Beyond the NDA:

Building a Real Discretion Culture in a HNW & UHNW Household: The 2026 Playbook

An NDA requires a private employee to keep information confidential.

It cannot decide who should see the family diary.

It cannot stop somebody forwarding an itinerary to the wrong group.

It cannot tell a Housekeeper whether a photograph taken inside a residence reveals something sensitive in the background.

It cannot help a Chauffeur recognise an impersonation message, show a Nanny how to respond to a safeguarding disclosure or give a Household Manager the confidence to report that a device has been lost.

A signed Non-Disclosure Agreement is evidence that confidentiality has been addressed contractually.

It is not evidence that appropriate levels of discretion are operating throughout the household.

So, How Do HNW/UHNW Families Keep Household Staff Discreet?

High-net-worth and ultra-high-net-worth families protect their privacy by treating discretion as a household operating system rather than a clause in an employment contract.

This means:

• giving each person access only to the information they need;
• using approved devices and communication channels;
• setting explicit rules for photographs, social media and location sharing;
• controlling what guests, contractors and temporary staff can see;
• training employees before providing access;
• testing judgement during recruitment;
• creating clear escalation routes; and
• ensuring confidentiality never prevents safeguarding or lawful reporting.

The objective is not to create a household in which everybody is frightened to speak.

It is to create one in which everybody understands what can be shared, with whom, through which channel and for what purpose.

That is the difference between secrecy and professional discretion.

Why an NDA Is Necessary, but Not Sufficient

An NDA remains an important part of the employment framework for private staff.

It can define confidential information, establish continuing obligations after employment and provide contractual remedies when protected information is deliberately misused.

But an NDA is mainly a legal control.

Most privacy failures inside a private household begin as operational failures:

• too many people have access to the family diary;
• work is conducted through personal messaging accounts;
• passwords are shared;
• former employees retain access to calendars or cloud folders;
• guest lists are distributed too widely;
• temporary staff receive no privacy briefing;
• a photograph unintentionally identifies a residence;
• somebody responds to an apparently urgent request without verifying it;
• a mistake is concealed because the employee fears the consequences of reporting it.

These situations are not solved by making the confidentiality clause longer.

They are solved through better household management.

There are also lawful limits to what an NDA can prevent.

In England and Wales, official guidance confirms that an NDA cannot validly prevent a person from reporting a crime to the police or a worker from making a protected whistleblowing disclosure. Changes from 1 October 2025 also made certain confidentiality restrictions unenforceable where they seek to prevent permitted disclosures connected with criminal conduct. (GOV.UK)

A professionally drafted Agreement should therefore protect legitimate family privacy while making clear that it does not prevent safeguarding reports, crime reporting, protected disclosures or access to appropriate legal and professional advice.

Privacy should protect the family.

But should never become a mechanism for concealing harm.

Confidentiality, Discretion and Security Are Not the Same Thing

These terms are often used interchangeably, but in reality, they perform different functions.

Principle	What it means in a private household
Confidentiality	The obligation not to disclose protected information improperly
Discretion	The judgement to recognise what is sensitive and act appropriately
Information security	The systems and controls that prevent loss, misuse or unauthorised access
Safeguarding	The responsibility to protect children and vulnerable individuals from harm
Discretion culture	The shared behaviours that make all four principles work in practice

A discreet professional does more than remain silent.

They notice who is listening. They question why information is required. They avoid unnecessarily naming the Principal. They verify unusual requests. They report mistakes promptly. They understand that the children’s welfare takes priority over instructions to “keep everything within the family”.

This judgement must be recruited, taught, reinforced and supported.

The Modern Household Has a Larger Privacy Perimeter

The traditional idea of household confidentiality has centered on what employees saw or heard inside the residence.

The modern privacy perimeter is far wider.

