A complete NDA checklist runs through about a dozen provisions: the structural choice between a one-way or mutual agreement, the parties and purpose, the definition of confidential information, authorized use and standard exclusions, legally required carve-outs, duration and return of materials, governing law, remedies, non-solicitation terms if any, and proper execution. Miss one and you may end up with sensitive information unprotected or an entire contract a court won’t enforce. The sections below walk each item in the order you’d draft or review them.
One-Way or Mutual
Decide first whether the agreement needs to protect one side’s information or both. A unilateral NDA runs in one direction: one party discloses, the other agrees not to share. That fits situations like showing financials to a potential investor or sharing source code with a contractor. A mutual NDA binds both parties equally and makes more sense for joint ventures, merger talks, or any collaboration where each side brings proprietary material.
The choice shapes every clause that follows. In a mutual agreement, each definition, exclusion, and remedy has to work symmetrically. In a unilateral agreement, the receiving party carries most of the obligations and the disclosing party keeps the enforcement tools. Getting this wrong at the top means rewriting everything underneath.
Parties and Purpose
Use each party’s full legal name as registered with the relevant Secretary of State. References like “the company” or a DBA create ambiguity about which entity actually holds the obligation. Include registered business addresses for legal notices.
The purpose clause is the single most important sentence in the document because it controls everything else. State narrowly why information is being shared: evaluating a potential acquisition, testing software compatibility, exploring a licensing deal. “General business discussions” gives the receiving party room to argue almost any use falls within scope. “Evaluating the feasibility of integrating Party A’s payment processing API into Party B’s mobile application” does the opposite and makes unauthorized use obvious.
What Counts as Confidential Information
Vague definitions invite disputes. List the categories you’re protecting: technical specifications, financial projections, customer databases, marketing strategies, product roadmaps. Require that written materials be marked “Confidential” or with a similar label so the recipient has clear notice.
Oral disclosures are harder because there’s nothing to stamp. Standard practice requires the disclosing party to follow up with a written summary identifying what was shared, typically within fifteen days of the conversation. That paper trail separates casual shop talk from protected information, which matters if the dispute ends up in court.
Trade Secret Threshold
If any of the shared information qualifies as a trade secret, say so explicitly. Under federal law, a trade secret must meet two tests: the owner has taken reasonable measures to keep it secret, and the information derives economic value from not being publicly known.1Office of the Law Revision Counsel. 18 U.S. Code 1839 – Definitions The NDA itself counts as one of those reasonable measures, but it isn’t enough alone. Courts have found that inconsistent enforcement undermines the entire claim. Requiring some employees to sign confidentiality agreements while letting others access the same data without one can lead a court to conclude the secrecy requirement wasn’t taken seriously.
So audit how the information is actually handled internally, not just how it’s described in the agreement. Access controls, password protections, and need-to-know restrictions all feed into whether a court treats the information as a trade secret worth protecting.
Authorized Use and Exclusions
Restrict the receiving party to using shared data only for the purpose stated in the agreement. Any other application, whether an internal research project or feeding the data into an unrelated product, is a breach. Spell this out rather than relying on implication.
Standard Carve-Outs
Every enforceable NDA carves out categories of information that don’t trigger confidentiality obligations. Without these, the agreement risks being overbroad and unenforceable. The standard carve-outs cover information that:
- Was publicly available through no fault of the receiving party.
- Was already known to the recipient before disclosure and can be shown to have been.
- Was independently developed by the recipient without using the disclosed materials.
- Came lawfully from a third party who wasn’t bound by a confidentiality obligation.
These exclusions protect the receiving party from liability for knowledge they would have had regardless of the NDA. Leaving them out doesn’t strengthen the agreement; it makes a court more likely to narrow or void the entire definition.
Residuals
In technology and pharmaceutical collaborations, where employees absorb large amounts of technical knowledge through months of joint work, a residuals clause may appear. It allows a party to use information retained in an employee’s unaided memory after the NDA expires, on the theory that you can’t surgically remove knowledge from someone’s brain. Residuals clauses typically exclude written or recorded materials and do not transfer ownership of any underlying intellectual property.
If you’re the disclosing party, a residuals clause should make you uncomfortable unless the collaboration genuinely requires it. If you’re the receiving party in a technology deal, expect to negotiate for one. Either way, define what “unaided memory” means and consider excluding patented information from the exception entirely.
