The indemnity clause in a non-disclosure agreement (NDA) under the UAE law

Standard Position

Indemnity clauses in UAE NDAs typically require one party (the indemnifying party) to compensate the other (the indemnified party) for losses arising from breach of confidentiality obligations or unauthorized disclosure of confidential information. Under UAE law, indemnity is contractual in nature and must be expressly agreed; it does not arise automatically from breach. Market practice in the UAE and the DIFC/ADGM jurisdictions increasingly favors mutual indemnity obligations, though the extent of indemnification often varies based on the sensitivity of information and the parties' relative bargaining power. A receiving party typically seeks broad indemnity covering third-party claims, regulatory fines, reputational harm, and direct losses. The disclosing party usually wants to limit indemnity to actual losses proven with specificity, exclude indirect or consequential damages, and cap liability at a defined multiple of contract value or annual fees.

Legal Basis

Indemnity in UAE contracts is governed by articles 286-294 of the UAE Civil Code, which addresses contractual liability and damages. Under these provisions, the indemnifying party is liable for loss or damage caused by its breach, but only to the extent that such loss was foreseeable at the time of contract formation. The DIFC and ADGM operate under common-law principles (broadly aligned with English law), where indemnity clauses are enforceable provided they are sufficiently clear and do not contravene public policy. Critically, indemnity under UAE civil law requires a causal link between the breach and the loss claimed; mere breach alone does not trigger indemnity unless the clause expressly states otherwise. Additionally, article 289 of the UAE Civil Code imposes a duty on the indemnified party to mitigate losses; the indemnifying party will not be liable for losses that could reasonably have been avoided.

Drafting and Negotiation

When drafting indemnity language for a UAE-governed NDA, be explicit about the scope: define 'Loss' to include direct damages, costs of remediation, third-party claims, and (if relevant) regulatory penalties, but expressly exclude indirect, consequential, and punitive damages unless the breach is intentional or grossly negligent. Specify the triggering events: indemnity should apply to unauthorized disclosure, breach of confidentiality obligations, and misuse of information, but clarify whether it covers losses arising from the disclosing party's own inadequate protection measures. Include a cap on indemnity (often a multiple of annual fees or a fixed amount) unless the breach involves willful misconduct or gross negligence; under UAE law, caps on liability for gross negligence may not be enforceable in all contexts. Address the mechanics: require the indemnified party to notify the indemnifying party promptly of claims, cooperate in defense, and take reasonable steps to mitigate. Consider whether the indemnity should apply only within the UAE or extend to other jurisdictions, as enforcement mechanisms differ. For DIFC or ADGM-governed NDAs, indemnity language should track common-law principles and may be broader (including indirect losses if expressly stated), but the underlying principle of mitigation applies universally.

Common Pitfalls

A frequent error is drafting indemnity language that fails to define causation clearly: courts in the UAE and the DIFC interpret indemnity clauses narrowly, so vague language like 'any loss arising out of' may not encompass losses the parties intended to cover. Another pitfall is omitting the mitigation obligation; the indemnified party's failure to take reasonable steps to reduce losses will limit the indemnifying party's liability under UAE civil law. Overly broad indemnity (covering third-party claims without limitation) can render the clause unenforceable if it amounts to an exculpatory clause contrary to public policy. Finally, many practitioners neglect to address whether the indemnity survives termination of the NDA; absent express language, a court may imply that indemnity obligations lapse when the confidentiality obligations end, leaving the indemnified party without recourse for breaches discovered post-termination.

Sample language

Each party shall indemnify, defend, and hold harmless the other party from and against any Loss (including reasonable legal costs) arising directly from its material breach of this Agreement's confidentiality obligations, provided that the indemnified party (a) promptly notifies the indemnifying party in writing of the claim, (b) grants the indemnifying party sole control of defense and settlement, and (c) takes all reasonable steps to mitigate such Loss. Notwithstanding the foregoing, no party shall be liable under this indemnity for any Loss to the extent arising from the indemnified party's negligence, breach of this Agreement, or failure to implement reasonable security measures.

This is general drafting guidance, not legal advice, and not a substitute for advice on your specific facts and jurisdiction. Sample language is a starting point to adapt, not a finished clause.