Non-disclosure agreements: how they work

How the law usually works

An NDA is a contract. It generally creates duties to keep specified information confidential, use it only for an agreed purpose, and limit access to people who need to know it. It may be one-way, protecting information disclosed by one party, or mutual, protecting information shared by both sides.

A stronger NDA usually:

• Describes confidential information by category and examples, rather than saying simply “everything disclosed.”
• Covers information disclosed orally, visually, electronically, and in documents.
• States the permitted purpose, such as evaluating an investment, supplying services, or discussing a possible acquisition.
• Limits copying, reverse engineering, testing, or commercial use where appropriate.
• Requires reasonable security measures and prompt notice of unauthorized access or disclosure.
• Makes the receiving party responsible for its employees, contractors, professional advisers, and other permitted recipients.
• Requires return or deletion of information, while addressing legally required archival copies.
• Separately protects trade secrets for as long as they remain trade secrets, while giving a definite period for other confidential information.

Common exclusions include information that:

• Was public when disclosed or later becomes public without breach.
• Was already lawfully known by the recipient.
• Is received lawfully from another source without a confidentiality duty.
• Is independently developed without using the protected information.
• The disclosing party agrees in writing may be disclosed.

The agreement should explain how exclusions are proved. A requirement that the recipient produce written records can be useful, but it may not be appropriate to make documentation the only possible proof.

Many NDAs include a compelled-disclosure clause. This commonly requires the recipient, where legally allowed, to give advance notice, disclose only what is required, and seek confidential treatment. It should not claim to prohibit reporting to regulators, police, courts, or other bodies where the law protects or requires that disclosure.

An NDA is not the same as a non-compete, non-solicitation agreement, intellectual-property assignment, data-processing agreement, or security schedule. Those subjects may need separate terms. An NDA also does not automatically transfer ownership of inventions, documents, or other work product.

Remedies can include an injunction, damages, an account of profits, delivery or destruction of materials, and recovery of legal costs where permitted. A clause saying that a breach automatically causes a particular amount of loss may be treated as an unenforceable penalty in some places. A court may also refuse or narrow an overly broad restriction.

Common processes

1. Identify the information and the business purpose. People commonly make a list of the information to be shared, who will receive it, and what the recipient needs to do with it. This helps avoid vague language and prevents the NDA from covering unrelated information.

1. Choose one-way or mutual protection. A one-way NDA may suit a company disclosing information to a consultant. A mutual NDA may be more appropriate where both sides will share business plans, technical information, customer information, or pricing.

1. Draft definitions and exclusions. The parties commonly describe information by subject matter and format, then include customary exclusions. Particularly sensitive material may be listed in a schedule or marked when delivered, while the agreement can still cover oral disclosures identified as confidential.

1. Set access and security rules. Common terms restrict access to personnel and advisers with a genuine need to know. They may require passwords, access controls, secure storage, limits on downloading, and immediate notice of suspected loss or unauthorized access.

1. Set duration and post-termination duties. People commonly distinguish the length of the relationship from the period of confidentiality. Trade-secret duties may continue while the information qualifies as a trade secret; other information may have a stated period. Return, deletion, and continuing confidentiality provisions should fit the business purpose.

1. Add lawful-disclosure protections. A carefully written NDA preserves disclosures required by law and protected reporting. In employment settings, it commonly avoids restricting discussions about workplace rights, discrimination, harassment, safety, wages, or suspected wrongdoing where applicable law protects those discussions.

1. Review enforcement terms and the parties’ authority. The agreement commonly identifies governing law, courts or arbitration, notice methods, ownership, no-license language, amendment rules, and whether electronic signatures are accepted. Each signer’s authority to bind the business is also checked.

1. Handle information consistently after signing. A signed NDA is stronger when the business uses sensible confidentiality labels, access controls, clean records, and staff training. Sharing sensitive material with people who have not agreed to confidentiality can undermine practical protection.

Deadlines and time limits

An NDA usually states its own confidentiality period, but legal limitation periods also affect claims. The period can depend on whether the claim is for breach of contract, misuse of a trade secret, copyright, fraud, or another wrong.

Typical sources commonly describe limitation periods ranging from about one to six years for contract or trade-secret claims, depending on the country, state, province, territory, cause of action, and discovery rules. Some systems pause or extend time in particular circumstances, and a new misuse may create a separate claim.

A confidentiality obligation can last longer than the period for bringing a lawsuit. Trade-secret protection may continue while secrecy and other legal requirements remain. You would commonly confirm the applicable deadline promptly with the relevant court or a licensed attorney where you live.

Documents that usually matter

• The signed NDA and any amendments.
• Schedules identifying protected information or permitted recipients.
• Emails or letters showing the purpose and timing of disclosure.
• Marked confidential documents, data-room records, access logs, and download histories.
• Policies or instructions showing how the business protects confidential information.
• Employment, consulting, supplier, licence, or investment agreements.
• Records of return, deletion, copying, or destruction.
• Evidence of unauthorized use, disclosure, loss, or resulting harm.
• Proof of independent development or lawful third-party receipt, if that issue arises.
• Notices to regulators, courts, or other bodies and any compelled-disclosure order.

How it differs by jurisdiction

United States. State contract and trade-secret law varies. The federal Defend Trade Secrets Act allows certain trade-secret civil claims in federal court and includes remedies such as injunctions and, in limited circumstances, exemplary damages and attorney fees. Employment and contractor agreements that govern trade secrets or other confidential information generally need a whistleblower-immunity notice to preserve those enhanced remedies. State laws may also protect employee discussions, reports of wrongdoing, and other disclosures. Non-compete and non-solicitation rules vary substantially by state.

England and Wales. Contract enforceability depends on ordinary contractual principles, including clarity, consideration where relevant, and public policy. Trade secrets receive protection under the Trade Secrets (Enforcement, etc.) Regulations 2018, alongside contractual and equitable duties of confidence. An NDA that restrains lawful work, reporting, or public-interest disclosures may face limits. Courts can grant injunctions and other remedies, but the wording and circumstances matter.

Canada. Contract law is mainly provincial, with important differences between common-law provinces and Quebec’s civil-law system. Confidential information may be protected by contract, equitable duties, and trade-secret principles. Employment-related restrictions receive close scrutiny, and Ontario’s Employment Standards Act, 2000 restricts certain employment non-competes. Privacy, employment, and whistleblowing rules can affect how an NDA operates.

Australia. Contract, equity, privacy, employment, and competition rules can all matter. Confidentiality obligations may protect trade secrets and information imparted in confidence, but restraints must be reasonable and may be limited by public policy. The Fair Work Act 2009 and other workplace laws may protect certain complaints, workplace rights, and disclosures. State and territory law can affect procedure and remedies.

When people consult a lawyer

People commonly obtain legal advice before signing an NDA when:

• The information includes source code, formulas, clinical or technical data, personal information, or valuable customer lists.
• The agreement covers employees, inventions, non-competes, non-solicitation, or ownership of work product.
• The other side uses a foreign governing law or unfamiliar court or arbitration clause.
• A company is being sold, financed, licensed, or acquired.
• There has been a suspected leak, copying, threatened disclosure, or demand to destroy evidence.
• The NDA may affect whistleblowing, regulator communications, workplace rights, or public-interest reporting.
• The proposed damages, indemnity, injunction, or penalty clause could create substantial exposure.

Urgent threats involving violence, extortion, stalking, or other danger should be reported to emergency services first.