Under the Dodd-Frank Act, companies are barred from prohibiting employees from reporting potential securities violations to the SEC. In 2015, the SEC took its first enforcement action against a company for language in NDAs which restricted whistleblowing. 

Rule 21F-17(a) prohibits companies from impeding employees, contractors, and clients from contacting the SEC and other government agencies about a possible securities law violation. 

The rule covers non-disclosure requirements found in contracts or agreements. It applies not only to employees, but also to investors, contractors, and compliance officials. 

The SEC has clearly spelled out in detail what constitutes violative contractual language. The commission even provides alternative language in their enforcement orders for what should instead be included in contracts. 

The commission has fined companies and required remedial enforcement action.