Confidentiality clause: what it means and how to draft it

What a confidentiality clause does

At its core, a confidentiality clause allocates a duty of secrecy. It answers five practical questions:

• What is protected. The clause defines “Confidential Information,” usually as any non-public information disclosed by one party to the other, in any form, whether or not marked as confidential. Strong drafting lists representative categories (pricing, source code, customer lists, product roadmaps, financials) without limiting the definition to that list.
• Who is bound. A unilateral (one-way) clause binds only the receiving party, which fits situations like a vendor pitch. A mutual (two-way) clause binds both sides and is standard when each party will share sensitive material.
• What the recipient may and may not do. Two obligations sit at the center: a non-disclosure duty (do not reveal the information to outsiders) and a non-use duty (do not use the information for anything beyond the stated purpose). The non-use duty is frequently overlooked and is often the more valuable of the two.
• Who may see the information. Permitted recipients typically include employees, affiliates, and professional advisors who have a need to know and are themselves bound by confidentiality obligations at least as protective as the clause.
• How long the duty lasts. The clause sets a survival period, meaning how long the obligation continues after the contract ends. Trade secrets are often protected for as long as they remain secret, while other information may be protected for a fixed term such as three or five years.

A complete clause also carves out standard exclusions, addresses compelled disclosure, and specifies remedies. Those pieces are what turn a vague promise into an enforceable obligation.

Drafting example

Confidentiality. “Confidential Information” means all non-public information disclosed by a party (the “Disclosing Party”) to the other (the “Receiving Party”), whether oral, written, or electronic, that is designated as confidential or that a reasonable person would understand to be confidential given its nature and the circumstances of disclosure. [Broad, purpose-driven definition that does not depend on a “Confidential” stamp.] The Receiving Party shall (a) use Confidential Information solely to perform its obligations under this Agreement [non-use duty tied to a defined purpose], (b) not disclose it to any third party except to its employees, affiliates, and advisors who need to know it and are bound by confidentiality obligations no less protective than these [controlled permitted recipients], and (c) protect it using at least the degree of care it uses for its own confidential information, and in no event less than a reasonable degree of care. Confidential Information does not include information that (i) is or becomes public through no fault of the Receiving Party, (ii) was rightfully known before disclosure, (iii) is independently developed without use of the Confidential Information, or (iv) is rightfully obtained from a third party without a duty of confidentiality. [Standard four exclusions.] These obligations survive for five (5) years after termination, except that obligations regarding trade secrets continue for as long as the information remains a trade secret under applicable law. [Dual survival period.]

The bracketed notes above would not appear in a live contract; they simply flag why each part is there.

What the law says

Confidentiality clauses are enforced as ordinary contract terms, but they also interact with a body of trade secret law. In the United States, trade secrets are protected under the federal Defend Trade Secrets Act of 2016 (DTSA) and, in most states, a version of the Uniform Trade Secrets Act (UTSA). To qualify as a trade secret, information generally must derive independent economic value from not being publicly known and must be the subject of reasonable efforts to keep it secret. A well-drafted confidentiality clause is itself evidence of those reasonable efforts.

Courts will usually enforce a confidentiality clause that is reasonable in scope and duration. Because money damages often cannot undo a disclosure, these clauses commonly authorize injunctive relief, and courts frequently grant it to stop threatened or ongoing misuse. Overly broad clauses carry risk: if a clause is written so expansively that it effectively bars someone from working in their field, a court may narrow it or decline to enforce it. Some states, notably California, restrict confidentiality terms that operate as disguised non-compete restraints, and several states now limit confidentiality provisions that would silence claims of harassment or discrimination.

One provision is easy to miss and costly to omit. Under the DTSA, an employer that wants to recover exemplary (double) damages and attorney fees against an employee or independent contractor for trade secret misappropriation must give a whistleblower immunity notice in any agreement governing the use of trade secrets or confidential information. Building that notice into your standard confidentiality template preserves remedies you might otherwise lose.

Common mistakes to avoid

• Defining Confidential Information too narrowly. Limiting protection to documents stamped “Confidential” invites arguments that oral disclosures and unmarked files are fair game. Use a definition that captures the substance of the information, not just its label.
• Forgetting the non-use restriction. A clause that only prohibits disclosure still lets the recipient exploit the information internally. Pair non-disclosure with a clear non-use obligation tied to a defined purpose.
• Setting a survival period that is too short, or none at all. If the clause is silent, the obligation may end when the contract does. Trade secrets in particular need protection that lasts as long as the information stays secret.
• Omitting the standard exclusions. Without carve-outs for public, independently developed, or rightfully received information, the receiving party may refuse to sign, or later challenge the clause as unreasonable.
• Ignoring compelled disclosure. When a subpoena or regulator demands the information, the clause should require prompt notice to the disclosing party and cooperation to seek protective treatment, rather than putting the recipient in breach for complying with the law.
• Leaving no record of who agreed to what. Confidentiality obligations negotiated by email and pasted into different drafts drift apart across a portfolio. Inconsistent language is hard to enforce and easy to dispute.

When it matters most

Confidentiality clauses earn their keep at the moments a deal turns tense: a vendor relationship ends and the customer worries its data will resurface at a competitor, an employee leaves for a rival, or a financing or acquisition falls through after both sides have opened their books. In each case the value of the clause depends on choices made months or years earlier, when the language was drafted and signed.

That is why confidentiality is a contract management problem, not just a drafting problem. Across a growing portfolio, the practical challenge is keeping every clause consistent, knowing which agreements contain which obligations, and being alerted before a survival period lapses. A CLM platform like Pactolane addresses this directly: standardized templates keep confidentiality language uniform, the contract repository and audit trail make every executed obligation searchable, and deadline alerts flag survival dates before they pass. Its AI copilot, PactAI, can extract and score confidentiality clauses, run conflict detection to surface agreements whose terms disagree, and support exposure analysis so leadership sees where sensitive information is committed and under what conditions. The clause protects the information; disciplined contract management makes sure the protection is actually there when you need it.

This is general legal information, not legal advice.