The confidentiality clause in a non-disclosure agreement (NDA) under India law

Standard Position

In Indian NDAs, the confidentiality clause is the core operative provision that defines what information qualifies as confidential, who is bound, and what obligations attach. Under Indian law, a confidentiality clause must clearly identify the subject matter (Confidential Information), specify the recipient's duties, and outline permitted uses. The standard market position in India mirrors global practice but reflects the Indian Contract Act, 1872 (ICA) principles: the clause should impose a duty of care on the receiving party, restrict disclosure to need-to-know personnel, and permit limited exceptions.

Indian courts interpret confidentiality clauses strictly according to Section 10 of the ICA (offer and acceptance) and the principle of consensus ad idem (meeting of minds). A confidentiality clause creates a contractual obligation enforceable under Section 73 (damages for breach) and Section 74 (limitation of damages) of the ICA. The clause must be sufficiently certain to be enforceable; vague or overbroad confidentiality language risks being struck down as unreasonable restraint under Section 27 of the ICA or as opposed to public policy.

Legal Basis

Section 10 of the ICA requires agreement on essential terms; the definition of Confidential Information must be clear enough to satisfy this. Section 27 restricts agreements that restrain a person from earning a livelihood; overboard confidentiality periods (e.g., perpetual restrictions on general knowledge) may infringe this. Section 73 allows damages for breach, but the receiving party may invoke Section 72 if they received the information from a third party without breach of duty.

The Information Technology Act, 2000, and the Data Protection regulatory framework (now transitioning to the Digital Personal Data Protection Act, 2023) may intersect if the Confidential Information includes personal data. This creates an additional layer: NDAs must not conflict with data protection duties.

Drafting and Negotiation

A robust confidentiality clause in an Indian NDA should:

1. Define Confidential Information precisely: specify that it includes technical data, business plans, financial information, and customer lists, but expressly exclude information that is (a) publicly available (not through breach), (b) independently developed, (c) lawfully received from a third party without confidentiality obligation, or (d) required to be disclosed by law or court order (with notice and mitigation obligations).

2. Specify the standard of care: require the recipient to protect the information with the same care they apply to their own confidential information (reasonable-care standard), or with a higher standard if negotiated (e.g., industry-standard security).

3. Limit duration: Indian courts prefer finite terms. A common negotiated position is 3-5 years from disclosure; perpetual restrictions on general knowledge are disfavored.

4. Clarify permitted uses: narrow the permitted use to the stated purpose (e.g., evaluation, negotiation). Any derivative use or broader commercial application must be separately permitted.

5. Address compelled disclosure: require the recipient to notify the discloser if compelled by law, court, or regulatory authority to disclose, allowing the discloser to seek protective orders.

Common negotiation points: receivers typically resist indefinite confidentiality terms and seek broad exceptions for information developed independently. Disclosers push for stricter care standards and longer terms. A balanced position: 5-7 year confidentiality for business information, indefinite for trade secrets (as defined under the Trade Secrets Act, 2000, a part of the Design Act framework).

Common Pitfalls

1. Overly broad definitions of Confidential Information that sweep in public domain knowledge create unenforceability risk under Section 27.
2. Failure to address statutory disclosure (e.g., under GST, Companies Act, or Labour law) creates ambiguity; always include a "compelled disclosure" carve-out.
3. Vague care standards (e.g., "best efforts") are harder to enforce; "reasonable care" is more enforceable in Indian courts.
4. Perpetual restrictions on the recipient's use of general skills or knowledge acquired incidentally may be deemed restraint under Section 27.
5. Omitting details on return/destruction of information can lead to disputes; always specify timelines and certification requirements.

Sample language

The Receiving Party shall maintain the Confidential Information in strict confidence and protect it with the same degree of care it applies to its own confidential information, but not less than reasonable care, for a period of five (5) years from the date of disclosure or until the information enters the public domain through no breach by the Receiving Party, whichever is earlier. The Confidential Information shall not include information that (a) is publicly available, (b) was independently developed without access to the Confidential Information, (c) is lawfully received from a third party without confidentiality restrictions, or (d) is required to be disclosed by law, provided the Receiving Party gives prompt written notice to the Discloser to permit a protective order.

This is general drafting guidance, not legal advice, and not a substitute for advice on your specific facts and jurisdiction. Sample language is a starting point to adapt, not a finished clause.