Legally Required Carve-Outs
This is where most homemade NDAs fail. Federal law restricts what an NDA can prohibit, and ignoring the restrictions can cost the disclosing party significant remedies or expose the company to regulatory action.
DTSA Whistleblower Immunity Notice
Any NDA between an employer and an employee or contractor that governs trade secrets or confidential information must include a notice of whistleblower immunity. The notice has to inform the person that federal law protects individuals who disclose trade secrets in confidence to a government official or an attorney for the sole purpose of reporting a suspected violation of law, or who file trade secret information under seal in a lawsuit.2Office of the Law Revision Counsel. 18 U.S. Code 1833 – Exceptions to Prohibition
Skip the notice and the consequences are concrete: the employer loses the ability to recover exemplary damages (up to double the actual damages) and attorney fees in any trade secret misappropriation action against that employee.2Office of the Law Revision Counsel. 18 U.S. Code 1833 – Exceptions to Prohibition An employer can satisfy the requirement by cross-referencing a separate policy document that lays out the company’s reporting procedures, as long as the reference actually exists in the NDA or an accompanying agreement.
SEC Communications
If your business touches securities in any way, the NDA cannot prevent employees from communicating directly with SEC staff about possible securities law violations. Federal regulation explicitly prohibits enforcing or threatening to enforce a confidentiality agreement to block those communications.3eCFR. 17 CFR 240.21F-17 – Staff Communications With Individuals Reporting Possible Securities Law Violations The SEC has brought enforcement actions against companies whose NDAs or exit agreements required departing employees to waive the right to file complaints with government agencies. Language that even appears to discourage SEC contact can draw scrutiny.
NLRA Protected Activity
For non-supervisory employees, the National Labor Relations Act protects the right to discuss wages, working conditions, and other workplace issues with coworkers. The NLRB has held that severance and confidentiality agreements broad enough to discourage those discussions violate federal labor law. If the NDA covers employees and contains sweeping non-disclosure or non-disparagement language, it needs carve-outs for protected concerted activity under Section 7 of the NLRA.
Compelled Disclosure
Address what happens when a court order or subpoena forces the receiving party to hand over confidential information. A compelled disclosure clause typically requires the recipient to notify the disclosing party promptly (and before disclosing, if legally permitted), give the disclosing party an opportunity to seek a protective order, limit disclosure to what the law actually requires, and request confidential treatment for anything turned over. Without this clause, a recipient who complies with a subpoena could technically be in breach of the NDA, which helps nobody.
Duration, Survival, and Return of Materials
Two time periods matter. The first is the agreement’s active term, during which the parties can share information under its protections. The second is the survival period, which is how long confidentiality obligations last after the agreement terminates or the relationship ends. Active terms commonly run one to five years, but the survival of confidentiality duties should extend beyond that, particularly for trade secrets, where indefinite protection is often appropriate because the information’s value depends on continued secrecy.
Don’t confuse the two. An NDA with a two-year term and no survival clause means all confidentiality obligations evaporate the moment the agreement expires.
Return and Destruction
Once the agreement ends, the recipient must either return or destroy all confidential materials, including copies stored in email, cloud backups, and collaboration platforms. Require a written certification from the recipient confirming that all physical and electronic copies have been permanently deleted or returned. For particularly sensitive data, reference a recognized digital-media sanitization standard such as NIST 800-88 so there’s no ambiguity about what “permanently deleted” actually means. A compliant certificate of destruction documents the storage media’s make, model, and serial number, the method used, the identity of the person who performed it, and verification that the process was completed.
Governing Law, Venue, and Severability
A choice-of-law clause fixes which jurisdiction’s rules will interpret the agreement if a dispute arises. This typically tracks the disclosing party’s headquarters, though it’s negotiable. Pair it with a venue clause specifying the court or arbitration forum where disputes will be heard, which eliminates jurisdictional arguments before they start.
A severability clause protects the rest of the agreement if a court strikes down one provision. Without it, an unenforceable restriction on the receiving party could in theory void the entire NDA. Boilerplate that earns its place.
Remedies
This is where the NDA gets its teeth. An equitable relief clause acknowledges that a breach of confidentiality can cause harm money alone cannot fix, and it preserves the disclosing party’s right to seek an injunction, a court order stopping further disclosure immediately, without waiting for a full trial.
