Crime and Policing Act 2026 and UK NDAs

On 29 June 2026, section 250 of the Crime and Policing Act 2026 came into force, extending the reformed corporate identification doctrine — previously limited to economic crimes — to all criminal offences. This is corporate criminal attribution law, not NDA law, and it is sometimes miscited as if it were the statutory basis for NDA whistleblowing or victim-reporting carve-outs. It isn't. The statutes that actually govern what a UK NDA can and cannot restrict are the Victims and Prisoners Act 2024 (s.17, in force since 1 October 2025) and the Public Interest Disclosure Act 1998. This guide explains what s.250 actually does, and why it should not be cited as an NDA statute.

What section 250 of the Crime and Policing Act 2026 does

Corporate criminal liability in English law has historically depended on the ‘identification doctrine’ — the principle that a company could only be held criminally liable where an offence was committed by the ‘directing mind and will’ of the organisation: typically its most senior directors. This narrow test made it extremely difficult to prosecute large companies.

The Economic Crime and Corporate Transparency Act 2023 reformed this position for a defined category of economic crimes — including fraud, bribery, money laundering and sanctions evasion — by replacing the identification doctrine with a broader ‘senior manager’ attribution rule. Under that rule, a company is criminally liable if a senior manager — a person who plays a significant role in the management of the company’s activities or in making decisions about them — commits a relevant offence within the actual or apparent scope of their authority.

Section 250 of the Crime and Policing Act 2026 extends this senior manager attribution rule to all criminal offences, not just economic crimes. From 29 June 2026:

• Any criminal offence committed by a senior manager within the actual or apparent scope of their authority can be attributed to the company.
• The definition of ‘senior manager’ is broad: it includes any individual who plays a significant role in the management of the whole or a substantial part of the company’s activities, or in the making of decisions about those activities — extending well beyond board directors.
• The company’s prior knowledge is not required for liability to attach — it is sufficient that the senior manager committed the offence within the scope of their authority.
• All companies operating in England and Wales are subject to the extended rule, including foreign companies carrying on business there.

What s.250 does not do

Section 250 does not itself void, restrict, or otherwise govern any NDA clause. It is not a whistleblowing statute, a victim-reporting statute, or an NDA statute of any kind. Guides and marketing copy sometimes cite it as though it were the legal basis for an NDA's crime-reporting carve-out, that is a mis-citation. The actual statutory basis is set out below.

• What voids an NDA crime-reporting clause: the Victims and Prisoners Act 2024 (s.17, in force since 1 October 2025) voids any NDA clause purporting to prevent a victim of crime from disclosing to the police or another appropriate body.
• What voids an NDA whistleblowing clause: the Public Interest Disclosure Act 1998 voids any NDA clause purporting to block a protected disclosure, including reporting a crime, a breach of a legal obligation, or a danger to health and safety.
• What s.250 actually does: it decides whether a company can be held criminally liable for an offence committed by a senior manager. Whether or not an NDA is involved at all, s.250 answers a question about corporate liability, not about contract law.

Why this matters

Confusing corporate-attribution law with NDA carve-out law leads to overclaiming, telling a reader that a clause is void, or that a company faces liability, for reasons that don't actually apply. If a business relies on this kind of guide to understand its NDA obligations, citing the wrong statute risks a false sense of security in one direction and unwarranted alarm in the other. When you need to know what an NDA can lawfully restrict, look to the Victims and Prisoners Act 2024 and the Public Interest Disclosure Act 1998, not to corporate criminal attribution law.

Why NDASafe templates include mandatory reporting carve-outs

Every NDASafe NDA template includes the following mandatory carve-outs, documented in each template’s guidance notes and marked as mandatory in the document itself:

• Whistleblowing carve-out (PIDA 1998): present in all Employee and Freelancer NDAs. A party may make a qualifying protected disclosure under the Public Interest Disclosure Act 1998 regardless of the confidentiality obligations.
• Regulatory disclosure carve-out: present across all variants. A party may disclose to any regulatory body with jurisdiction over their activities, including the FCA, the ICO, the SRA, and sector regulators.
• Crime victim reporting carve-out (Victims and Prisoners Act 2024, s.17): present in the Employee NDA. A party who is a victim of a criminal offence may report to the police and cooperate with the appropriate authorities without breaching the NDA.
• Law enforcement cooperation: present across all variants. A party may cooperate with any law enforcement investigation, court order or legally compelled disclosure.
• These clauses cannot be removed: a customer who deletes a mandatory clause from their downloaded template does so at their own legal risk; NDASafe does not endorse modified versions.