A confidentiality agreement is a contract that limits how one party can use and share sensitive information it receives from another. It’s the same instrument people call an NDA; “CDA” (confidential disclosure agreement) tends to show up in technology licensing and university research, while “NDA” is more common in employment and corporate deals. Businesses use them when hiring, exploring mergers, onboarding vendors, pitching investors, or doing anything else where trade secrets or proprietary data might change hands. A signed agreement also helps the disclosing party show it took “reasonable measures” to protect its trade secrets, which is a prerequisite for protection under federal and state trade secret law.1Office of the Law Revision Counsel. 18 U.S. Code 1839 – Definitions
Forty-eight states plus the District of Columbia have adopted some version of the Uniform Trade Secrets Act, which runs alongside the federal Defend Trade Secrets Act.2Legal Information Institute. Trade Secret A contract gives you contract remedies if someone breaches; the statutes add injunctions and enhanced damages when the information qualifies as a trade secret. A well-drafted agreement locks in both.
One-Way or Mutual
Decide first whether information flows in one direction or both. A one-way (unilateral) agreement protects a single disclosing party. Use it when onboarding an employee, engaging a consultant, or showing financials to a potential investor.
A mutual (bilateral) agreement protects both sides because both are sharing. Joint ventures, merger talks, and technology partnerships almost always call for mutual terms: each party is both discloser and receiver, and the obligations mirror. Signing a one-way agreement when the deal is actually two-way leaves one side exposed.
What the Agreement Needs to Identify
The parties must be named precisely enough to be enforceable. Use the full legal name and registered address of each entity exactly as they appear in state business records, not a trade name or abbreviation. Ambiguity about who signed can be fatal.
Also confirm who has authority to sign. For a corporation, that usually sits with officers such as the CEO, president, or general counsel, or someone the board has specifically authorized. For an LLC, the operating agreement typically designates who can bind the company. A signature from someone without actual authority may not hold up.
State the business purpose for the disclosure, and keep it narrow. “Evaluating a potential acquisition of Company X” draws a boundary the receiver can’t cross. “Exploring business opportunities” doesn’t, and lets the other side use what they learn for projects you never contemplated.
Defining the Protected Information
The scope clause is the heart of the agreement. Most cover technical, financial, and business information shared in any form, whether written, electronic, or physical. The disclosing party typically marks written and electronic materials “Confidential” before sending them, which removes any later argument about intent.
Oral disclosures are harder because you can’t stamp a conversation. The standard fix requires the discloser to follow up in writing, usually within about 30 days, summarizing what was shared and identifying what’s confidential. Skip that step and the verbal disclosure may fall outside protection. Some agreements add a catch-all for anything a reasonable person would understand as proprietary from the circumstances, but relying on that alone is risky.
Residual Knowledge Clauses
In collaborations, the receiving party’s employees will inevitably remember things. A residual knowledge clause permits the receiver to use information retained in unaided memory, without reference to notes or documents, and treats that as non-breaching. It exists because you can’t scrub a brain.
These clauses carry real risk for the discloser. They blur the line between protected trade secrets and general industry knowledge and make breach harder to prove. Disclosers often negotiate narrow residuals language or exclude categories such as patented technology or copyrighted material from the exception. Receivers, by contrast, want residuals language because it gives their people room to work on future projects without triggering a lawsuit.
What the Receiving Party Must Do
Two core restrictions apply once information changes hands. The non-use obligation limits the receiver to using the information only for the stated business purpose. The non-disclosure obligation bars sharing it with outsiders without prior written consent, though most agreements let the receiver bring in officers, employees, and professional advisors who need access and agree to the same restrictions.3U.S. Securities and Exchange Commission. Confidentiality and Non-Disclosure Agreement
A standard of care clause sets how carefully the materials must be handled. The common formulation requires at least the same degree of care the receiver uses for its own proprietary information.4U.S. Securities and Exchange Commission. Confidentiality Agreement In practice: encrypted storage for digital files, restricted physical access for printed documents, and distribution limited to people who actually need the material.
Return or Destroy
When the purpose ends or the agreement terminates, the receiver must return or destroy all confidential materials, including physical documents, electronic copies, notes, and derivative summaries. Most agreements require a senior officer to certify in writing that nothing was kept.
The usual exception covers copies on automated backup or disaster recovery systems, which can remain in place as long as the confidentiality obligations continue to apply and the backups aren’t actively accessed. Without a return-or-destroy clause, the receiver can sit on your data indefinitely after the deal collapses.
What’s Excluded From Confidential Treatment
Not everything exchanged under a confidentiality agreement stays locked down. Standard carve-outs cover information the receiver already knew or that anyone can look up:
- Information that was already public, or that becomes public through no fault of the receiver.
- Information the receiver can show it already possessed before signing.
- Information the receiver develops independently without relying on the disclosed materials.
- Information the receiver obtains from an independent third party who had no confidentiality obligation.
The receiver bears the burden of proving an exclusion applies. Records of prior knowledge and documentation of independent development matter more than people expect; without the paper trail, these defenses are hard to invoke.