It can include:

• shared electronic calendars;
• family travel applications;
• private aviation itineraries;
• school and activity schedules;
• medical information;
• photographs of children;
• security systems and alarm codes;
• property plans;
• vehicle tracking;
• staff rotas;
• home automation;
• guest lists;
• online purchasing accounts;
• personal and business payment instructions;
• group chats involving staff across several countries;
• external advisers and Family Office professionals.

The household team may also include permanent employees, rotational staff, travelling professionals, security teams, tutors, medical advisers, dog walkers, tradespeople, event staff and temporary cover.

Every additional person, device and communication channel expands the potential exposure.

Family Offices are already operating in a heightened cyber-risk environment. Deloitte’s Family Office research found that 43% of surveyed Family Offices had experienced a cyberattack during the preceding 12 to 24 months. Among those affected, phishing was the most frequently reported form of attack. Nearly one-third did not have a cyber incident response plan. (Deloitte)

A household employee does not need access to the investment platform to create risk.

Access to a diary, passport copy, telephone number, travel pattern or trusted messaging group may be enough to make a fraudulent approach considerably more convincing.

The Eden DISCRETION Framework

Eden Private Staff recommends building household privacy around ten connected controls.

Together, they form the DISCRETION Framework.

D — Define What Is Confidential

“Everything is confidential” sounds robust, but it is often too vague to guide behaviour.

Employees need practical examples.

A household should define its’ sensitive information categories, which may include:

• family identity and relationships;
• home addresses and property layouts;
• current and future locations;
• children’s schools, routines and activities;
• travel arrangements;
• health and medical information;
• financial matters;
• guest identities;
• security measures;
• access codes, keys and passes;
• photographs and recordings;
• private conversations;
• disputes or family circumstances;
• business and Family Office information.

A simple traffic-light classification can help.

Red information might include live locations, children’s information, passports, medical details, security protocols, financial instructions and complete travel itineraries. It should be restricted to named individuals and approved systems.

Amber information might include operational schedules, guest preferences, vehicle arrangements and supplier information. It can be shared where there is a genuine need.

Green information is material specifically approved for wider operational use or publication.

Classification does not need to become bureaucratic. Its’ purpose is to help employees make consistent decisions when the Principal is not available to answer every question.

I — Restrict Information to Those Who Need It

Discretion is strengthened when employees receive the information required to perform their role—and no more.

A Private Chef may need the number of guests, dietary requirements and service time. They may not need to know the commercial reason for the dinner.

A Chauffeur needs the collection location, timings, route and security instructions. They do not always need the Principal’s full itinerary for the following week.

A temporary Housekeeper may need access to specified rooms. They should not automatically receive the household directory, complete staff rota or children’s schedule.

This is known as need-to-know access.

In practice, it means:

• separating calendars by purpose;
• using role-based group chats;
• restricting sensitive folders;
• avoiding universal shared passwords;
• reviewing access when responsibilities change;
• removing access promptly when employment ends;
• recording who holds physical keys, passes and devices.

Where a Family Office, employing company or other organisation controls personal information, data-protection principles require appropriate security measures to protect the information held. (ICO)

Even where a particular domestic arrangement falls outside parts of organisational data-protection law, need-to-know access remains good privacy practice.

S — Secure Devices, Accounts and Documents

A discreet employee using an insecure system can still expose the family.

Households should establish minimum standards for devices and accounts used for work. Depending on the role and risk profile, those standards may include:

• household-issued telephones or laptops;
• supported and regularly updated devices;
• strong screen locks;
• two-step verification or passkeys;
• separate work and personal accounts;
• password-management software;
• encrypted storage;
• remote device-locking or wiping;
• restrictions on personal cloud backups;
• rules for printing and secure disposal;
• no shared user accounts.

Two-step verification can prevent access even where somebody has obtained the account password. The National Cyber Security Centre recommends enabling it on important accounts, including email and social-media services. (National Cyber Security Centre)

Physical information also needs protection.

A printed itinerary left in a vehicle, a guest list placed in ordinary household waste or a handwritten alarm code stored beside a telephone can be as revealing as an insecure digital file.

