The confidentiality clause in a non-disclosure agreement (NDA) under the United States law

Standard Position

Under US common law and the Uniform Commercial Code (UCC), a confidentiality clause in an NDA establishes a contractual obligation to protect disclosed information from unauthorized use or disclosure. The standard market position in the US is to define confidential information broadly, impose a duty of care on the receiving party, and carve out common exceptions. Most NDAs require the receiving party to limit access to employees or contractors with a legitimate need to know, and to apply reasonable security measures. The duration of the obligation typically ranges from 2 to 5 years post-disclosure, though trade secrets may be protected indefinitely under state law.

Legal Basis

NDAs derive enforceability from contract law principles: mutual assent, consideration, and clear terms. The Uniform Trade Secrets Act (UTSA), adopted in most US states (and recently superseded by the Uniform Trade Secrets Act 2024 in some jurisdictions), defines trade secrets and provides separate tort remedies for misappropriation, which complement contractual confidentiality clauses. Federal law, including the Defend Trade Secrets Act (DTSA, 18 U.S.C. SS 1836), also protects trade secrets and provides for injunctive relief and damages. Courts enforce NDAs under ordinary contract principles but require that confidentiality obligations be reasonable in scope and duration to avoid being deemed unenforceable restraints on competition. The reasonableness standard varies slightly by state; California courts, for example, scrutinize overly broad confidentiality provisions more strictly under public policy grounds.

Drafting and Negotiation

Key negotiation points include the definition of confidential information, scope of permitted uses, recipient obligations, and exceptions. A tight definition (e.g., "information disclosed in writing and marked confidential") favors the discloser but may create disputes over oral disclosures; a broader definition ("any information clearly understood as confidential") is more protective but less certain. Carve-outs for information already known, independently developed, rightfully received from third parties, or in the public domain are standard and legally necessary (courts will read them in even if absent). Recipients should negotiate for a "residual knowledge" exception if they employ many people working in similar fields, and for explicit permission to use the information in specified ways (e.g., evaluation, performance, backup). The standard of care ("reasonable efforts" vs. "best efforts" vs. "same care as own secrets") directly affects liability exposure and should reflect the sensitivity of the information. Negotiating a cap on liability, a fixed notice period for alleged breaches, and a requirement that the discloser mitigate damages are important defensive moves.

Common Pitfalls

Failing to define "confidential information" with sufficient clarity leads to disputes over what is actually protected. Over-reaching confidentiality periods (e.g., perpetual obligations) may be found unenforceable as an unreasonable restraint, particularly if they extend beyond the information's legitimate competitive value. Neglecting to carve out information already in the public domain, or information reverse-engineered by lawful means, invites challenge under state trade secret law. Imposing an unreasonably high standard of care (e.g., "best efforts" or "military-grade security") creates operational friction and liability risk. Failing to address the treatment of information upon termination or return can create ambiguity. Finally, overloading the confidentiality clause with non-compete or non-solicitation provisions may render the entire clause void in jurisdictions that scrutinize restrictive covenants closely. State law variation means that a one-size-fits-all clause may be enforceable in Delaware but problematic in California or Colorado.

Sample language

Recipient shall maintain the confidentiality of all Confidential Information disclosed by Discloser, using at least the same degree of care it uses to protect its own confidential information of similar nature, but no less than reasonable efforts. Recipient shall limit access to employees or contractors with a legitimate need to know and shall ensure such persons are bound by written confidentiality obligations. Recipient may use Confidential Information solely for the purpose stated in this Agreement. Confidentiality obligations shall survive termination for five (5) years, except that trade secrets shall be protected for so long as they qualify as trade secrets under applicable law. Confidential Information shall not include information that is publicly available through no breach by Recipient, rightfully received from a third party without confidentiality obligations, or independently developed without reference to Discloser's Confidential Information.

This is general drafting guidance, not legal advice, and not a substitute for advice on your specific facts and jurisdiction. Sample language is a starting point to adapt, not a finished clause.