How to Review a Non-Disclosure Agreement (NDA)

This clause draws the boundary around everything the agreement protects, so read it first and read it carefully. A well-drafted definition is specific: it names categories such as technical data, source code, financial statements, customer lists, and business plans, and it captures information disclosed in writing, orally, and visually. Watch three things in particular.

First, breadth. A definition that sweeps in "any and all information disclosed by the Disclosing Party" with no limit is hard to comply with, because you cannot protect what you cannot identify. Second, oral disclosures. Some NDAs only protect information that is marked "Confidential" in writing, or oral information that is reduced to a written summary within a set number of days. That protects a disclosing party but creates a compliance trap for a receiving party. Third, marking. Decide whether a marking requirement helps or hurts you given which side you are on.

A one-way (unilateral) NDA protects one party's information; a mutual NDA protects both. The right choice is not about fairness in the abstract, it is about the direction of the actual information flow. If both sides will exchange sensitive material, a mutual NDA is usually cleaner to negotiate because each side has a symmetric incentive to keep every obligation reasonable.

A red flag is a one-way NDA presented as standard when the discussion is genuinely two-sided. If you are being asked to sign a unilateral agreement as the receiving party, every obligation falls on you alone, so scrutinise the standard of care, the term, and the remedies especially hard.

The permitted purpose defines the sole reason you are allowed to use the other side's information, for example "solely to evaluate a potential business relationship between the parties." Anything outside that purpose is a breach, even if you never disclose the information to anyone. Narrow, specific purpose language protects a disclosing party; a receiving party wants a purpose broad enough to actually do the work contemplated.

Check who counts as a permitted recipient inside your own organisation. Good drafting lets you share on a need-to-know basis with employees, affiliates, and professional advisers who are themselves bound by confidentiality obligations at least as protective as the NDA. Watch for clauses that make you liable for those recipients' breaches, which is common and often acceptable, but should be a conscious acceptance.

Nearly every fair NDA carves out information that should not be treated as confidential. If these standard exclusions are missing or narrowed, that is a meaningful red flag. Confirm the agreement excludes information that:

This clause states how carefully you must guard the information. The common and reasonable standard is to use "the same degree of care used to protect your own confidential information, and in no event less than a reasonable degree of care." Be cautious with an absolute or strict-liability standard that makes you responsible for any disclosure regardless of fault, or one requiring "best efforts," which courts in some jurisdictions read as a demanding obligation.

Check the affirmative duties too: limiting access to need-to-know personnel, not copying beyond what the purpose requires, and notifying the other side promptly on discovering any unauthorised disclosure.

This is the distinction people most often get wrong, so slow down here. There are two separate clocks. The term is how long the agreement is active, meaning the window during which new disclosures are covered. Survival is how long your duty to keep already-disclosed information secret continues after the agreement ends.

A two-year term with a three-year survival period means: information can be exchanged for two years, and anything exchanged must be kept confidential for three years after the agreement terminates. For ordinary business information, a defined survival period of two to five years is common. But genuine trade secrets are often carved out to remain protected for as long as they qualify as trade secrets under applicable law, because a fixed expiry could forfeit that protection. Read the two provisions together, and be wary of a perpetual, indefinite confidentiality obligation over all information, which can be difficult to justify and, for some categories, difficult to enforce.

On expiry or on request, the receiving party is usually required to return or destroy confidential materials and copies, and sometimes to certify destruction in writing. Two practical points to negotiate: a carve-out allowing you to retain one archival copy for legal, compliance, or record-keeping purposes, and an exception for information held in routine, automated electronic backups that cannot practically be deleted, provided it stays subject to confidentiality. Without these, a literal return-or-destroy clause can be impossible to comply with.

Because a leak often cannot be undone with money alone, most NDAs let the disclosing party seek injunctive relief to stop a breach. A balanced clause acknowledges that damages may be inadequate and preserves the right to seek an injunction. Watch for over-reach: language stating that any breach automatically causes "irreparable harm" and entitles the other side to an injunction without proof, a waiver of the requirement to post a bond, or, more seriously, liquidated-damages or penalty figures and one-sided indemnities and legal-fee-shifting provisions. Uncapped liability and automatic fee-shifting in a document you are signing just to have a conversation deserve real scrutiny.

A residuals clause lets the receiving party's people freely use general knowledge, ideas, know-how, and techniques retained in their unaided memory, without reference to written materials. It heavily favours the receiving party and can quietly gut the protection a disclosing party thinks it has. If you are disclosing sensitive material, a broad residuals clause is a significant red flag and often worth deleting or narrowing. If you are receiving, it can be valuable, particularly where your teams work across many similar projects, but expect the other side to resist it.

An NDA should govern information, not restrain trade. Read for clauses that do not belong in a confidentiality agreement: a promise not to solicit or hire the other party's employees, a promise not to solicit its customers, or an outright non-compete. These restrictive covenants have serious commercial consequences and their enforceability varies sharply by jurisdiction. In some places broad non-competes are heavily restricted or unenforceable; in others they are read down or upheld only where narrowly tailored. Never let a restraint of trade slip through inside a document you assumed was only about secrecy. If one appears, negotiate it on its own terms or strike it.

Confirm the NDA states that disclosing information grants no licence and transfers no intellectual-property rights, and that it creates no obligation for either party to proceed with a transaction. A receiving party should resist any clause that assigns ownership of feedback, ideas, or improvements to the disclosing party, which sometimes hides here and can reach well beyond confidentiality.

Check whether either side can assign the agreement, and to whom. A receiving party generally does not want the disclosing party freely assigning the NDA to a competitor of the receiving party, and a disclosing party wants its confidentiality protections to survive and bind a successor in a merger or acquisition. A common middle ground allows assignment to a successor of substantially all of the assigning party's business, with consent required otherwise.

The governing-law clause decides which jurisdiction's law interprets the agreement, and the forum or jurisdiction clause decides where disputes are heard. These are not boilerplate. They determine how key terms, especially any restrictive covenants and the enforceability of remedies, will actually be read, and how costly a dispute would be to run. Prefer a jurisdiction you understand and can practically litigate or arbitrate in, and make sure the governing law and the forum are consistent with each other.