Compelled Disclosure
A subpoena, court order, or regulatory demand can override confidentiality. Most agreements handle this by requiring the receiver to notify the discloser immediately so the discloser can seek a protective order before anything is produced.3U.S. Securities and Exchange Commission. Confidentiality and Non-Disclosure Agreement If no protective order issues, the receiver may disclose only the specific portion legally compelled.
Limits the Agreement Cannot Override
Federal law puts hard ceilings on what a confidentiality agreement can actually prevent an employee from doing, and these override whatever the contract says.
DTSA Whistleblower Immunity
The Defend Trade Secrets Act grants immunity to anyone who discloses a trade secret in confidence to a government official or attorney for the purpose of reporting a suspected legal violation, or who files trade secret information in court under seal. Employers must include notice of this immunity in any contract or agreement with an employee governing the use of trade secrets or confidential information. The notice can appear directly in the agreement or by reference to an internal policy document describing the employee’s reporting rights.5Office of the Law Revision Counsel. 18 U.S. Code 1833 – Exceptions to Prohibitions
Omit the notice and the employer loses the right to recover exemplary damages (up to double the actual damages) and attorney fees in any DTSA action against that employee. “Employee” includes contractors and consultants, not just W-2 workers.5Office of the Law Revision Counsel. 18 U.S. Code 1833 – Exceptions to Prohibitions
SEC Rule 21F-17
SEC Rule 21F-17 bars anyone from taking action to impede someone from communicating directly with the SEC about a possible securities law violation, including enforcing or threatening to enforce a confidentiality agreement to block such communications.6eCFR. 17 CFR 240.21F-17 – Staff Communications With Individuals Reporting Possible Securities Law Violations The SEC has brought enforcement actions even when no employee was actually blocked, so an overly restrictive agreement is itself a compliance risk.
Overbroad Agreements Treated as Non-Competes
Courts in multiple jurisdictions have struck down confidentiality provisions written so broadly they effectively prevent someone from working in their field. When the agreement purports to protect general knowledge, publicly available information, or the employee’s overall skills, courts have voided those provisions as unauthorized non-competes. Covering more than genuinely proprietary information risks invalidating the entire confidentiality clause, not just the overreaching portion.
Disclosure Period vs. Confidentiality Period
Define two separate timeframes. The disclosure period, sometimes called the “term,” is the window in which the parties may exchange information. The confidentiality period is how long the receiver must keep it secret after receiving it, and it typically runs well past the disclosure window.7University of Tennessee, Knoxville. Confidentiality Agreement Primer
A typical structure might allow sharing for one year and require confidentiality for five years after each disclosure. An agreement with no defined term may create obligations that run indefinitely.7University of Tennessee, Knoxville. Confidentiality Agreement Primer If you’re receiving, push for a defined end date. If you’re disclosing, set the confidentiality period long enough that the information will have lost its competitive value by the time it expires.
Remedies if Someone Breaches
A breach can trigger contract remedies, and if the information qualifies as a trade secret, additional statutory remedies under the DTSA or state trade secret law.
The most immediate remedy is a court order stopping the breach. Under the DTSA, a court can enjoin actual or threatened misappropriation. It cannot prevent someone from taking a new job; any restriction on future employment must rest on evidence of threatened misappropriation, not on what the person knows.8Office of the Law Revision Counsel. 18 U.S. Code 1836 – Civil Proceedings Most agreements include language where both parties acknowledge that a breach would cause irreparable harm, which helps the discloser obtain an injunction without first proving an exact dollar loss.
On damages, the DTSA allows actual loss plus any unjust enrichment not already covered by the loss calculation, or alternatively a reasonable royalty for the unauthorized use. When misappropriation is willful and malicious, the court can award exemplary damages up to two times actual damages, plus attorney fees to the prevailing party.8Office of the Law Revision Counsel. 18 U.S. Code 1836 – Civil Proceedings Some agreements add a liquidated damages clause setting a predetermined breach amount; those are enforceable if the figure is a reasonable estimate of hard-to-calculate harm, but courts will throw out numbers that look like punishment.
Signing and Governing Law
The agreement takes effect once authorized representatives of both parties sign. Electronic signatures are fully valid under the Electronic Signatures in Global and National Commerce Act, which prevents a contract from being denied effect solely because it was signed electronically.9Office of the Law Revision Counsel. 15 U.S.C. Chapter 96 – Electronic Signatures in Global and National Commerce Platforms that produce audit trails and tamper-evident records are standard.
Each party should keep a fully executed copy somewhere it can be pulled quickly for compliance review or litigation. Log the execution date, the disclosure period’s start and end, and the confidentiality expiration so no one has to reverse-engineer them from the contract years later.
Most agreements include a choice-of-law and venue clause specifying which state’s law governs and where any suit must be filed. Pick a jurisdiction with developed commercial law, and explicitly exclude its conflict-of-laws rules, which could otherwise redirect the dispute to a different state’s law. If the agreement also contains non-solicitation terms, enforceability varies significantly by state, so the governing-law choice can decide whether key provisions survive.