with your referrer list, your commission splits, your lender panel notes or the spreadsheet showing which introducers actually convert. None of that is personal information. It is your commercial material, and a contract is the only thing that binds anyone to leave it alone.
The same asymmetry runs through the breach rules. Under the Notifiable Data Breaches scheme, any organisation the Privacy Act covers “must notify affected individuals and the OAIC when a data breach is likely to result in serious harm”. That is a duty you owe. It is not a right you hold. If the leak came off a contractor’s personal laptop, the obligation to notify is still yours, and what you can recover from that contractor depends entirely on what they put their name to.
Licence obligations point upward, not sideways
Credit licensees carry a long list of ongoing duties. ASIC’s summary of ongoing credit licence obligations includes acting efficiently, honestly and fairly, being competent and ensuring representatives are competent, “having adequate resources (including financial, technological and human resources) and risk management systems”, “having appropriate arrangements and systems to ensure compliance”, AFCA membership, and lodging an annual compliance certificate.
Every one of those obligations is owed to ASIC. Not one of them gives you anything to enforce against the person who leaked the file. That is the point most brokers never quite put into words: a regulatory obligation runs upward to the regulator, while an NDA is the only instrument that runs sideways to the counterparty. You need both, and they do completely different work.
Ready to put it in writing?
Claim Done generates your non-disclosure agreement from your evidence for a flat A$49. You review and approve it, then it is sent by email. No lawyer's retainer, no subscription.
Offshore and outsourced processing: the clauses that earn their place
Offshore support in Australian broking is ordinary now rather than novel, and the regulator has noticed where the risk sits. On 8 May 2026, ASIC Commissioner Simone Constant told the industry to “act now, and act with discipline” on cyber resilience, and ASIC called for actively managing third-party risk “particularly where external providers introduce systemic exposure”. Broking, as Mortgage Professional Australia reported, sits “at the intersection of multiple data flows: lender systems, CRMs, serviceability calculators, identity verification tools”. The FBAA had already told members not to enter client or personal information into publicly available AI tools.
An NDA for a processing contractor has to do more than say “keep things confidential”. At a minimum it needs to:
- Define confidential information to include both client material (payslips, bank statements, identity documents, credit reports) and your own commercial material (referrer lists, commission arrangements, pricing notes, pipeline data).
- Name the systems the work may happen in, and prohibit the rest. No personal email, no personal cloud storage, no public AI tools, no local copies living outside the CRM.
- Ban copying and retention, and require deletion or return at the end of the engagement, with written confirmation that it has actually happened.
- Require your written consent before any part of the work is sub-contracted or moved to a different provider.
- Oblige the contractor to tell you about a suspected breach, in writing, within a set number of days, so that you can meet your own reporting duties on time.
- Survive the end of the engagement for a stated period.
That last clause gets dropped more often than any other, and it is the one that matters on the day somebody leaves.
Referral partners: the problem runs both ways
A one-way NDA is the wrong shape for a referral relationship. The accountant sending you clients learns your commission structure and your turnaround times. You learn their client base and their fee model. Make it mutual, then decide deliberately whether the existence of the relationship is itself confidential, because plenty of brokers want to name their referral partners in marketing and only find out later that they signed something stopping them.
Keep confidentiality separate from the commercial terms. A referral fee arrangement, the disclosure obligations that go with it, and the confidentiality promise are three different things. Bundle them onto one page and you renegotiate all three every time one of them changes.
Selling a book, or a broker joining and leaving
Nobody should see your trail report, your run-off history or your client list before signing. That NDA goes in place before the data room opens, not after the first conversation about price. It should say what the recipient may do with the numbers, that they may not approach your clients or your referrers, and that everything comes back or gets destroyed if the deal does not proceed.
When a broker leaves, be clear about what a confidentiality obligation can and cannot reach. It stops them using your file notes, your CRM exports and your pricing work. It does not stop them ringing a client they personally built a relationship with. A restraint of trade clause is a different clause with different enforceability, and pretending the NDA covers it produces a letter you cannot back up.
A ten-minute audit of what you already signed
Pull out the contractor agreement or the referral document you are using now and check six things:
- Does it define confidential information, or does it just use the word?
- Does it cover your commercial material, or only client personal information?
- Is there any obligation to delete or return material at the end?
- Does it name permitted systems, or is it silent about where the work happens?
- Is there a survival period after termination?
- Does the other party have to tell you when something goes wrong?
Three or more answers of “no” and the document is decoration.
Getting it in place, and what it costs
Claim Done builds the document from the facts you give it: who the parties are, what is being shared, how long the obligation lasts, what has to happen at the end. The NDA is a flat A$49, with no retainer and no subscription. You answer the questions, Claim Done’s document engine drafts it, you read it and approve it, and then it is sent to you by email. Every document and its price sits on the pricing page.
Which document you want depends on the relationship. For a referral partner or a book sale, the non-disclosure agreement is the one. For a processing contractor or a para-broker you want an independent contractor agreement as well, because an NDA handles confidentiality and nothing else: not scope, not payment, not intellectual property, not worker status. If someone has already sent you their template and you want to know what you would be agreeing to, the contract and agreement reviewer reads it and explains it in plain English.
Claim Done is not a law firm and does not give legal advice.
If your offshore assistant, your best referrer or the broker you are about to bring on has never signed anything, start with the one costing you the most sleep. Go to Claim Done and start your NDA. You answer a short set of questions about the parties and what needs protecting, the document is drafted from those answers, and once you have read it and approved it, it arrives in your inbox ready to send to the person who should have signed it months ago.
Frequently asked questions
Is an NDA the same thing as a non-compete or restraint clause?
No, and conflating them is a common and expensive mistake. An NDA governs what someone may do with information they were given: your referrer list, your pricing work, your client files. A restraint of trade clause attempts to limit who they may work for or approach afterwards, and it is judged on very different grounds. If you want both, they need to be drafted as separate clauses doing separate jobs.
My aggregator agreement already has a confidentiality clause. Isn't that enough?
That clause binds you to the aggregator. It does nothing to the virtual assistant, the contract loan writer or the accountant who refers to you, because none of them is a party to it. Confidentiality obligations only reach the people who sign them, so you need a document with each counterparty who sees your files.
Does an NDA work if my processing contractor is overseas?
It still does real work. A signed agreement sets the standard, gives you a basis to terminate immediately, and lets you show a lender or the regulator what controls you had in place. Enforcement across borders is harder and slower than enforcement at home, so pair the agreement with practical controls: named systems only, no local copies, access revoked the day the engagement ends, and written confirmation of deletion.
When should the NDA be signed if I am selling my trail book?
Before the buyer sees anything beyond headline numbers you would be comfortable making public. The document should cover the trail report, run-off history and client data, restrict the buyer from approaching your clients and referrers, and require return or destruction of everything if the sale does not complete. Signing it after the data room has been opened protects very little.
What changes when it is in writing
Same problem. What a prepared case looks like.