Most agency NDAs get the same treatment: a template found online, a signature, a folder. The contract says the subcontractor will keep your client's code, credentials and roadmap confidential, and everyone assumes that if the worst happens, the NDA is what you point to. There is a federal rule that decides how much that NDA is worth in court, and it is a single missing paragraph.
This post is about that paragraph. It is general information, not legal advice, and the clause check at the end is something to hand to your own counsel, not a replacement for them.
What is the whistleblower immunity notice in the Defend Trade Secrets Act?
The Defend Trade Secrets Act of 2016 (DTSA) gave companies a federal claim for trade secret misappropriation. In the same law, Congress added a protection for people who report wrongdoing. The text of 18 U.S.C. § 1833(b), as published by Cornell's Legal Information Institute (read on 9 October 2026), says an individual cannot be held criminally or civilly liable under any federal or state trade secret law for disclosing a trade secret in confidence to a government official or an attorney, solely to report or investigate a suspected violation of law, or in a complaint or other document filed in a lawsuit.
The part that touches your paperwork is § 1833(b)(3)(A). It says an employer shall provide notice of that immunity in any contract or agreement with an employee that governs the use of a trade secret or other confidential information. An NDA is exactly that kind of agreement. The notice is a few sentences long, and it has to be in the document or reachable from it.
Does that apply to a subcontractor, or only to employees?
It applies to individual contractors too. Subsection (b)(4) says that for this purpose the term "employee" includes any individual performing work as a contractor or consultant for an employer. So the freelance React developer you bring in for three months counts, even though California and the IRS may separately treat them as a business of one.
What the statute text does not settle is the harder case for agencies: the subcontractor that is a company, with its own staff, whose people never sign anything with you. I did not find a primary source that says how a court treats that, so treat it as a question for counsel. The practical answer is cheap, and it comes later in this post.
What do you lose if the notice is missing?
Section 1833(b)(3)(C) says that if an employer does not comply with the notice requirement, it may not be awarded exemplary damages or attorney fees under § 1836(b)(3)(C) or (D) in an action against an employee to whom notice was not provided.
Those two remedies are the ones that make a federal claim worth bringing. Section 1836(b)(3)(C), also read on Cornell's LII on 9 October 2026, lets a court award exemplary damages of not more than 2 times the damages awarded, when the trade secret was willfully and maliciously misappropriated. Section 1836(b)(3)(D) allows reasonable attorney fees to the prevailing party in the same willful and malicious situation. Lose the notice and those two remedies come off the table against that individual. The claim itself survives. The part that pays for the lawsuit does not.
The statute does not say the notice rule only bites on new paper from some recent year, either. Section 1833(b)(3)(D) applies it to contracts and agreements entered into or updated after the date of enactment, and the amending law is Public Law 114-153, dated 11 May 2016. Any agency template written or revised since then is inside the rule.
What does this look like in an agency?
Picture a 14-person agency that took on a fintech client's mobile build. The client contract has a confidentiality section. The agency's owner then pulls in two freelance engineers for a quarter. The agency's own NDA, copied from a 2019 template, goes out as a one-page PDF. Both sign it. Neither contract mentions a whistleblower.
Eight months later, one of the engineers leaves with a copy of the client's scoring model and starts building a competing product. The agency and client want to sue for willful misappropriation. The point where this agency is weakest is not the facts. It is that the engineer was never given the § 1833(b) notice, so the exemplary damages and attorney fees that would have made a case worth funding are not available against that individual.
The three-year window matters too. Under § 1836(d), a civil action may not be commenced later than 3 years after the date the misappropriation is discovered or should have been discovered with reasonable diligence. You have time to fix paper going forward. You do not have time to find out you needed it after the incident.
What should the clause actually say?
You have two routes under § 1833(b)(3)(A) and (B). One is to state the immunity in the agreement. The other is a cross-reference: the statute says an employer is in compliance if it provides a cross-reference to a policy document provided to the individual that sets out the employer's reporting policy for a suspected violation of law.
In plain English, an in-contract notice has four parts:
- 1.The individual will not be held criminally or civilly liable under any federal or state trade secret law for a disclosure made in confidence to a government official or an attorney, solely to report or investigate a suspected violation of law.
- 2.The same protection applies to a disclosure made in a complaint or other document filed in a lawsuit.
- 3.The notice sits in the agreement that governs confidential information, not in a handbook the contractor never sees.
- 4.It reaches every individual who touches the work, not only the person who signed for the firm.
Have counsel turn that into the paragraph your template uses. I would put it in the NDA and in the confidentiality section of the master subcontract, so there is no version of the paperwork that has one and not the other.
Flowing it down to a subcontractor firm is the step agencies skip, and it is where I would take a firm position: do not rely on the firm's own paperwork to carry your notice. Ask the firm to confirm that its staff on your project have signed confidentiality terms with the notice, or have each named individual sign a short joinder to your NDA. It adds a signature, not a negotiation. The same flow-down logic is why a CCPA subcontractor contract needs terms your client's contract cannot supply, and why code ownership has to be assigned by contract, not assumed.
When is the notice not the problem?
Three cases where tightening this clause is the wrong move. If the person has access to nothing confidential, no clause will matter. If your real exposure is a client's personal data rather than trade secrets, the controlling terms are privacy terms, not an NDA. And if the engagement is a single freelancer and a short project, a lawyer reviewing your template once is all you need; a partner arrangement adds nothing to that.
If you are an agency owner who would rather hand overflow work to a vendor whose staff already sit under signed confidentiality terms, see how our agency partner arrangement works or tell us the scope. Whoever you choose, ask to read the confidentiality terms before anyone sees client code.