Last reviewed 29 August 2026
Non-disclosure agreements — also called confidentiality agreements — govern how information shared for a specific purpose may be used and disclosed. They appear at the start of nearly every commercial conversation: supplier discussions, partnership talks, acquisitions, product demonstrations and recruitment of senior staff.
Because they are routine, they are often signed without scrutiny. Yet the differences between a well-drafted NDA and a weak one are significant: what counts as confidential, how long protection lasts, who may see the information and what happens when the relationship ends.
This guide explains how to use NDAs effectively, and where they are the wrong tool.
One-way, mutual and multi-party
A one-way (unilateral) NDA protects information flowing in a single direction, for example where you disclose product detail to a prospective customer. A mutual NDA protects both parties and is appropriate whenever both will share sensitive material — most partnership and acquisition discussions.
Signing a one-way NDA as the receiving party places all the obligations on you. It is common, but read it: some are drafted so broadly that ordinary information already in your possession becomes restricted.
Defining confidential information
There are two approaches. A broad definition covers all information disclosed in connection with the purpose, regardless of form or marking. A narrow definition covers only information marked confidential or confirmed in writing within a set period after oral disclosure.
Broad definitions favour the disclosing party and are simpler to operate, because nobody remembers to mark documents. Narrow definitions favour the receiving party and give certainty about what is caught. Choose deliberately based on which side of the transaction you are on.
Permitted disclosures and standard carve-outs
Standard exclusions cover information that is already public, was already lawfully known to the recipient, is independently developed without reference to the disclosed information, or is received from a third party without breach of confidence. These are reasonable and should be resisted only in unusual cases.
Permitted disclosure clauses allow sharing with employees, professional advisers, group companies and funders on a need-to-know basis, provided they are bound by equivalent obligations. Include a route for disclosure required by law, regulation or a court order, ideally with notice to the disclosing party where lawful to give it.
Purpose limitation and non-use
The most commercially important clause is often the non-use provision, not the non-disclosure one. Restricting information to a defined purpose stops the recipient from using your data to build a competing product even without telling anyone about it.
Define the purpose specifically. 'Evaluating a potential business relationship' is vague enough to justify a wide range of activity; 'evaluating the supply of X services to Y' is not. Where the risk is genuinely competitive, consider adding non-solicitation of staff and customers and a short standstill on approaching identified counterparties.
Duration, return of information and remedies
Two to five years is typical for general commercial information. Trade secrets should be protected for as long as they remain secret, which usually means an indefinite obligation for that category. An NDA that expires in twelve months protects nothing about source code or formulations.
Include an obligation to return or destroy information on request, subject to sensible exceptions for backups and regulatory record-keeping. On remedies, damages for breach of confidence are notoriously hard to quantify, so state that the disclosing party may seek injunctive relief without needing to prove that damages are inadequate.
What an NDA cannot do
An NDA cannot make public information secret again, cannot prevent independent development, and cannot practically stop determined misuse — it gives you a claim, not a shield. It also cannot prevent a worker from making a protected disclosure (whistleblowing) or reporting a criminal offence, and any clause purporting to do so is unenforceable and reputationally damaging.
Most institutional investors decline to sign NDAs. Where a counterparty will not sign, manage the risk by staging disclosure: share the commercial case first, technical detail later, and keep genuinely patentable material unpublished until filed.
Key points
- Use mutual NDAs whenever both parties will share sensitive information.
- Broad definitions favour the discloser; marking-based definitions favour the recipient.
- The non-use clause is often more valuable than the non-disclosure clause.
- Define the permitted purpose narrowly and specifically.
- Trade secrets need indefinite protection, not a two-year term.
- An NDA cannot restrict protected disclosures or reporting of criminal conduct.
Frequently asked questions
- Is an NDA legally binding?
- Yes, provided the usual contract requirements are met. Enforcement is a separate question: proving breach and quantifying loss can be difficult, which is why injunctive relief and clear evidence trails matter.
- How long should an NDA last?
- Two to five years for general commercial information is common, with an indefinite obligation for trade secrets. The right period reflects how long the information retains value.
- Can I send my standard NDA to everyone?
- For routine discussions, yes — a good standard form saves time. For material transactions, or where the counterparty is a potential competitor, the terms deserve specific attention.
- What do I do if someone breaches an NDA?
- Act quickly. Preserve evidence, take advice on urgent injunctive relief, and consider whether related claims arise in breach of confidence, database right or intellectual property infringement. Delay weakens an application for an injunction.