A confidentiality agreement is enforceable when it names the right parties, defines the protected information with real boundaries, sets clear obligations and a sensible time limit, carries the federal notices the law requires, and leaves room for a court to grant the kind of relief you’ll actually need. To write one, work through each of those pieces in order, and keep the language specific enough that both sides — and later a judge — can tell what the agreement covers.
Pick a Unilateral or Mutual Structure
The first choice is who is disclosing. A unilateral NDA protects one party: the person or company handing over sensitive material. The other side agrees to keep it secret but shares nothing of their own. Use this when you’re hiring a contractor, pitching investors, or onboarding an employee who will see trade secrets.
A mutual NDA runs in both directions. Each party discloses something confidential and each agrees to protect the other’s. Joint ventures, merger negotiations, and technology partnerships almost always call for a mutual agreement because both sides are exposing something valuable. If there’s any realistic chance both parties will exchange sensitive information, start mutual. Converting after the fact creates gaps that are hard to close.
Define the Confidential Information
This provision decides whether the rest of the agreement means anything. A definition that’s too narrow leaves valuable information unprotected. One that’s too broad can sink the whole NDA, because courts have struck down agreements that try to classify essentially everything as confidential.
Name the categories of information you actually need to protect: financial records, customer data, product designs, source code, pricing strategies, or whatever applies. Be specific enough that both sides know what’s covered, but don’t try to list every document. A workable approach is to identify the major categories and add a catch-all for information that a reasonable person would understand to be confidential based on how it’s marked or the circumstances of disclosure.
If trade secrets are in play, the definition carries extra weight. Under the Defend Trade Secrets Act, information qualifies as a trade secret only when the owner has taken reasonable steps to keep it secret and the information has economic value because it isn’t publicly known.1Office of the Law Revision Counsel. 18 U.S. Code 1839 – Definitions Having an NDA in place is strong evidence of those reasonable steps. Without one, proving trade secret status gets much harder.
Carve Out the Standard Exclusions
Every well-drafted NDA excludes certain information from the confidentiality obligation. These exclusions are standard, and leaving them out makes the agreement look one-sided, which hurts enforceability. The usual carve-outs:
- Information that is already public, or becomes public through no fault of the receiving party.
- Information the receiving party already knew before the disclosure, provided they can show it with written records.
- Information the receiving party developed independently, without using or referencing the confidential material.
- Information received from a third party who wasn’t under a confidentiality obligation.
If you’re the one disclosing, draft these tightly. Requiring written evidence of independent development, for example, shifts the burden of proof in your favor if there’s ever a dispute.
Spell Out the Receiving Party’s Obligations
The obligations section answers one question: what must the receiving party do, and not do, with the information? At minimum, cover three points. The receiving party must keep the information confidential and not disclose it outside the agreement. The receiving party can use the information only for the specific purpose the agreement describes — evaluating a deal, performing a contract, or whatever the relationship requires. And the receiving party must limit internal access to people who genuinely need it, with those people bound by confidentiality obligations of their own.
Most NDAs require the receiving party to protect confidential information with at least a reasonable degree of care. Some require the same level of care the receiving party uses for its own most sensitive information. The stronger standard is worth pushing for if you’re disclosing, because it gives you a clearer benchmark when you need to prove a breach.
Set Duration and Return of Materials
The term sets how long the obligations last. Most NDAs run between one and five years, but the right duration depends on how long the information stays valuable. Trade secrets can remain valuable indefinitely, and courts have upheld open-ended confidentiality obligations for genuine trade secrets. For time-sensitive business information, like pricing for a particular deal, a shorter term fits better.
Address what happens to the materials when the relationship ends or either party asks for them back. The standard approach requires the receiving party to return all copies or destroy them and provide written confirmation. Be specific about what “all copies” means: printed documents, digital files, emails, backups, and any notes or summaries derived from the confidential information. If legal or compliance rules require the receiving party to retain certain records, acknowledge that exception while keeping those retained copies subject to the confidentiality obligations.
Write the Remedies Clause
Once confidential information leaks, money alone often can’t undo the harm. NDAs typically include a provision for injunctive relief, meaning a court order that stops further disclosures. Getting an injunction usually requires showing irreparable harm — harm that money can’t adequately fix. Many NDAs include a clause where both parties agree in advance that a breach would cause irreparable harm. Whether courts treat that clause as binding or merely as evidence varies by jurisdiction, so don’t rely on it as the only argument.
Beyond an injunction, the disclosing party can seek monetary damages for actual losses. Quantifying the damage from a confidentiality breach is notoriously difficult, which is why some NDAs include a liquidated damages clause: a predetermined amount both parties agree represents a reasonable estimate of the harm a breach would cause. Courts enforce these clauses only when actual damages would be genuinely hard to calculate and the agreed amount is a reasonable forecast rather than a penalty. An inflated number attached to a limited-scope agreement is likely to be struck down.
Include the Federal Provisions You Cannot Skip
Federal law imposes specific requirements on confidentiality agreements that many people drafting NDAs don’t realize apply. Ignoring them can cost you money in litigation or leave parts of your agreement unenforceable.
