Staying in compliance with a non-disclosure agreement means doing what the contract requires at every stage of the relationship: knowing which information is protected, handling it with the care your NDA specifies, passing those duties on to anyone else who touches it, respecting the legal exceptions that override the agreement, and following the return, destruction, and survival rules after the work ends. Most NDA breaches are not dramatic leaks. They are forwarded spreadsheets, files left on a personal laptop after a job ends, and vendors who were never told the information was sensitive. Preventing those quiet failures is what compliance actually looks like.
Start With What Your NDA Actually Protects
Compliance begins with scope, because you cannot protect what you have not identified. NDAs typically sweep in several overlapping categories. Proprietary information generally covers assets the company created or owns, like software code or manufacturing methods. Confidential information is broader, reaching things like client lists, internal financials, pricing strategies, and unreleased product plans. Some agreements define these categories precisely; others use catch-all language covering virtually any nonpublic information the disclosing party shares.
Trade secrets sit at the top of the sensitivity pyramid and carry federal protection. Under the Defend Trade Secrets Act, a trade secret is business, financial, scientific, or technical information that derives economic value from being kept secret, so long as its owner has taken reasonable steps to protect it.1Office of the Law Revision Counsel. 18 USC 1839 – Definitions When your NDA labels something a trade secret, treat it accordingly.
Read your agreement for how protected material gets identified. Many NDAs require the disclosing party to mark documents “confidential” or follow up oral disclosures with written summaries. If your agreement has those marking requirements, unmarked information may technically fall outside the NDA. The safer posture is to treat any nonpublic information received during the relationship as potentially protected until you confirm otherwise.
How to Handle Protected Information Day to Day
Most NDAs require “reasonable efforts” to protect confidential information. The standard is flexible, but in practice it means the kind of safeguards a sensible business uses for its own sensitive data.
The most fundamental control is access on a need-to-know basis. Only the employees or contractors directly involved in the relevant project should see protected materials. This sounds obvious and breaks down constantly. Someone gets added to a shared drive for convenience. A manager forwards a deck to a colleague who “might find it useful.” Each of those moments is a potential compliance failure. Access logs that track who viewed what and when give you both a deterrent and a paper trail if questions arise later.
For digital data, encrypted storage with multi-factor authentication is the baseline. Physical documents should sit in locked storage within restricted areas. Regular audits of both digital and physical systems catch drift before it becomes a problem. The point is not perfection. Courts look at the pattern of care, not whether you achieved an impossible standard.
Flow-Down Clauses for Subcontractors
If your work involves subcontractors or third-party vendors who might see protected information, your NDA likely requires you to ensure they comply with the same confidentiality standards. This is typically handled through flow-down clauses: provisions in your subcontracts that impose the same restrictions on your vendors that the NDA imposes on you. Skip this step and you stay on the hook for any subcontractor leak. The disclosing party does not care that your vendor caused the breach; they care that you let it happen.
What You’re Still Allowed to Disclose
Not every disclosure violates an NDA. Several well-established exceptions define the real boundaries of your duty.
Standard Carve-Outs
Most NDAs exclude information already publicly available through no fault of the receiving party. If data shows up in a news article or a public filing before you disclose it, your NDA obligations do not apply to that information. Independent development without using the disclosed data is typically not a breach either. Some agreements also carve out information you already possessed before signing, though proving this usually requires documentation that predates the agreement.
Whistleblower Immunity
Federal law creates a safe harbor that overrides any NDA’s confidentiality terms. Under the Defend Trade Secrets Act, you cannot be held criminally or civilly liable for disclosing a trade secret to a government official or an attorney if the disclosure is made confidentially and solely for the purpose of reporting a suspected legal violation.2Office of the Law Revision Counsel. 18 USC 1833 – Exceptions to Prohibitions The same protection applies if you include a trade secret in a court filing made under seal as part of a retaliation lawsuit. No NDA can override this immunity, regardless of how the confidentiality clause is worded.
Subpoenas and Court Orders
If you receive a subpoena or court order requiring you to produce information covered by your NDA, complying with that legal obligation is not a breach, but there is a process. Most NDAs require you to notify the disclosing party promptly so they can seek a protective order or take other steps to limit what gets disclosed. Skipping that notification, even when the disclosure itself was legally compelled, can put you in breach of the agreement’s procedural requirements.
If You Draft NDAs: The Required Whistleblower Notice
Employers using NDAs with employees or contractors have a federal compliance duty that many companies overlook. The Defend Trade Secrets Act requires employers to include notice of whistleblower immunity in any agreement with an employee that governs trade secrets or confidential information.2Office of the Law Revision Counsel. 18 USC 1833 – Exceptions to Prohibitions You can satisfy this by including the immunity language directly in the NDA or by cross-referencing a company policy document that explains the employee’s right to report suspected violations.
The penalty for leaving the notice out is concrete. An employer who does not comply cannot recover exemplary damages or attorney fees in a trade secret misappropriation action against that employee.2Office of the Law Revision Counsel. 18 USC 1833 – Exceptions to Prohibitions The statute defines “employee” broadly to include contractors and consultants, so the requirement is not limited to W-2 workers. If your NDA templates predate 2016, check them.
