What makes a confidentiality agreement enforceable is a combination of ordinary contract validity and a set of confidentiality-specific requirements: a precise definition of what counts as confidential, the exclusions the law requires, a stated purpose for use, a workable duration, the federal carve-outs employers cannot contract around, and remedies a court can actually apply. Miss any of these and a judge can strike the offending clause or refuse to enforce the agreement at all.
The clauses below are the ones that decide whether an NDA holds up when tested. They are also the clauses most often drafted badly.
Contract Basics Every NDA Must Satisfy
Before any confidentiality-specific language matters, the agreement has to work as a contract. Three requirements do most of the work.
Consideration. Each side must give something of value. In an NDA the exchange is usually simple: the disclosing party agrees to share sensitive information, and the receiving party promises to keep it secret. No money has to change hands. Mutual promises are enough.1Legal Information Institute. Consideration
Mutual assent. Both parties have to understand and agree to the same deal. If the terms are so vague that no one could have genuinely agreed on what was covered, a court can void the agreement for lack of assent.
Capacity. Each signer must be of legal age and sound mind, and anyone signing for a company needs actual authority to bind it. An NDA signed by a junior employee who was not authorized to commit the company can be challenged as voidable.2Legal Information Institute. Capacity
Electronic signatures are fine. Under the E-SIGN Act, a contract cannot be denied legal effect solely because it was signed electronically.3Office of the Law Revision Counsel. 15 USC 7001 – General Rule of Validity The signer has to affirmatively consent to conducting business electronically, and platforms like DocuSign and Adobe Sign satisfy that by recording consent, timestamps, and IP addresses at signing.
The Confidential Information Definition
The definition of “confidential information” is the single most important clause in an NDA. Everything else depends on it. A definition that is too vague fails because the receiving party had no real notice of what was off-limits. A definition that is too narrow leaves important material unprotected.
Effective definitions pair a general category statement with concrete examples: financial data, technical specifications, customer lists, marketing strategies, product roadmaps, plus a catch-all for anything marked as confidential or proprietary. For information shared verbally, many agreements require the disclosing party to follow up in writing within 30 days identifying what was confidential. That written confirmation protects both sides. The discloser gets documentation; the recipient gets clarity about what is actually covered.
The recurring drafting mistake is a definition that tries to protect everything. Courts have struck down NDAs whose confidentiality provisions were so broad and abstract that an employee could not have known in advance what disclosures would trigger enforcement. A definition that sweeps in publicly available information, general industry knowledge, or skills the recipient already possessed is a red flag that invites a court challenge and can pull the whole clause down with it.
Exclusions the Law Requires You to Carve Out
No enforceable NDA can claim secrecy over information the marketplace already has. Every solid agreement carves out five categories.
- Publicly available information, whether known to the public already or later made public through no fault of the receiving party.
- Information the receiving party already had before signing, usually proven through existing records.
- Information the receiving party independently develops without relying on the disclosed material.
- Information received from a third party who had no confidentiality obligation to the discloser.
- Information a court order, subpoena, or government investigation legally compels the recipient to produce.
The compelled-disclosure carve-out needs a companion clause. A well-drafted NDA pairs it with a notice requirement: the receiving party must promptly tell the disclosing party about the legal demand before turning anything over, so the discloser has a chance to seek a protective order or narrow the scope. Without that notice provision, confidential material can end up in public court filings before anyone can intervene.
Permitted Use and Who Can See the Information
Defining what is confidential is only half the job. The agreement also has to say how the recipient is allowed to use it. A permitted-use clause locks the information into a single stated purpose: evaluating a potential acquisition, developing a joint product, completing a specific consulting engagement. Any use outside that purpose is an immediate breach.
Most enforceable NDAs go further and restrict who inside the receiving organization can see the material. The standard is a need-to-know test: only employees or advisors who genuinely need the information to accomplish the stated purpose get access, and each of those internal recipients must be bound by confidentiality obligations at least as protective as the NDA itself. If a receiving company lets the data circulate freely through its whole staff, the disclosing party has a strong argument that the permitted-use clause was violated even without an outside leak.
Duration and Survival
Two different time periods run inside every NDA, and mixing them up is a common enforceability problem. The term is how long the parties are actively sharing information under the agreement, often six months to two years. The survival period is how long the confidentiality obligation continues after the relationship ends, and it is almost always longer, commonly three to five years.
For genuine trade secrets, putting a fixed expiration date on the confidentiality obligation is a serious drafting mistake. A time-limited NDA can be read to mean that the disclosed information loses its trade secret status once the clock runs out, which destroys protection not just against the recipient but against the world. For high-value trade secrets, the safer approach is a perpetual confidentiality obligation that lasts as long as the information continues to qualify as a trade secret.
When the agreement ends or the stated purpose is complete, a return-or-destruction clause typically requires the recipient to either return all copies of the confidential material or certify in writing that every copy, including digital files and derivative material, has been permanently destroyed. That written certification creates the paper trail a court will look for if confidential information surfaces later.
Federal Rights an NDA Cannot Override
Federal law carves out several rights that no confidentiality agreement can eliminate. Drafting around them creates enforcement risk: at best the offending clause is struck, and at worst the whole agreement is weakened.
