A well-drafted non-disclosure agreement (NDA) identifies what must remain confidential, who may use the information, how long the obligation lasts, and what happens if the agreement is breached. This guide explains what an NDA should include, how a one-way NDA differs from a mutual NDA, which provisions deserve careful review, and when a template should be updated or reviewed by a lawyer.
Overview
An NDA, also called a confidentiality agreement or non-disclosure agreement, is a contract intended to limit the use or sharing of specified information. Businesses commonly use NDAs before discussing product plans, software, financial information, customer data, marketing strategies, manufacturing processes, or a potential transaction. Individuals may encounter them in employment, freelance, consulting, investment, or creative work.
A template can provide a useful starting point, but it is not automatically suitable for every relationship or jurisdiction. The right terms depend on who is disclosing information, who is receiving it, the purpose of the discussion, the type of information involved, and the consequences of unauthorized disclosure.
The basic choice is often between a one-way NDA and a mutual NDA:
- One-way NDA: One party primarily discloses confidential information and the other party agrees to protect it. This may fit a company sharing information with a contractor or prospective service provider.
- Mutual NDA: Both parties may disclose confidential information, and both receive confidentiality obligations. This may fit a partnership discussion, joint development project, or business acquisition conversation.
Do not choose a mutual form merely because it sounds more balanced. If the parties will exchange information in significantly different amounts or for different purposes, the agreement should still describe those obligations clearly.
For a broader process for checking agreements, see How to Review a Contract Before You Sign and the small business contract review checklist.
What to track
When preparing or reviewing an NDA template, track the following provisions rather than focusing only on the document's title.
1. The parties and their authority
Confirm the full legal names of the parties and, where relevant, their business forms and addresses. Check that the person signing has authority to bind the company. If an employee, consultant, affiliate, or subcontractor will receive information, determine whether that person is covered directly or through an obligation imposed on the receiving party.
2. The definition of confidential information
A useful definition should be broad enough to cover the information genuinely needing protection but clear enough that the receiving party can understand its responsibilities. It may cover written, electronic, visual, oral, or other information, along with information derived from those materials.
Watch for definitions that are either so narrow that important disclosures fall outside them or so broad that they create uncertainty about ordinary business information. The agreement should also explain whether information must be marked confidential. If oral disclosures are covered, check whether the agreement requires a later written confirmation and whether that process is practical.
3. Exclusions from confidentiality
Most carefully drafted NDAs address information that is already public, was lawfully known before disclosure, is received lawfully from another source without a confidentiality duty, or is independently developed without using the confidential information. These exclusions help distinguish protected information from material the recipient could use or obtain independently.
Review the wording and the burden of proof. For example, an agreement may require the receiving party to show records supporting a claim of prior knowledge or independent development. Do not assume an exclusion applies simply because it seems commercially fair; the actual wording controls the contract's operation.
4. Permitted purpose and permitted recipients
The NDA should state why the information is being shared and limit use to that purpose. It should identify who may access the information, such as employees, professional advisers, contractors, or financing sources, and require those people to be bound by confidentiality duties.
5. Required disclosures
Look for a process covering subpoenas, court orders, regulatory requests, or other legally required disclosures. The clause may address notice, cooperation, and efforts to seek confidential treatment where appropriate. It should not be read as allowing a party to ignore a legal obligation.
6. Duration and survival
Separate the agreement's active term from the period during which confidentiality duties continue. A short project may have a defined term, while certain sensitive information may need protection for longer. Trade-secret treatment can raise different considerations from ordinary business information, so a generic duration may not fit every situation.
Red flags include an unclear start date, a term that expires before the parties finish exchanging information, or language that creates a continuing obligation without explaining which information remains protected.
7. Return, deletion, and retention
Check what happens when discussions end or a party requests the return or deletion of information. The clause should address copies, backups, archived records, and materials created from the confidential information where relevant. Some records may need to be retained for legal, compliance, or routine systems purposes, so the agreement should account for that possibility instead of promising an impossible deletion process.
8. Ownership and intellectual property
An NDA generally governs confidentiality; it does not automatically transfer ownership of inventions, content, software, data, or other intellectual property. Confirm that the agreement says who owns pre-existing materials and whether any license is granted solely to evaluate or perform the stated purpose. If the parties expect an assignment, development obligation, or license, those terms usually require a separate provision or agreement.
