Confidentiality Clauses, Explained (2026)

A confidentiality clause protects the sensitive information one party shares with another during a contract. It defines what counts as confidential, what the receiving party may do with it, and for how long the protection lasts. Almost every commercial agreement contains one, because deals routinely involve exchanging pricing, customer lists, source code, roadmaps, and personal data. This guide explains what the clause does, how it is built, what each side wants, and the mistakes that leave information unprotected. ## Confidentiality clause versus NDA The terms overlap. A non-disclosure agreement (NDA) is a standalone contract whose only job is confidentiality, usually signed before parties share information to explore a deal. A confidentiality clause does the same work but sits inside a larger contract, such as a services agreement, licence, or employment contract, once the relationship is underway. The mechanics are the same. The practical difference is scope and timing. An NDA covers the exploratory phase; the confidentiality clause covers the live relationship. Where both exist, say which controls, because an entire agreement clause in the later contract can accidentally supersede the earlier NDA. ## The building blocks A well drafted confidentiality clause has a predictable structure. - Definition of confidential information. This is the heart of it. The definition can be broad ("all information disclosed by one party to the other") or specific (named categories marked confidential). Broad is easier but can be hard to enforce because it sweeps in trivial information; specific is tighter but risks leaving something out. A common middle path covers all non-public information a reasonable person would treat as confidential, plus named categories.

• Obligations of the receiving party. Keep the information secret, use it only for the permitted purpose, and protect it with at least the same care it uses for its own confidential information.
• Permitted purpose. Information may be used only to perform or receive the contract, not for any other reason. This stops a counterparty using what it learns to compete.
• Permitted disclosures. The receiving party may share with employees, advisers, and contractors who need to know and who are themselves bound by confidentiality.
• Carve-outs. Standard exceptions where the obligation does not apply.
• Compelled disclosure. What to do if a court or regulator orders disclosure.
• Duration. How long the obligation lasts.
• Return or destruction. What happens to the information when the contract ends. ## The standard carve-outs Almost every confidentiality clause excludes information that: - was already known to the receiving party before disclosure, without a duty of confidence;
• is or becomes public through no fault of the receiving party;
• is received from a third party who was free to disclose it; or
• is independently developed by the receiving party without using the confidential information. These carve-outs are fair and standard. A receiving party should insist on them, because without them it could be in breach for using information it already had or that everyone knows. There is usually a separate rule for compelled disclosure: if a law, court, or regulator requires disclosure, the receiving party may comply, but should give notice where lawful so the disclosing party can seek protection, and disclose only what is required. ## Duration: the point most clauses get wrong Confidentiality obligations do not have to end when the contract ends. Two patterns are common. Either the obligation runs for a fixed period after termination (often two to five years), or it continues for as long as the information stays confidential. The second is important for trade secrets and source code, which can lose all value if disclosed even years later. A fixed term is simpler but can leave genuinely secret information exposed once it expires. Match the duration to the information: a fixed term for ordinary commercial data, an indefinite obligation for trade secrets. ## What each side wants The disclosing party wants a broad definition, strong obligations, a narrow permitted purpose, and a long or indefinite duration. It wants the clause to survive termination and to require return or destruction of its information. The receiving party wants a clear and bounded definition so it knows what it is protecting, the full set of carve-outs, a sensible permitted-purpose that lets it actually do the work, and a duration that does not bind it forever on ordinary information. If it processes the information in systems it cannot fully purge, such as backups, it will ask for an exception to the destruction requirement for routine backups kept securely. ## Illustrative wording > "Each party (the Receiving Party) shall keep confidential all Confidential Information of the other party (the Disclosing Party), shall use it only for the purpose of performing this Agreement, and shall not disclose it except to its personnel and advisers who need to know it for that purpose and who are bound by obligations of confidentiality no less protective than these. These obligations do not apply to information that is or becomes public through no breach of this Agreement, was lawfully known to the Receiving Party without a duty of confidence before disclosure, is lawfully received from a third party free to disclose it, or is independently developed without use of the Confidential Information. If required by law or a regulator to disclose, the Receiving Party may do so, provided it gives prompt notice where lawful and discloses only what is required. These obligations survive termination and continue for [three years / for so long as the information remains confidential]." ## Common mistakes to avoid - A definition so broad it is unenforceable, or so narrow it misses key categories.
• No permitted-purpose limit, so the counterparty can use the information for anything.
• Forgetting the standard carve-outs, which makes the clause unfair and harder to enforce.
• A duration that ends at termination, leaving trade secrets exposed.
• No handling for compelled disclosure, so a party breaches simply by obeying a court order.
• Ignoring personal data, which also needs a data protection clause or DPA, not just confidentiality.
• Letting a later contract's entire agreement clause supersede an earlier NDA by accident. ## Keeping confidentiality terms consistent across every contract Most companies use many versions of confidentiality wording, picked up from different templates and counterparties over the years. The risk is drift: one contract has an indefinite trade-secret obligation, the next ends at termination, a third forgets the carve-outs. Seeing that inconsistency means reading the confidentiality clause in every signed agreement and comparing them. An AI contract workspace that extracts the confidentiality position across your portfolio makes the outliers visible, and lets you draft new contracts from one tuned standard. Adira does this in one place: draft, review for risk, and track clauses like confidentiality across documents. More at Adira. The guidance above stands on its own. ## Bottom line A confidentiality clause protects shared sensitive information by defining it, limiting its use to a permitted purpose, allowing standard carve-outs, and setting how long the protection lasts. Match the duration to the information, keep the carve-outs and compelled-disclosure handling, and remember that personal data needs separate data protection terms. Where both an NDA and a contract clause exist, say which controls. Get local advice for trade secrets and cross-border data.