The policy should cover paper, keys, access cards, photographs and devices—not just email.

C — Control Communication and Messaging

Many household privacy failures happen through convenience.

A member of staff needs an answer quickly, so they add somebody to a personal messaging group. A passport copy is forwarded without checking the recipient. A payment request appears to come from the Principal and urgency overrides verification.

In March 2026, the National Cyber Security Centre warned that high-risk individuals were being targeted through messaging applications. Reported techniques included impersonating known contacts, adding unauthorised devices, entering group chats without detection and trying to obtain verification or account-recovery codes. The NCSC advises high-risk users to avoid sharing sensitive information through messaging apps, use approved work services where available, enable two-step verification and regularly review linked devices and group members. (National Cyber Security Centre)

A household communication protocol should therefore define:

• which channel is approved for each type of information;
• what must never be sent through a group chat;
• how urgent financial or travel requests are verified;
• whether personal devices may be used;
• who can create or add members to staff groups;
• how frequently group membership is reviewed;
• whether messages must be retained for operational or legal reasons;
• when a telephone call or face-to-face conversation is more appropriate.

Sensitive instructions should not be actioned solely because the message appears to come from a familiar number.

A separate verification route should be used for unusual requests, payments, travel changes, identity documents or security information.

R — Recruit for Judgement, Not Just Agreement

Confidentiality begins before the employee signs the contract.

The recruitment process should test whether a candidate can exercise discretion when the correct response is not written in front of them.

One of the clearest warning signs is excessive disclosure about previous employers.

A candidate may believe that naming prominent Principals, describing private incidents or sharing photographs demonstrates experience.

In reality, it demonstrates what they may one day disclose about the next family.

Professional candidates can explain the scale, complexity and responsibilities of a previous role without compromising the people who trusted them.

Recruitment should therefore examine:

• how the candidate describes former households;
• whether they understand need-to-know information;
• their use of social media;
• how they have handled errors;
• whether they verify unexpected instructions;
• how they respond under pressure;
• whether they understand safeguarding exceptions;
• what previous employers say about their judgement.

Any online vetting should be relevant, proportionate, consistently applied and conducted in accordance with applicable recruitment, employment and data-protection requirements. The ICO’s recruitment guidance applies to employers, agencies and headhunters processing candidate information throughout selection and vetting. (ICO)

Eden’s approach extends beyond qualifications and job history. Candidate assessment considers judgement, emotional intelligence, discretion, communication style and the ability to integrate within a sensitive household environment. (Eden Private Staff)

E — Educate and Onboard Before Granting Access

A new employee should not learn the household’s privacy rules through trial and error.

An induction should take place before unrestricted access is provided.

It should explain:

• who can issue instructions;
• what information the employee will access;
• which systems and devices must be used;
• social-media and photography rules;
• how to respond to journalists or unsolicited approaches;
• guest and contractor procedures;
• safeguarding routes;
• what constitutes an incident;
• how and when to report concerns;
• what happens when the family travels.

Employees should be able to ask practical questions.

Can they identify their job category on LinkedIn?

May they take personal photographs in staff accommodation?

Can they mention the country in which they are working?

What should they do when a family friend asks for the Principal’s arrival time?

Are photographs of food, flowers, vehicles or pets permitted if no person is visible?

Unanswered questions create inconsistent interpretations.

Training should also be refreshed. Rotational staff, temporary cover and employees joining an overseas residence should receive the same core guidance as the permanent team.

The Principal and senior management must model the policy. A household cannot insist on approved systems while routinely sending sensitive instructions to employees’ personal accounts.

T — Control Third-Party and Guest Access

A household’s discretion culture is only as strong as its least-briefed visitor.

Contractors, event staff, beauty professionals, tutors, medical practitioners, delivery drivers, external chefs and temporary employees may enter highly private areas without understanding what the family regards as sensitive.

