How to Use a Volunteer Confidentiality Agreement

If your volunteers ever encounter information they shouldn't be sharing with the outside world, you need a confidentiality agreement. That sounds obvious when you say it out loud, but a surprising number of nonprofits skip this step because the conversation feels awkward or because they assume goodwill is enough.

Goodwill is great. It doesn't hold up in court, and it doesn't help when a well-meaning volunteer shares a client's situation with someone else without realizing it was a problem. A confidentiality agreement is what makes the expectation explicit, gives volunteers a framework for judgment calls, and gives your organization a documented basis for addressing problems if they arise.

This article covers when you need one, what to put in it, and how to introduce it in a way that doesn't make your volunteers feel like they're signing documents before being allowed to enter a law firm.

When a confidentiality agreement is actually necessary

Not every volunteer role requires a formal confidentiality agreement. If someone is helping set up chairs at a fundraiser, there's probably no confidential information they'll encounter, and adding paperwork to that relationship doesn't serve anyone.

The clearer cases are programs where volunteers come into contact with:

Client or patient information. Healthcare settings, legal aid organizations, social services programs, shelters, and counseling programs all involve information that has a legal protection layer in addition to an ethical one. If you're working in a healthcare-adjacent context, there's a reasonable chance HIPAA applies, which raises the stakes considerably.

Financial or organizational information. Volunteers who help with bookkeeping, grant writing, or donor management often see information your organization has legitimate reasons to keep internal.

Information about children or vulnerable adults. Beyond privacy considerations, these populations often have additional legal protections, and volunteers who work with them should understand explicitly what they can and can't share. This overlaps with the broader framework in managing volunteers who work with children.

Internal organizational matters. This one is softer, but if a volunteer serves in a capacity where they hear about personnel decisions, board discussions, or strategic plans, having them understand what "confidential" means in that context is reasonable.

If you're uncertain whether your program falls into one of these categories, err on the side of including an agreement. The downside of having one when you didn't strictly need it is minimal.

What a confidentiality agreement should cover

A volunteer confidentiality agreement doesn't need to be long, and it shouldn't read like a corporate NDA. The goals are clarity and acknowledgment, not legal intimidation.

The core elements are:

What information is confidential. Be specific. "Client information" is better than "organizational information." "Any information about the individuals we serve, including names, situations, and case details" is better still. The more precisely you define it, the less room there is for a volunteer to genuinely not realize something qualified.

What they can and can't do with it. They shouldn't share it with people outside the organization. They shouldn't discuss it in public spaces where others might overhear. They shouldn't post about specific cases or situations on social media. Write out the actual behaviors, not just the principle.

What to do when they're unsure. This is the part most organizations forget. Confidentiality agreements that only tell people what not to do leave volunteers without guidance on the judgment calls. Adding a line like "when in doubt, ask your coordinator before sharing anything" gives them a clear path.

The duration. Most confidentiality agreements for volunteers specify that the obligation continues after the volunteer relationship ends. If someone stops volunteering with you and three months later mentions a client's situation to a neighbor, you still want a basis to address that.

Acknowledgment and signature. A simple signature block with the date is enough. The point is that the volunteer saw it, read it, and acknowledged they understood.

You don't need a lawyer to draft a basic version of this, though if your organization operates in a regulated sector (healthcare, childcare, legal services), getting a quick review from someone familiar with your sector is worth the cost.

How to introduce it without the awkward

The most common reason coordinators avoid confidentiality agreements is that they feel like a heavy-handed way to start a volunteer relationship. And if you hand someone five pages of dense legal language before they've even had a chance to learn what they'll be doing, that's fair.

The framing makes a big difference. A confidentiality agreement introduced as "here's what we ask everyone to keep private, and why" lands very differently than one that feels like a prelude to interrogation.

A few things that help:

Explain the why before you hand it over. "We work with people who are in difficult situations, and they trust us to keep their information private. We ask all of our volunteers to read and sign this so everyone is on the same page about what that means." That's the whole explanation. It's honest, it's brief, and it grounds the document in a value rather than a legal formality.

Put it in the right place in onboarding. The confidentiality agreement should come after volunteers understand the program and the role, not before. Once someone understands what they'll be doing and why it matters, a request to protect sensitive information feels like a natural extension of that rather than a surprise obstacle.

Read through it together, or invite questions. If the agreement includes terms that might be confusing, don't just hand it over and expect people to figure it out. A quick walkthrough of the main points lets you answer questions in real time and signals that you want them to actually understand it, not just sign it.

Pair it with your standard volunteer waiver or release form and any other acknowledgments you collect during onboarding. Doing all the paperwork in one pass is less disruptive than spreading it across multiple interactions.

Storing and managing the agreements

Keep a copy of every signed agreement in your volunteer records. If you're using any kind of volunteer management software, there's often a way to attach documents to individual volunteer profiles. If you're working from spreadsheets and folders, a simple naming convention (Firstname-Lastname-confidentiality-YYYY) and a dedicated folder is sufficient.

The agreement only does its job if you can produce it when you need it, which hopefully never happens but occasionally does. Being organized about where it lives costs you almost nothing.

When something goes wrong

If a volunteer shares information they shouldn't have, a signed confidentiality agreement gives you a clear basis for a conversation. It doesn't guarantee the conversation is easy, but it means the expectation was documented rather than assumed.

Most situations won't be malicious. They'll be someone who didn't think of a comment as "sharing information" rather than someone intentionally violating a trust. A good confidentiality agreement and a clear onboarding process reduce those inadvertent situations significantly, because they help volunteers develop better intuitions about where the line is. The broader guidance in protecting volunteer data is a useful companion read here, since some of the same principles apply to how you handle the information itself.

The goal isn't to create suspicion. It's to create clarity. That's what a good confidentiality agreement does, when it's written plainly and introduced honestly.