9. Remedies, governing law, and forum
Review provisions addressing breach, including available remedies and whether a party may seek urgent court relief. The governing-law and forum clauses identify which legal rules and courts the parties intend to use, but their effect can depend on the facts and applicable law. A mismatch between the parties' locations, the chosen forum, and the place where the work occurs is a reason to seek legal advice.
10. Practical drafting checklist
- Identify the parties and signing authority.
- Choose one-way or mutual obligations based on the actual information flow.
- List the permitted purpose and authorized recipients.
- Define confidential information and review each exclusion.
- Address oral disclosures and required disclosures by law.
- Set a clear effective date, term, and survival period.
- Explain return, deletion, backups, and permitted retention.
- Separate confidentiality from ownership and intellectual-property rights.
- Review remedies, governing law, forum, notices, and amendment rules.
- Remove unused options, inconsistent definitions, and blank fields before signing.
Cadence and checkpoints
Use an NDA review checklist each time a new agreement is created, not only once a year. Before sending a template, confirm that the business purpose and parties have not changed. Before signing, compare the final version with the draft and verify that attachments, schedules, and incorporated policies are present.
For organizations that use NDAs repeatedly, a quarterly or semiannual checkpoint can identify recurring problems: missing signature dates, inconsistent definitions, expired forms, unclear approval responsibilities, or terms that do not match current workflows. Keep a simple register showing the parties, purpose, effective date, expiration or survival terms, permitted recipients, and storage location. Limit access to the register itself if it contains sensitive information.
When an NDA supports a larger transaction, employment arrangement, contractor relationship, or technology project, review it alongside the related contract. A confidentiality clause in a services agreement may conflict with a stand-alone NDA, especially on ownership, data handling, retention, or permitted use.
How to interpret changes
Not every requested change has the same significance. A formatting correction is different from narrowing the definition of confidential information, shortening the survival period, adding broad permitted recipients, or changing the governing law. Mark substantive revisions and ask what business risk the change creates.
Pay particular attention when:
- The recipient wants to use information for purposes beyond evaluation or performance.
- The agreement permits disclosure to affiliates or contractors without a clear responsibility for their conduct.
- The disclosing party wants perpetual confidentiality for information that may become public through ordinary business activity.
- The recipient has independent-development, residual-knowledge, or broad archival rights.
- The agreement includes a noncompete, non-solicitation, intellectual-property assignment, or penalty that goes beyond confidentiality.
- The information includes personal data, regulated data, or customer information requiring additional safeguards.
An NDA is not a substitute for a privacy, security, data-processing, employment, licensing, or services agreement when those subjects are part of the relationship. For questions involving website or customer information, the GDPR and website privacy compliance checklist may help identify issues that need separate treatment.
Legal advice is especially useful when the information is central to a valuable product, the other party proposes major revisions, the agreement crosses borders, a dispute has already arisen, or the contract includes obligations beyond confidentiality. Individuals and small businesses seeking options can review resources for free or low-cost legal help by state or learn how to find the right lawyer.
When to revisit
Revisit an NDA before each new disclosure, renewal, project phase, or change in the parties' relationship. A template also deserves review when the business begins sharing new categories of information, adopts new systems, works with overseas partners, adds contractors or affiliates, or changes where its operations are based.
Set a recurring quarterly or semiannual review for frequently used forms and conduct a broader legal review at least when a major transaction, dispute, business restructuring, or material change in law affects the agreement. Do not wait for the scheduled date if a party reports a suspected disclosure, requests unusual access, or proposes language that changes ownership, use rights, duration, or remedies.
Before reusing an old NDA, complete these final steps:
- Confirm the current legal names, purpose, and information categories.
- Check the effective date, term, survival period, and signatory authority.
- Compare the template with related contracts and current data-handling practices.
- Remove obsolete clauses, comments, tracked changes, and blank alternatives.
- Escalate unusual risks or negotiated changes to qualified legal counsel.
- Store the signed version where the responsible team can find it without broadening access.
A reliable NDA template is a starting tool, not a guarantee of protection. Reviewing its purpose, definitions, exclusions, duration, ownership language, and enforcement provisions each time the circumstances change makes the document more accurate and more useful.