DTSA Whistleblower Immunity Notice
If your NDA involves an employee, contractor, or consultant, federal law requires a notice about whistleblower immunity. Under the Defend Trade Secrets Act, any individual who discloses a trade secret to a government official or an attorney for the purpose of reporting a suspected legal violation is immune from criminal and civil liability under federal and state trade secret laws. The same protection covers disclosures made in sealed court filings.2Office of the Law Revision Counsel. 18 U.S. Code 1833 – Exceptions to Prohibitions
Employers must put notice of this immunity in any agreement that governs the use of trade secrets or confidential information. You can either include the notice directly in the NDA or cross-reference a separate company policy document that contains the required language. The penalty for skipping it is concrete: in a later suit against that employee for trade secret misappropriation, you lose the ability to recover exemplary (double) damages or attorney fees, even if you win on the merits.2Office of the Law Revision Counsel. 18 U.S. Code 1833 – Exceptions to Prohibitions “Employee” here includes contractors and consultants, not just W-2 workers.
The Speak Out Act
Since 2022, pre-dispute nondisclosure clauses cannot be enforced in cases involving sexual assault or sexual harassment where the alleged conduct violates federal, tribal, or state law.3Office of the Law Revision Counsel. 42 U.S. Code 19403 – Limitation on Judicial Enforceability of Nondisclosure and Nondisparagement Contract Clauses Relating to Sexual Assault Disputes and Sexual Harassment Disputes The key word is “pre-dispute.” An NDA signed before any harassment occurs cannot prevent someone from speaking about what happened. NDAs entered as part of a settlement after a formal claim has been filed are still enforceable. A blanket confidentiality clause in an employment agreement will not silence future harassment complaints.
SEC Rule 21F-17
If your NDA could reach people who might observe securities law violations, which covers most employees at publicly traded companies, SEC Rule 21F-17 applies. The rule prohibits any person from taking action to impede someone from communicating directly with the SEC about a possible securities law violation, including enforcing or threatening to enforce a confidentiality agreement that would block such communication.4eCFR. 17 CFR 240.21F-17 The SEC has fined companies for agreements that prohibited disclosing confidential information to regulators, that required departing employees to certify they hadn’t filed agency complaints, and that required former employees to notify the company before speaking with the SEC. Include a carve-out that explicitly permits communications with government agencies.
Avoid What Makes NDAs Unenforceable
An NDA with all the right sections can still fail if it crosses certain lines. The most common reasons courts refuse to enforce confidentiality agreements:
- Overbroad scope. A definition so sweeping that it covers essentially everything the receiving party learns reads as an unreasonable restraint, not legitimate protection.
- No consideration. Like any contract, an NDA needs something of value exchanged by both sides. At the start of employment, the job itself is the consideration. Asking an existing employee to sign a new NDA mid-employment requires something additional: a bonus, a promotion, access to new information, or another tangible benefit.
- No defined time period. An NDA that applies forever to all information, not just trade secrets, is vulnerable. Ordinary business information should have an expiration.
- Covering public information. Courts won’t enforce an obligation to keep secret what’s already available, including information the disclosing party failed to protect through its own carelessness.
- Requiring illegal conduct. An agreement that asks someone to conceal information they’re legally required to report to a regulator, law enforcement, or a court will not survive.
A severability clause helps with some of these risks. It tells a court that if one provision is unenforceable, the rest of the agreement should survive. Without severability, a single overbroad clause can take down the whole NDA.
Add the Boilerplate That Holds It Together
Several standard provisions round out a complete agreement. A governing law clause identifies which state’s laws apply to any dispute; pick a jurisdiction where you’d be comfortable litigating. A jurisdiction and venue clause specifies which courts will hear disputes. An integration clause confirms that the signed NDA is the complete agreement and supersedes prior discussions or side deals about confidentiality.
State that the NDA cannot be modified except in a signed writing. Add language making the agreement binding on successors and assigns, so an acquisition doesn’t erase the obligations. Specify whether the receiving party can assign their obligations to someone else or whether assignment requires the disclosing party’s written consent. Most disclosing parties want to control where their information ends up, so restricting assignment is the safer default.
Signing and Review
You don’t need wet ink. Under the federal ESIGN Act, electronic signatures carry the same legal weight as handwritten ones for transactions in interstate or foreign commerce, and a contract cannot be denied legal effect solely because it was signed electronically.5Office of the Law Revision Counsel. 15 U.S. Code 7001 – General Rule of Validity To make an electronic signature hold up, make sure the signer clearly intends to sign, consents to conducting business electronically, and receives a fully executed copy. The platform should retain records that can be reproduced later.
Having a lawyer review the agreement before anyone signs is worth the cost, which typically runs a few hundred dollars for a straightforward NDA. An attorney can catch enforceability problems, confirm the mandatory federal provisions are in place, and make sure the agreement actually protects what you think it protects. That matters most for NDAs involving trade secrets, employment relationships, or high-value transactions, where a flawed agreement can cost far more than the review fee.