What an NDA Cannot Legally Restrict
Compliance also means knowing when the law makes certain NDA provisions unenforceable. Trying to enforce an illegal restriction creates its own legal exposure.
The federal Speak Out Act, enacted in 2022, makes predispute nondisclosure and nondisparagement clauses judicially unenforceable when the underlying dispute involves sexual assault or sexual harassment and the alleged conduct violates federal, tribal, or state law.3Office of the Law Revision Counsel. 42 USC Ch. 164 – Speak Out Act The key word is “predispute”: NDAs signed before an allegation arises cannot silence the person making the claim. The law does not prevent confidentiality agreements as part of a settlement after a dispute has already surfaced, and it explicitly preserves the right to protect trade secrets and proprietary information.
Nearly 20 states have enacted their own laws restricting NDA provisions related to workplace harassment, discrimination, and retaliation. Some go further than the federal Speak Out Act by covering all forms of discrimination rather than just sexual misconduct, by voiding both predispute and post-dispute confidentiality clauses, or by penalizing employers who try to enforce prohibited restrictions. If you operate in multiple states, your templates need to account for the strictest applicable law.
Obligations When the Relationship Ends
When the business relationship ends, a new wave of duties kicks in. This is where parties get sloppy and where a surprising number of lawsuits originate.
Return or Destroy
Most NDAs require the receiving party to either return all confidential materials or destroy them and provide written certification that the destruction is complete. Materials means digital copies too: files on laptops, emails, cloud backups, and anything on personal devices used for work. Deleting files from a desktop is not enough if copies live on backup servers or in email archives. Compliance means a thorough sweep, documented.
Survival Periods
The active term of the NDA may end, but confidentiality obligations almost always outlast it. Survival clauses typically extend protection for two to five years after the relationship concludes. For trade secrets specifically, the duty can last indefinitely, since trade secret protection under federal law does not expire as long as the information retains its economic value and the owner continues to keep it secret.1Office of the Law Revision Counsel. 18 USC 1839 – Definitions Check your agreement’s survival clause before assuming your obligations have ended.
Residuals Clauses
Some NDAs include a residuals clause that carves out information retained in your unaided memory. After working with someone’s confidential data for months or years, you inevitably absorb general knowledge, concepts, and techniques you cannot simply erase. A residuals clause permits you to use that retained knowledge as long as you did not deliberately memorize specific information to take with you. These clauses typically exclude actual trade secrets and do not give you the right to reproduce specific documents or data sets from memory. Whether your NDA includes one makes a real difference in what you can do after the relationship ends.
If Protected Information Gets Out
If information leaks despite your precautions, how you respond matters almost as much as the breach. Courts and disclosing parties distinguish between a company that made a mistake and scrambled to fix it and one that shrugged and hoped nobody noticed.
Your NDA likely specifies a notification window, and the timeframes are often tight. Report the breach to the disclosing party as soon as you discover it. Your notification should explain what information was exposed, how the breach occurred, and what steps you have already taken to contain it. Vague, delayed reports signal indifference and make a good-faith argument harder later.
Beyond notification, the receiving party has to cooperate in mitigation. That can mean helping track down where the information went, participating in legal actions to prevent further distribution, or implementing additional security to prevent recurrence. Prompt, transparent cooperation is often the difference between a dispute that resolves through negotiation and one that escalates to litigation.
What’s at Stake if Compliance Fails
Knowing the consequences gives the rest of this work its weight. Breach remedies run on two tracks: contractual remedies built into the agreement, and statutory remedies available under federal law when trade secrets are involved.
The most immediate remedy is an injunction stopping further use or disclosure. Under the Defend Trade Secrets Act, courts can grant injunctions to prevent actual or threatened misappropriation, though the injunction cannot prevent someone from taking a new job based solely on what they know.4Office of the Law Revision Counsel. 18 USC 1836 – Civil Proceedings
A disclosing party can recover actual losses caused by the misappropriation, plus any unjust enrichment the breaching party gained that is not already captured in the loss calculation. The court can instead award damages measured as a reasonable royalty for the unauthorized use.4Office of the Law Revision Counsel. 18 USC 1836 – Civil Proceedings Some NDAs add liquidated damages clauses that set a predetermined amount payable upon breach. Courts will enforce these only if the amount reflects a reasonable estimate of anticipated losses rather than a punishment. An arbitrarily high figure designed to scare the receiving party into compliance will likely be struck down.
If the misappropriation was willful and malicious, a court can award exemplary damages up to twice the amount of actual damages. The court can also award reasonable attorney fees to the prevailing party when a claim is brought or defended in bad faith, or when the misappropriation was willful.4Office of the Law Revision Counsel. 18 USC 1836 – Civil Proceedings Many NDAs also include their own fee-shifting provisions, so even disputes that do not involve trade secrets can leave the losing party covering both sides’ legal costs. The financial exposure from a breach can escalate far beyond whatever advantage the breaching party hoped to gain.