Client information is confidential unless the client made it public or agreed to release it, and the client must be told in advance what will be published.
What applies today
The body is responsible for managing all information obtained or created during certification, and that responsibility must rest on legally enforceable commitments. Information the client has made public, or information released with the client's agreement, falls outside the confidential category. Everything else is proprietary and must be treated as confidential. Before information goes into the public domain, the client has to be told what will be published. Where a statute or a contract obliges the body to disclose private material, it must tell the client or the person affected, unless the law forbids that. Information about a client that comes from someone else, such as a complainant or a regulator, is also confidential.
Why it matters
Certification bodies hold product designs, process data, failure reports and commercial plans. The clause makes the body a custodian, not an owner. The advance-notice duty is easy to miss: a body can publish a directory entry or a certificate summary that the client did not expect. The clause is also the bridge to the records rules and to the people who sit on committees but are not employees.
The public FDIS contents lists clause 4.5 as Confidentiality. The FDIS requirement wording is not held, so the requirement above is the 2012 text that applies until publication.
Where this clause lands in the revision
This is a general requirement. The public contents keeps its number and title, so the 2012 wording remains the basis of an assessment until the new edition is published. A first artefact an assessor commonly asks for here is signed confidentiality undertakings for every category of person. The party this touches first is Every person who handles client information, including committee members and external bodies.
What the assessor asks for
| Category | Artefact to have ready |
|---|---|
| Commitments | Signed confidentiality undertakings for every category of person |
| Data map | Record of systems, locations and access for client information |
| Publication notice | Client-facing statement of the information placed in the public domain |
| Disclosure file | Legal or contractual disclosure with the notice given, or the legal prohibition |
One common question. follow a client file from receipt to archive and ask who could read it at each step. A committee pack sent by ordinary email is a frequent gap.
Common failures
- External committee members sign no confidentiality commitment
- The directory publishes more than the client was told
- A regulator request was answered without notifying the client
- Client files sit on a shared drive open to the sales team
Prepare before publication
List every person and body that can see a client file, including committee members and IT contractors. Match each to a signed commitment.
Dates that matter
The public record gives stage 50.20 on 4 August 2026 and voting to 27 October 2026. The planning date, 15 February 2027, is an estimate from that stage and not an ISO date, and clause 4.5 has no separate date.
Cross-references
4.1.2 Certification agreement · 5.2 Mechanism for safeguarding impartiality · 6.1.1 Certification body personnel: general · 7.12 Records
Source
Source for 4.5: ISO/IEC 17065:2012, Clause 4.5, with the ISO/IEC FDIS 17065 public record. Our statement, not the instrument verbatim; the FDIS wording is not held.
Not legal advice; does not certify. A reading of the requirement and the evidence an assessor commonly samples, not a substitute for the standard or your accreditation body's rules.