Third-party controls can include:

• advance identity confirmation;
• sign-in and sign-out;
• restricted areas;
• escorts where appropriate;
• clearly defined working zones;
• temporary access credentials;
• photography restrictions;
• secure Wi-Fi arrangements;
• return of passes and keys;
• deletion or return of information after the assignment;
• proportionate confidentiality agreements where appropriate.

Guest management also requires judgement.

Staff should know whether guest names can be used on radios or messaging systems, who may receive a complete guest list and how to respond when one guest asks about another.

The default response to enquiries should be polite and limited.

A member of staff should not confirm whether a Principal is at home, abroad, expected later or travelling with children simply because the person asking appears familiar.

I — Make Incident Reporting Immediate and Safe

The first few minutes after a privacy incident can determine its seriousness.

A message sent to the wrong person may still be retrievable.

A lost device may be remotely locked.

An unknown group member may be removed.

A fraudulent payment may be stopped.

But this requires the employee to report the problem immediately.

A strong discretion culture distinguishes between:

• an honest mistake reported promptly;
• reckless disregard for an established procedure; and
• deliberate disclosure or concealment.

If every error is met with automatic punishment, staff may hide small incidents until they become major ones.

The policy should identify a primary and alternative escalation contact. This is particularly important if the usual manager is unavailable or connected to the incident.

Employees should know how to report:

• a lost device, key or pass;
• a suspicious request;
• an unauthorised photograph;
• information sent to the wrong person;
• an unknown participant in a group chat;
• unusual contact from the media or a stranger;
• overheard disclosure;
• suspected account compromise;
• a safeguarding concern.

Where a Family Office or employing entity is subject to UK GDPR, certain personal-data breaches must be reported to the ICO within 72 hours of awareness where feasible. Organisations should have processes for detecting, investigating, recording and assessing breaches. (ICO)

The employee does not need to decide whether a breach is legally reportable.

They need to know whom to notify internally without delay.

O — Set Explicit Online and Social-Media Boundaries

“Do not post about the family” is not a complete social-media policy.

A photograph does not need to show the Principal to expose useful information.

It may reveal:

• the interior of a residence;
• a recognisable view;
• a vehicle registration;
• a child’s uniform;
• a luggage label;
• a security camera;
• the date of an event;
• the presence or absence of staff;
• a location embedded in the file;
• another person reflected in glass or a mirror.

The household policy should address:

• identifying the employer;
• following or interacting with family accounts;
• accepting requests from guests;
• location sharing and geotagging;
• photographs inside residences;
• images of children;
• uniforms, vehicles and private aircraft;
• posting during or immediately after travel;
• public job descriptions;
• online reviews of locations used by the family;
• content posted by friends or relatives of employees.

Privacy settings reduce exposure but do not eliminate it.

The NCSC advises social-media users to consider their digital footprint, who can see their posts and whether apparently unnecessary detail could help criminals create convincing phishing or impersonation approaches. (National Cyber Security Centre)

The best rule is not necessarily “no social media”.

It is no unauthorised connection between the employee’s online life and the family’s private life.

N — Never Confuse Discretion with Silence

This is the most important principle.

A household’s privacy arrangements must never prevent an employee from raising a genuine safeguarding concern, reporting criminal conduct or seeking appropriate professional guidance.

Where children are involved, the process should identify:

• the normal safeguarding contact;
• an alternative contact;
• what to do if the concern relates to either of those people;
• how concerns should be recorded;
• when external support must be contacted;
• what to do in an emergency.

The NSPCC advises that a professional should never promise a child that concerning information will be kept secret. A child should be told that the information may need to be shared with somebody capable of helping them. Information can be shared with appropriate professionals where a child is suffering, or at risk of suffering, significant harm. (NSPCC Learning)

This principle should be stated during recruitment and onboarding.

A Nanny who responds to a safeguarding disclosure appropriately is not breaching the household’s culture of discretion.

They are demonstrating it.