Damages Under the DTSA
If the confidential information qualifies as a trade secret, federal law provides a specific menu of remedies. A court can award damages for actual loss, damages for unjust enrichment not already captured in the actual-loss calculation, and, for willful and malicious misappropriation, exemplary damages up to twice the compensatory award. Attorney fees are also available to the prevailing party in cases involving bad faith claims or willful misappropriation.4Office of the Law Revision Counsel. 18 U.S. Code 1836 – Civil Proceedings Recovering those exemplary damages and fees still requires having included the DTSA whistleblower notice.2Office of the Law Revision Counsel. 18 U.S. Code 1833 – Exceptions to Prohibition
Liquidated Damages
Proving actual monetary harm from a confidentiality breach is often difficult, so some NDAs include a liquidated damages clause setting a pre-agreed dollar amount payable upon breach. Courts enforce these provisions only if actual damages would be hard to calculate and the stated amount is a reasonable estimate of potential loss rather than a punishment. A clause that looks like a penalty, especially one wildly disproportionate to any realistic harm, won’t survive judicial review. If you include one, document the reasoning behind the dollar figure at the time of drafting.
Fee Shifting
A prevailing-party clause shifts the winner’s legal costs to the loser. It discourages frivolous breach claims and gives the disclosing party added incentive to enforce. Without it, each side bears its own legal costs regardless of outcome, which can make enforcement economically irrational for smaller trade secret disputes. Courts applying these clauses have generally used an all-or-nothing approach, awarding the prevailing party all fees rather than splitting them claim by claim.
Non-Solicitation Add-Ons
NDAs frequently bundle in restrictions on soliciting the other party’s employees or customers during and after the relationship. These are separate obligations from the confidentiality provisions and face their own enforceability hurdles. Courts scrutinize the duration, geographic scope, and the breadth of who’s covered. A non-solicitation period of six months to two years is generally considered reasonable; longer periods face increasing skepticism.
Keep the scope limited to people the receiving party actually dealt with during the relationship, not the disclosing party’s entire workforce or customer base. An overly broad restriction that effectively prevents someone from working in their field starts to look like a non-compete, which triggers a much stricter legal analysis. A handful of states, most notably California, void non-solicitation clauses entirely under the same statutes that prohibit non-compete agreements. If parties in those jurisdictions are involved, the clause is likely unenforceable regardless of how carefully you draft it.
Settlement NDAs: A Different Animal
If the NDA accompanies a legal settlement rather than a business relationship, tax consequences enter the picture. Attaching a confidentiality clause to a settlement for a personal injury claim may cause an otherwise tax-free payment to become partially taxable, because any portion allocated to the confidentiality provision doesn’t qualify for the personal-injury exclusion from gross income.
Stakes are higher for sexual harassment or sexual abuse claims. Federal tax law disallows any deduction for a settlement payment subject to a nondisclosure agreement in those cases, and the disallowance extends to related attorney fees.5Office of the Law Revision Counsel. 26 U.S. Code 162 – Trade or Business Expenses An employer insisting on confidentiality in a harassment settlement may be paying for that secrecy with the loss of the entire deduction. If the settlement doesn’t specifically allocate between the claim and the confidentiality component, the IRS may try to treat the full amount as taxable compensation for the silence rather than for the underlying injury.
Execution and Signing
An NDA is only as binding as the authority of the person who signs it. Before exchanging signatures, verify that each signatory actually has the power to bind their organization. For corporations, that authority typically flows from a board resolution granting specific officers the right to execute contracts. If the person signing is a mid-level manager rather than a named corporate officer, ask for documentation confirming authority. Discovering after a breach that the signer lacked authority can unravel the entire agreement.
Electronic signatures carry the same legal weight as ink-on-paper signatures for any transaction in interstate commerce. Federal law provides that a contract cannot be denied legal effect solely because an electronic signature was used in its formation.6Office of the Law Revision Counsel. 15 U.S. Code 7001 – General Rule of Validity Use a platform that logs timestamps, IP addresses, and the sequence of actions each party took; the audit trail is useful for proving validity if the agreement is later disputed. Date the document accurately to establish when confidentiality obligations began, and make sure each party retains a complete executed copy. Notarization is not typically required for an NDA to be enforceable, though some parties request it for added authentication.