Writing an NDA that actually protects you
An NDA protects you when it clearly defines what’s confidential, limits what the other side can do with it, lasts long enough, and gives you a realistic remedy if it’s broken. Plenty of NDAs miss at least one of those, usually because someone grabbed a template and changed the names. A strong non-disclosure agreement doesn’t need to be long. Two or three pages is normal.
One-way or mutual
A one-way NDA protects information flowing in one direction. Say a founder in Dubai is about to show a potential distributor her supplier list and landed costs. Only she’s disclosing, so a one-way NDA fits. A mutual NDA suits partnership talks, joint ventures and acquisitions, where both sides will open their books.
If the other side sends a mutual NDA when only you are sharing, that isn’t automatically a problem. Just check the obligations really are balanced and that nothing in it limits your own freedom to do business.
Name the parties precisely, with full legal names. If the other side’s parent company or a sister company will actually see your information, it should be bound too.
The definition does most of the work
Get the definition of confidential information wrong and nothing else in the NDA helps. Too narrow and important material falls outside it. Too broad and a court may hesitate to enforce it, and the other side will push back anyway.
A workable definition usually covers:
- All non-public business, technical and financial information shared for the purpose of the deal, in any form, including things said in meetings and seen on site visits
- The specific categories that matter to you, such as source code, pricing, customer data, product plans and supplier terms
- The fact that the talks are happening at all, if that’s sensitive
- Notes, analyses and summaries the recipient makes that contain your information
Some NDAs only protect information that’s marked “confidential,” and require oral disclosures to be confirmed in writing within a set time, often 30 days. That works in a formal data room. In a real negotiation, over coffee and video calls, it’s easy to forget. If you’re the one disclosing, push back on strict marking rules, or at least add that anything a reasonable person would understand to be confidential is covered.
The four standard exclusions
Nearly every NDA carves out certain information, and courts expect to see these. The usual list is information that:
- Is or becomes public through no fault of the recipient
- The recipient already knew before you shared it, without any duty of confidence
- The recipient gets from a third party who was free to share it
- The recipient develops independently without using your information
They’re fair. Check two details, though. The recipient should have to prove an exclusion applies, ideally with written records. And the independent development carve-out should require that the people who developed it never had access to your information.
What they’re allowed to do with it
A good NDA spells out what the recipient may do as well as what it can’t.
- Purpose. Your information can be used only for a defined purpose, such as “evaluating a potential distribution agreement between the parties.” A vague purpose weakens everything else.
- Need to know. Disclosure only to employees, advisers and, if needed, lenders who need the information for that purpose and are bound by duties at least as strict.
- Responsibility. The recipient answers for breaches by its own people and advisers.
- Standard of care. At least the care it uses for its own confidential information, and never less than reasonable care.
- Compelled disclosure. If a court or regulator orders disclosure, the recipient tells you promptly (where the law allows) and discloses only what’s required.
How long it should last
NDAs often run two clocks. One covers how long the parties will be exchanging information. The other covers how long the confidentiality duties last afterwards, and that’s the one that matters.
| Type of information | Common confidentiality period |
|---|---|
| General commercial discussions | 2 to 3 years after disclosure or termination |
| Detailed financial or strategic information, such as in an acquisition | 3 to 5 years |
| Trade secrets, source code, formulas | For as long as the information stays a trade secret |
A fixed end date for trade secrets is risky. Once the NDA expires, the recipient can argue it’s free to use the information, and you may struggle to show you took reasonable steps to keep it secret. Where trade secrets are involved, ask for protection that lasts as long as they stay secret, and add a survival clause so the duties outlive the agreement.
Getting it back, and what happens if they break it
When talks end, or whenever you ask, the recipient should return or destroy your information and confirm in writing that it has. It’s reasonable to let them keep copies in automatic backups or where the law requires, as long as those stay confidential.
On remedies, the most useful term is an acknowledgment that money alone may not fix a breach and that you can seek injunctive relief to stop a disclosure. A court still decides whether to grant it, but the clause helps. Also think about:
- An attorneys’ fees clause. In the US each side usually pays its own legal costs unless a contract or statute says otherwise, which can make enforcing a small NDA uneconomic.
- Governing law and a forum you can realistically use. Suing in a foreign court is slow and expensive.
Red flags in the other side’s draft
When a bigger company sends you its standard NDA, read it for anything that has nothing to do with confidentiality.
- A residuals clause. A residuals clause lets the recipient use anything its people remember unaided. For know-how and technical ideas, that can wipe out most of your protection.
- Hidden restrictions. A non-solicitation or non-compete tucked into an NDA can limit your hiring or your business for years.
- No “no license” wording. The NDA should say plainly that sharing information grants no license or ownership of your IP.
- A missing “no obligation” line. It’s normal and sensible to state that neither side has to go ahead with any deal.
What an NDA can’t do
An NDA can’t override certain legal rights. In the US, the UK and many other countries, it generally can’t stop someone reporting wrongdoing to a regulator or the police, and a clause that tries to may be unenforceable or land you in regulatory trouble. In the UK, workers keep their whistleblowing protections whatever the NDA says.
In the US, NDAs with individuals should include the whistleblower immunity notice under the Defend Trade Secrets Act if you want the full range of remedies. A 2022 federal law also stops pre-dispute NDAs from being enforced against sexual harassment and sexual assault claims, and some states go further.
Next steps
- Decide whether you need a one-way NDA or a mutual NDA, and start from a template rather than a blank page.
- Write a specific purpose and list the categories of information that matter most to you.
- Set a confidentiality period that fits the information, with open-ended protection for trade secrets.
- Check the other side’s draft for residuals, non-solicitation and non-compete language.
- Keep a simple log of what you shared and when. It’s tedious, and it’s the first thing you’ll want if there’s ever a dispute.
If a larger company sends you its NDA, LegalWolf can flag one-sided terms like residuals clauses and hidden restrictions before you sign.
This article is general information, not legal or tax advice. Laws differ between countries and states and change over time, so check the rules that apply to you or speak to a qualified professional.