Real discretion means sharing sensitive information only with the correct person, for the correct protective purpose.

For a deeper childcare-specific recruitment framework, this article should internally link to Eden’s HNW/UHNW nanny recruitment guidance, which addresses privacy sensitivities, security awareness, judgement, scenario evaluation and structured candidate trials. (Eden Private Staff)

How to Test Discretion During an Interview

Asking, “Are you discreet?” produces very little useful information.

Almost every candidate will say yes.

A better assessment uses realistic situations.

Scenario 1: The Family Friend

“A person you recognise as a close friend of the Principal asks whether the family will be at the country residence this weekend. What do you do?”

A strong candidate does not rely on familiarity. They provide no unnecessary confirmation and refer the request through the authorised route.

Scenario 2: The Urgent Message

“You receive a message from the Principal’s number asking you to send passport copies to a new travel adviser immediately.”

A strong candidate pauses, uses an independent verification method and does not allow urgency to override procedure.

Scenario 3: The Previous Employer

“Tell us about the most high-profile household in which you have worked.”

A strong candidate explains responsibilities and complexity without identifying the family or sharing private anecdotes.

Scenario 4: The Accidental Disclosure

“You realise that you have sent tomorrow’s itinerary to the wrong group. What do you do?”

Look for immediate reporting, containment and honesty—not denial or attempted concealment.

Scenario 5: The Child’s Confidence

“A child tells you something concerning and asks you to promise not to tell anybody.”

The candidate should respond calmly, avoid promising secrecy, preserve the child’s trust as far as possible and follow the safeguarding route.

Scenario 6: The Social Photograph

“You take a photograph during your break and later notice that part of the family residence and a vehicle are visible.”

A strong candidate recognises that the absence of the Principal from the photograph does not make it safe to publish.

What Should You Ask Referees?

A generic reference confirming dates of employment is not enough for a role involving significant private access.

Where the referee is willing and legally able to respond, useful questions include:

• Was the candidate trusted with sensitive information?
• How did they exercise judgement around guests and family members?
• Did they respect professional boundaries?
• How did they respond when they made a mistake?
• Were there concerns about photographs, devices or social media?
• Could they distinguish urgent requests from verified instructions?
• Would you trust them with a private diary or children’s routine?
• Would you re-employ them in a similarly sensitive position?

The purpose is not to invite disclosure about the previous family.

It is to understand the candidate’s conduct.

The 10-Point HNW/UHNW Household Discretion Checklist

A Principal, Chief of Staff or Family Office adviser should be able to answer yes to the following:

1. Have we defined what information is considered sensitive?
2. Does each employee receive only the access required for their role?
3. Are work devices, accounts, passwords and documents properly secured?
4. Have we approved specific communication channels and verification rules?
5. Do recruitment interviews test judgement through realistic scenarios?
6. Is every permanent, rotational and temporary employee properly inducted?
7. Are guests, contractors and external specialists subject to access protocols?
8. Can employees report an incident immediately without uncertainty?
9. Are social-media, photography and location-sharing rules explicit?
10. Are safeguarding and lawful reporting routes protected from confidentiality restrictions?

A “no” does not necessarily mean that the household has suffered a breach.

It identifies where preventable risk remains.

How Eden Private Staff Recruits for Discretion

Discretion cannot be established from a CV alone.

It must be assessed through the candidate’s history, language, behaviour, references, judgement and understanding of professional boundaries.

Eden Private Staff can support Principals and Family Offices by:

• defining the privacy exposure attached to the role;
• controlling how much family information is disclosed during the search;
• assessing candidates’ judgement through structured scenarios;
• examining how candidates describe previous employers;
• undertaking relevant checks and references;
• testing alignment with the household’s culture;
• incorporating privacy expectations into the candidate brief;
• supporting a structured transition into the household.