DTSA Whistleblower Immunity Notice
The Defend Trade Secrets Act requires employers to include a specific notice in any agreement with an employee that governs trade secrets or confidential information. The notice must tell the employee that federal law provides immunity from criminal and civil liability for disclosing trade secrets in confidence to a government official or an attorney for the purpose of reporting a suspected legal violation. An employer who leaves the notice out cannot recover exemplary damages or attorney’s fees in any later trade secret action against that employee.4Office of the Law Revision Counsel. 18 USC 1833 – Exceptions to Prohibition Employers can satisfy the requirement by cross-referencing a separate policy document that describes the company’s reporting procedures. The penalty for noncompliance is not that the NDA becomes void; the employer simply forfeits valuable litigation tools if a dispute reaches court.
SEC Whistleblower Communications
An NDA cannot prevent anyone from communicating directly with the SEC about a potential securities law violation. Federal regulations explicitly prohibit enforcing or threatening to enforce a confidentiality agreement to block those communications.5eCFR. 17 CFR 240.21F-17 – Staff Communications The SEC has brought enforcement actions against companies whose separation agreements or investigation confidentiality notices had the effect of chilling employee reports, even when no employee was actually prevented from contacting the agency.
Employee Rights Under the NLRA
The National Labor Relations Act protects employees’ right to engage in concerted activities for mutual aid or protection, including discussions of wages, benefits, and working conditions.6Office of the Law Revision Counsel. 29 USC 157 – Right of Employees A confidentiality clause that broadly prohibits employees from sharing any company information, including compensation data, can violate these protections. The NLRB evaluates such policies from the perspective of an average employee: if a reasonable worker could read the policy as barring conversations about pay or workplace issues, the policy is presumed unlawful unless the employer shows it is narrowly tailored to a legitimate business need. These protections apply in both union and non-union workplaces.
When Overbreadth Makes an NDA Unenforceable
An NDA that protects too much can end up protecting nothing. Courts regularly refuse to enforce agreements whose confidentiality definitions are so sweeping that they effectively prevent the receiving party from working in their field. When that happens, the NDA has crossed the line from protecting legitimate secrets into functioning as a non-compete, and a growing number of jurisdictions will not enforce it.
The warning signs of a problematic NDA: a confidentiality definition that reaches publicly available data or general industry skills, no time limit on the restrictions, and language broad enough that the recipient cannot determine in advance what conduct is prohibited. A California appellate court, for example, voided an agreement that defined confidential information to include essentially all knowledge related to securities trading, finding that it effectively barred the employee from working in finance for life.
Even in jurisdictions that enforce reasonable non-competes, courts have started treating overbroad NDAs with the same skepticism. Draft the confidentiality definition to cover actual proprietary information rather than everything the employee might have picked up on the job.
Remedies That Make the Agreement Worth Enforcing
An NDA is only as strong as the remedies a court will grant when it is breached. Disclosing parties typically pursue two paths together.
Monetary Damages
Damages compensate for actual financial losses from the breach, such as lost profits or mitigation costs. Under the Defend Trade Secrets Act, a court can award damages for actual loss and for any unjust enrichment the breaching party gained from misusing the information. If the misappropriation was willful and malicious, the court can add exemplary damages up to twice the compensatory award.7Office of the Law Revision Counsel. 18 USC 1836 – Civil Proceedings The hard part is proving the number. The value of a leaked trade secret is often speculative, and connecting the breach to a specific dollar amount of lost revenue requires evidence many disclosing parties struggle to produce.
Injunctive Relief
An injunction is a court order forcing the breaching party to stop using or sharing the confidential information. Under the DTSA, a court can grant an injunction to prevent actual or threatened misappropriation and can require affirmative steps to protect the trade secret, such as returning materials or segregating data systems. One important guardrail: the injunction cannot prevent someone from taking a new job, and any employment conditions must rest on evidence of threatened misappropriation, not simply on what information the person happens to know.7Office of the Law Revision Counsel. 18 USC 1836 – Civil Proceedings
Many NDAs include an “irreparable harm” acknowledgment, language designed to help the disclosing party meet the standard for an emergency injunction. Courts do not automatically accept that acknowledgment as dispositive. Federal appellate courts have held that the DTSA authorizes but does not mandate injunctive relief, so the disclosing party still needs to show actual or threatened harm rather than relying on boilerplate.
Attorney’s Fees
A prevailing-party provision shifts litigation costs to the losing side. Under the DTSA, courts can award reasonable attorney’s fees when a misappropriation claim was made in bad faith or when the trade secret was willfully and maliciously taken.7Office of the Law Revision Counsel. 18 USC 1836 – Civil Proceedings Many NDAs include a broader fee-shifting clause covering any enforcement action, raising the stakes for both sides and deterring casual breaches.
Governing Law and Jurisdiction
Every enforceable NDA should specify which state’s law governs the agreement and which court has jurisdiction over disputes. Without these clauses, the parties can spend months fighting over where and under what legal framework a breach claim should be heard.
The choice of governing law matters more than people expect. Trade secret law varies significantly from state to state even though nearly all states have adopted some version of the Uniform Trade Secrets Act. How courts evaluate the reasonableness of an NDA’s scope, what remedies are available, and whether an overbroad agreement gets narrowed or thrown out entirely all depend on the jurisdiction. Picking the governing law at the drafting stage removes that uncertainty and tells both parties the rules before any dispute arises.