The indemnity clause in a non-disclosure agreement (NDA) under India law

Standard position

In Indian NDAs, indemnity clauses typically require the breaching party to compensate the non-breaching party for losses arising from unauthorised disclosure or misuse of confidential information. Unlike some common law jurisdictions, Indian law does not recognise pure contractual indemnity as a distinct cause of action separate from breach of contract; instead, indemnity operates as a contractual remedy for loss caused by breach. Standard market position in India is that the disclosing party seeks broad indemnity covering third-party claims, regulatory fines, reputational harm, and direct business losses. However, Indian courts are cautious about enforcing unlimited indemnity provisions and apply the remoteness doctrine strictly, requiring losses to be reasonably foreseeable.

Legal basis

Indemnity clauses in NDAs derive authority from Sections 124-125 of the Indian Contract Act, 1872, which define indemnity as a contract by which one party promises to save the other from loss caused by the conduct of the promisor or by the conduct of any other person. The indemnifying party must have had knowledge of the risk or been in breach of contract. Indian courts, particularly in decisions interpreting commercial contracts, have held that indemnity must be clear and unambiguous (see principles in cases like Dhanraj Pillai v. Bharat Petroleum). Additionally, Section 73 of the Indian Contract Act limits damages to those that are not too remote: losses must flow directly from the breach and be of a type reasonably contemplated by both parties at the time of contract execution. The Indian Penal Code, 1860 is also relevant when disclosure involves theft or fraud, as criminal liability may run parallel to contractual indemnity.

Drafting and negotiation

When drafting indemnity in an Indian NDA, clearly delineate categories of loss: direct losses (business opportunity loss, data restoration costs), third-party claims (IP infringement claims by competitors based on disclosed information), and regulatory/statutory damages (RBI penalties if financial data is disclosed, data protection fines under emerging privacy frameworks). Specify whether indemnity covers both the disclosing party and its affiliates, advisors, or customers. Indian in-house teams should define the trigger: does indemnity apply only to proven breach, or also to negligent disclosure or inadvertent access by employees? Negotiate a reasonable cap (often 1-2x annual contract value or a fixed amount), as Indian courts disfavour penalties and will reduce manifestly excessive indemnity sums. Include a mitigation obligation: the disclosing party must take steps to reduce harm once breach is discovered. Address the interaction with insurance: clarify whether indemnity is primary or excess to insurance coverage, as Indian corporate policy often requires this. For software or IT NDAs, specify whether the indemnifying party's obligation covers only the employee who breached or the organisation itself. Given India's multi-jurisdictional corporate structure, state clearly whether indemnity extends to overseas subsidiaries or foreign acquiring companies.

Common pitfalls

A frequent error is creating asymmetrical indemnity: the disclosing party is indemnified broadly, but the receiving party has narrow indemnity protection. Indian courts may rewrite such clauses as unconscionable. Another pitfall is omitting causation language, leading to disputes over whether a loss was actually caused by the breach; use "arising directly and proximately from" rather than vague "relating to." Avoid including indemnity for the non-breaching party's own negligence or failure to enforce confidentiality; Section 74 of the ICA permits courts to reduce such liability. Do not conflate indemnity with liability caps: they serve different purposes, and courts interpret them independently. Finally, many drafters fail to address what happens if the receiving party receives a third-party claim: require prompt notice, cooperation in defence, and control of settlement, as these are mandatory under Indian procedure for indemnity to be enforceable.

Sample language

The Receiving Party shall indemnify, defend, and hold harmless the Disclosing Party from and against any third-party claims, damages, losses, costs (including reasonable legal fees), and regulatory penalties arising directly from the Receiving Party's unauthorised disclosure, breach, or negligent handling of Confidential Information, provided that the Disclosing Party gives prompt written notice, allows the Receiving Party to control the defence, and takes reasonable steps to mitigate loss. Indemnity shall not apply to losses arising from the Disclosing Party's own negligence, breach of this Agreement, or breach by the Disclosing Party's own advisors.

This is general drafting guidance, not legal advice, and not a substitute for advice on your specific facts and jurisdiction. Sample language is a starting point to adapt, not a finished clause.