Eden recruits across the complete private household and Family Office structure, including Nannies, Governesses/Tutors, Maternity Nurses, Housekeepers, Private Chefs, Chauffeurs, Butlers, Domestic Couples, Household Managers, Estate Managers and Directors, Gardeners, Private PAs and EAs, Chiefs of Staff and senior Family Office professionals.

Privacy risk does not sit within one role. It moves between the household, the Family Office, the properties, the vehicles, the children’s schedules, the guest programme and the Principal’s travel.

For more than 25 years, Eden Private Staff has supported HNW and UHNW clients with discreet private staff recruitment in the UK and internationally. Its’ approach prioritises judgement, cultural fit, risk reduction and long-term suitability—not simply speed of placement. (Eden Private Staff)

Final Thought: Trust Must Be Designed

The most discreet households are not always those with the longest contracts or the strictest language.

They are the households in which good judgement is recruited, information is controlled, expectations are understood and employees know exactly what to do when something goes wrong.

An NDA establishes an obligation.

A discretion culture makes that obligation real.

For Principals, Family Offices, lawyers and advisers, the most valuable question is therefore not:

“Has every employee signed an NDA?”

It is:

“Have we built a household structure in which privacy can hold under pressure?”

Frequently Asked Questions

How do HNW/UHNW families keep household staff discreet?

HNW/UHNW families protect their privacy through a combination of careful recruitment, role-based information access, secure communication, social-media rules, staff onboarding, third-party controls and clear incident-reporting procedures. An NDA supports this structure but cannot replace it.

Is an NDA enough for private household staff?

No. An NDA creates a contractual confidentiality obligation, but it does not prevent operational mistakes, insecure messaging, excessive access, weak passwords or poor judgement. It should sit within a wider household discretion policy.

What should a private staff social-media policy cover?

It should address employer identification, photographs inside residences, children’s images, geotagging, travel posts, vehicles, uniforms, family accounts, guest interactions and public descriptions of current or former roles.

Should all household staff have access to the family diary?

No. Employees should receive only the information required to perform their duties. Full diary access should be limited to roles that genuinely need it, such as an authorised Private PA, EA, Chief of Staff or Household Manager.

How can a family test discretion during recruitment?

Use scenario-based questions, detailed references and structured assessment. Observe how the candidate discusses previous employers, handles unexpected requests, responds to mistakes and distinguishes confidentiality from safeguarding.

Is naming a previous high-profile employer a warning sign?

It can be. Candidates should be able to describe the responsibilities and complexity of a role without unnecessarily identifying or exposing the former Principal.

Can an NDA prevent a Nanny from reporting a safeguarding concern?

No household policy should seek to do so. Safeguarding concerns must be handled through the appropriate internal or external route. Employees should never be instructed to keep potential harm to a child “within the family”.

What should staff do after accidentally sharing confidential information?

They should report the incident immediately through the agreed escalation route. Prompt action may allow access to be withdrawn, messages recalled, devices secured or affected parties informed.

Do confidentiality rules apply to temporary staff and contractors?

They should. Temporary workers, suppliers, event teams and contractors may access sensitive spaces or information and should receive proportionate privacy, access and conduct instructions before beginning work.

How can Eden Private Staff help?

Eden can help define the role’s privacy exposure, conduct a discreet Search, assess candidate judgement, undertake relevant vetting and references and align the successful candidate with the household’s operating culture.

This article provides general recruitment and household-management guidance. Employment contracts, data-protection measures, cybersecurity arrangements and safeguarding procedures should be reviewed by appropriately qualified advisers in the relevant jurisdiction.

At Eden Private Staff, we have been placing Maternity Nurses, Nannies, Governesses, House Managers, Chauffeurs, Personal Assistants, Executive Assistants, Gardeners, Domestic Couples, Allrounders & All family office professionals with HNW & UHNW families for nearly 30 years. If you are preparing to hire and would like guidance on structuring your process, we are happy to help.

You can contact Eden Private Staff on +44 (0) 2074716000 or email info@edenprivatestaff.com