NDA in the UAE: Template, Key Clauses and Local Law (2026)

What an NDA is under UAE law A non-disclosure agreement in the UAE is a contract in which one or both parties promise to keep shared information secret and use it only for an agreed purpose. The UAE has no single dedicated NDA statute, so an NDA rests on general contract law under the Civil Transactions Law (Federal Law No. 5 of 1985, the UAE Civil Code), which enforces lawful agreements freely made between the parties. Around it sit the UAE's data protection law and criminal provisions on disclosing secrets, which together give an NDA real force. Because there is no special NDA statute, the strength of a UAE NDA comes from careful drafting and from choosing the right law and forum. One early decision matters: whether the NDA sits under onshore UAE law and courts, or under a free-zone regime such as the DIFC or ADGM, which have their own laws and English-language courts. ## What local law adds to a generic template Enforceable as a contract. The Civil Code enforces a clear, lawful NDA. The agreement must have a defined purpose, a defined scope of confidential information and a lawful object. Remedies for breach include damages, and a well-drafted NDA helps prove both the obligation and the loss. Protecting secrets and the criminal backstop. Disclosing another party's secrets can also have consequences beyond the contract. UAE law treats the disclosure of confidential information and trade secrets seriously, and in some circumstances it can attract criminal liability, which raises the stakes for a deliberate breach. Confidentiality is also protected in specific settings, such as between an employer and employee. Data protection. The UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) regulates how personal data is collected, used, stored and transferred, and it took effect in January 2022. If the confidential information includes personal data, the NDA must sit alongside that law, and the DIFC and ADGM free zones have their own separate data protection laws. A confidentiality clause does not replace a proper data processing arrangement where one party handles personal data for the other. Onshore or free zone. Decide the governing law and forum deliberately. An NDA tied to the DIFC or ADGM is read by common-law courts in English; an onshore NDA is read by the local courts applying UAE civil law. For cross-border deals, parties sometimes choose a free-zone forum or arbitration for predictability. Reasonable scope and duration. Keep the definition of confidential information and the duration proportionate. An indefinite, all-encompassing obligation is weaker and harder to enforce than a clear, bounded one, with genuine trade secrets protected for as long as they stay secret. ## One-way or mutual, and agreed damages Decide early whether the NDA is unilateral, protecting one discloser, or mutual, protecting both parties. A mutual NDA is standard when both sides will share sensitive material, as in a partnership or acquisition talk. The structure changes the obligations clause, so settle it before drafting rather than editing later. Many UAE NDAs include an agreed compensation or liquidated damages figure for breach, because proving the exact loss from a confidentiality breach is hard. This is useful, but under the Civil Code a court can adjust agreed compensation to reflect the actual loss, so a wildly inflated figure may be reduced. Set a genuine pre-estimate of the likely harm rather than a penalty, and it is far more likely to stand. ## Confidentiality with employees and the overlap An NDA often sits alongside other duties. Employees already owe confidentiality duties under the Labour Law and their contracts, so an NDA with a worker should complement, not contradict, those terms, and any post-employment restraint still has to respect the Article 10 limits on non-competes. When the counterparty is a business, the NDA stands on its own contractual footing. Either way, keep the obligation about genuine confidential information and trade secrets, make the carve-outs clear, and avoid language so broad that a court reads it down. A precise NDA that protects real secrets is stronger than a sweeping one that tries to protect everything. ## A usable template Adapt to your facts and have a UAE lawyer review it. NON-DISCLOSURE AGREEMENT (UAE) 1. Parties. [Disclosing party, trade licence] and [Receiving party]. State whether the NDA is one-way or mutual. 2. Purpose. The information is shared only to [state the permitted purpose]. 3. Definition of confidential information. All non-public information disclosed in any form, marked or reasonably understood as confidential, including [technical, commercial, financial, personal data]. 4. Exclusions. Information that is public without breach, already lawfully held, independently developed, or lawfully received from a third party. 5. Obligations. The Receiving party keeps the information secret, uses it only for the purpose, limits access to people who need it and are bound by equivalent duties, and applies reasonable protection measures. 6. Duration. During the discussions and for [X] years afterwards; genuine trade secrets remain protected for as long as they qualify. 7. Return or destruction. On request or at the end, the Receiving party returns or destroys the information and confirms in writing. 8. Personal data. Where personal data is shared, each party complies with the UAE Personal Data Protection Law, or the applicable free-zone data law. 9. Remedies. Breach may give rise to damages and, where available, injunctive relief. 10. Governing law and forum. [UAE law and the competent onshore courts / DIFC law and courts / ADGM law and courts / arbitration]. Signatures, dated. ## A short walk through the key clauses Purpose and definition do the real work. A tight purpose stops the receiver reusing your information, and a clear definition prevents arguments about what was covered. Governing law and forum is a bigger decision in the UAE than in many countries because of the onshore and free-zone split. Pick the regime that fits the parties and the likely dispute, and keep it consistent with the rest of the deal. Duration and exclusions keep the NDA enforceable: a bounded term and fair carve-outs make a court more willing to enforce the core obligation. ## Red flags to check before signing - A definition of confidential information so wide it covers everything.

• A perpetual, unlimited obligation with no defined term.
• No carve-outs for public or independently developed information.
• Personal data shared with no basis under the data protection law and no processing arrangement.
• A governing-law or forum clause that is vague or inconsistent with the main contract. ## Keeping the obligation under control after signing An NDA in the UAE matters most later, when you need to know who received what, under which purpose, for how long, and whether the term has expired. Drafting a UAE NDA from a clean template, checking that its definition, duration and forum are right and that it links to the data protection law where personal data is involved, and tracking each NDA's purpose and expiry can sit in one AI workspace tuned to how your company handles confidential information. Adira follows that shape: it drafts from a template, models the NDA as linked clauses so it can flag an over-broad definition or a perpetual term, and keeps the purpose, counterparty and expiry date in one place. Adira is India-first today, with jurisdictions set per contract and an international mode for others; in-language Arabic support and deep, verified coverage of UAE law are on its roadmap rather than established, so treat UAE specific output as a draft for a UAE lawyer to confirm. This page is general information, not legal advice.