Crime and Policing Act 2026 and UK NDAs: What Changed on 29 June 2026

On 29 June 2026, section 250 of the Crime and Policing Act 2026 came into force, extending the reformed identification doctrine — previously limited to economic crimes — to all criminal offences. The Victims and Courts Act 2026, which received Royal Assent on 29 April 2026, adds further statutory prohibitions on what an NDA can lawfully prevent. Together, these developments represent the most significant changes to the UK NDA legal landscape since the Victims and Prisoners Act 2024 came into force on 1 October 2025.

What section 250 of the Crime and Policing Act 2026 does

Corporate criminal liability in English law has historically depended on the ‘identification doctrine’ — the principle that a company could only be held criminally liable where an offence was committed by the ‘directing mind and will’ of the organisation: typically its most senior directors. This narrow test made it extremely difficult to prosecute large companies.

The Economic Crime and Corporate Transparency Act 2023 reformed this position for a defined category of economic crimes — including fraud, bribery, money laundering and sanctions evasion — by replacing the identification doctrine with a broader ‘senior manager’ attribution rule. Under that rule, a company is criminally liable if a senior manager — a person who plays a significant role in the management of the company’s activities or in making decisions about them — commits a relevant offence within the actual or apparent scope of their authority.

Section 250 of the Crime and Policing Act 2026 extends this senior manager attribution rule to all criminal offences, not just economic crimes. From 29 June 2026:

• Any criminal offence committed by a senior manager within the actual or apparent scope of their authority can be attributed to the company.
• The definition of ‘senior manager’ is broad: it includes any individual who plays a significant role in the management of the whole or a substantial part of the company’s activities, or in the making of decisions about those activities — extending well beyond board directors.
• The company’s prior knowledge is not required for liability to attach — it is sufficient that the senior manager committed the offence within the scope of their authority.
• All companies operating in England and Wales are subject to the extended rule, including foreign companies carrying on business there.

How s.250 changes the NDA risk landscape

Section 250 has three direct consequences for UK NDA practice:

• NDAs cannot suppress evidence of senior manager conduct: a clause purporting to prevent a party from disclosing criminal conduct by a senior manager to law enforcement, a regulator, or in legal proceedings is void. Where a company uses an NDA to conceal criminal conduct by a senior manager, the company may itself incur corporate criminal liability — the act of suppression is conduct that can attract the same attribution principle.
• Internal investigation and disciplinary clauses need review: where an NDA restricts disclosure of information about internal compliance or disciplinary matters involving senior managers, businesses should review whether those restrictions could be construed as obstructing the reporting of criminal conduct. A blanket internal-confidentiality clause not expressly carved out for regulatory and criminal reporting is at greater risk of challenge from 29 June 2026.
• Settlement NDAs following senior manager misconduct: settlement agreements containing confidentiality clauses that address conduct by a senior manager require careful review. If the underlying conduct could constitute a criminal offence, a clause prohibiting disclosure to the police or a regulator is void — and, under the new regime, potentially evidence of the company’s own criminal liability.

The Victims and Courts Act 2026: NDA prohibitions

The Victims and Courts Act 2026 received Royal Assent on 29 April 2026. Its NDA-related provisions build on the Victims and Prisoners Act 2024, which came into force on 1 October 2025 and which NDASafe’s Employee NDA already reflects in its mandatory carve-outs.

The key NDA prohibitions under the Victims and Courts Act 2026 are:

• NDAs cannot prevent a victim disclosing to law enforcement: any clause purporting to prohibit a person who is a victim of a criminal offence from reporting to the police or any other law enforcement agency is void.
• NDAs cannot prevent disclosure to a lawyer: a victim must be able to obtain legal advice about the crime and about the NDA itself without breaching the agreement. Any clause preventing disclosure to a qualified legal adviser is void.
• NDAs cannot prevent access to a regulated support service: the victim must be able to access mental health support, counselling, a rape crisis centre, a domestic abuse service or any other regulated support organisation without breaching the NDA.
• NDAs cannot prevent disclosure to a regulator or healthcare provider: reporting the crime to an appropriate regulator and disclosing to a treating healthcare provider are both protected disclosures.
• The prohibition applies regardless of what the NDA says: these carve-outs operate as a matter of statute. A clause in an NDA that expressly attempts to restrict any of these disclosures is void and unenforceable. It does not matter that the parties agreed to it or that the clause is clearly worded.

Practical impact on NDAs from 29 June 2026

For NDAs signed on or after 29 June 2026, four considerations apply:

Why NDASafe templates include these carve-outs by default

Every NDASafe NDA template includes the following mandatory carve-outs, documented in each template’s guidance notes and marked as mandatory in the document itself:

• Whistleblowing carve-out (PIDA 1998): present in all Employee and Freelancer NDAs. A party may make a qualifying protected disclosure under the Public Interest Disclosure Act 1998 regardless of the confidentiality obligations.
• Regulatory disclosure carve-out: present across all variants. A party may disclose to any regulatory body with jurisdiction over their activities, including the FCA, the ICO, the SRA, and sector regulators.
• Crime victim reporting carve-out (VPA 2024 / VCA 2026): present in the Employee NDA and updated to reflect the Victims and Courts Act 2026. A party who is a victim of a criminal offence may report to the police, disclose to a qualified legal adviser, access a regulated support service, and disclose to a healthcare provider — all without breaching the NDA.
• Law enforcement cooperation: present across all variants. A party may cooperate with any law enforcement investigation, court order or legally compelled disclosure.
• These clauses cannot be removed: a customer who deletes a mandatory clause from their downloaded template does so at their own legal risk; NDASafe does not endorse modified versions.

Which NDASafe template to use

The CPA 2026 and VCA 2026 changes are relevant across all NDA contexts. The most directly affected templates are:

• Employee NDA (£29): the most directly affected template. Includes mandatory whistleblowing, regulatory, victim-reporting and law enforcement carve-outs updated to reflect the VCA 2026. Use for employment NDAs, post-termination confidentiality, and settlement agreements with confidentiality clauses covering senior manager conduct.
• Mutual NDA (£29): includes regulatory and law enforcement carve-outs. The right choice for commercial NDAs between businesses where either party employs senior managers in scope of the CPA 2026 attribution rule.
• One-Way NDA, Disclosing (£29): includes standard carve-outs. Where the disclosing party employs senior managers, the NDA must not purport to restrict internal reporting of criminal conduct by those individuals.
• Freelancer NDA (£29): includes whistleblowing and victim-reporting carve-outs for self-employed contractors, including individuals engaged in a capacity that may meet the ‘senior manager’ definition under s.250.
• Complete NDA Bundle (£79): all eight variants with current mandatory carve-outs. The right choice for businesses that use NDAs across multiple contexts and want assurance that all templates reflect the law as at 29 June 2026.