Non-disclosure agreement (NDA): what it is and what to include

What a non-disclosure agreement is

A non-disclosure agreement, also called a confidentiality agreement or CA, is a legally binding contract that governs how sensitive information moves between parties. One side (the disclosing party) shares proprietary material such as financials, product plans, source code, customer lists, or trade secrets, and the other side (the receiving party) agrees to protect that material and not to disclose or exploit it outside the defined purpose.

NDAs come in two basic shapes. A unilateral (one-way) NDA protects information flowing from one party to another, which is common when a company shares data with a prospective vendor or job candidate. A mutual (two-way) NDA protects information each side discloses to the other, which fits partnerships, joint ventures, and merger talks where both parties open their books. A third variant, the multilateral NDA, binds three or more parties under a single agreement.

Because an NDA is a creature of state contract law, its enforceability depends on ordinary contract principles: offer, acceptance, consideration, and reasonable, definite terms. Courts generally uphold NDAs that are limited in scope, duration, and geography, but they may narrow or refuse to enforce provisions that are unreasonably broad or that serve an improper purpose. An NDA also works alongside statutory trade secret protection under the federal Defend Trade Secrets Act (DTSA) and state versions of the Uniform Trade Secrets Act, so the contract and the underlying law reinforce each other.

Key terms and clauses to include

The heart of any NDA is the definition of Confidential Information. It should be broad enough to capture the material you actually share (technical, commercial, and financial data, whether written, oral, or visual) but precise enough to be enforceable. Many agreements require that written material be marked “Confidential” and that oral disclosures be confirmed in writing within a set window; decide deliberately whether to impose those marking requirements or to cover everything a reasonable person would treat as confidential.

Equally important are the exclusions, the categories that are not confidential. Standard carve-outs cover information that is or becomes public through no fault of the receiving party, was already known to the receiver before disclosure, is independently developed without using the disclosed material, or is rightfully received from a third party free of any duty. A separate provision should address disclosures compelled by law or court order, allowing the receiving party to comply while giving prompt notice so the discloser can seek protection.

Other core clauses include:

• Purpose and permitted use, which limits the receiver to using the information only for the stated evaluation, transaction, or project and nothing else.
• Standard of care, requiring the receiver to protect the information at least as carefully as its own confidential material, and never with less than reasonable care.
• Term and survival, separating the disclosure period from the confidentiality period; trade secrets are commonly protected for as long as they remain secret, while other information may be protected for a fixed number of years.
• Return or destruction of materials on request or at termination, often with written certification.
• Remedies, expressly acknowledging that money damages may be inadequate and that the disclosing party may seek injunctive relief to stop a breach before the harm becomes irreversible.
• Governing law, jurisdiction, and venue, so the parties know which state’s law applies and where disputes are heard.
• A whistleblower immunity notice under the Defend Trade Secrets Act, 18 U.S.C. 1833(b), which an employer must include in any agreement governing trade secrets with employees or contractors in order to preserve the right to recover exemplary damages and attorney fees against that person.

Rounding out the document are boilerplate but consequential terms: no license or ownership transfer, no obligation to proceed with a deal, no warranty as to accuracy, assignment limits, and an entire-agreement clause. Be cautious with a residuals clause, which lets the receiver use unaided memory of the information, because it can quietly weaken the protection you thought you had.

When you need one

You need an NDA whenever you are about to reveal something that would help a competitor or harm your position if it leaked. Typical triggers include evaluating a vendor or supplier, sharing designs or source code with a contractor, opening due diligence in a merger or acquisition, pitching sensitive metrics to investors, onboarding employees who will handle proprietary information, and exploring a partnership or licensing deal.

Timing matters as much as the trigger. Sign the NDA before the first substantive disclosure, not after, because information shared beforehand may fall outside the agreement’s protection. In practice, mature organizations keep an approved template ready so a deal is never held up waiting for a first draft, and they route any counterparty redlines through a consistent review process.

Common pitfalls

The most frequent mistake is an overbroad or vague definition of Confidential Information, which can make the whole agreement harder to enforce and invites disputes about what was actually covered. The mirror-image error is a definition so narrow, or marking requirements so strict, that important disclosures slip through unprotected.

Other recurring problems include:

• No purpose limitation, so the receiver can arguably use the information for almost anything.
• A single perpetual term applied to all information, when courts often expect a reasonable, finite period for ordinary business information even though trade secrets can be protected indefinitely.
• Omitting the Defend Trade Secrets Act immunity notice, which forfeits enhanced remedies against employees and contractors.
• Missing carve-outs, especially for legally compelled disclosure, which puts the receiver in an impossible position.
• Using an NDA to suppress reports of unlawful conduct; the federal Speak Out Act limits enforcement of pre-dispute nondisclosure clauses covering sexual assault and sexual harassment, and several states restrict such clauses more broadly.
• Copying one template across jurisdictions and relationships without adjusting governing law, term, or scope.
• Signing the NDA and then losing track of it, so no one remembers when confidentiality obligations end or what must be returned.

From signed NDA to managed obligation

An NDA is only as strong as the discipline behind it. Its definitions must be intentional, its term and carve-outs must fit the deal, and every executed copy must be findable when a dispute or an audit arrives. This is where structured contract management earns its place. In a CLM platform like Pactolane, a central repository keeps every NDA searchable, renewal and deadline alerts flag when a confidentiality term or return-of-materials obligation comes due, and approval workflows plus a full audit trail record who signed what and when. Compliance playbooks apply your preferred confidentiality language to incoming agreements, risk scoring highlights nonstandard terms such as a missing immunity notice or an unusual perpetual duration, and conflict detection across contracts surfaces inconsistent obligations between related NDAs. PactAI prepares the work by extracting key dates, summarizing terms, and flagging risk, while your team decides, negotiates, and signs. Handled this way, an NDA stops being a document filed and forgotten and becomes a tracked obligation the business can actually rely on.