If you’ve signed an NDA to receive someone else’s confidential information, you are the receiving party, and the agreement imposes real legal duties on you: use the information only for the purpose stated in the contract, protect it with the care the agreement specifies, limit who inside your organization sees it, and return or destroy it when the relationship ends. Breach those duties and you can face a court injunction, actual damages, disgorgement of your profits, a doubling of damages for willful misuse, and attorney fees. The specifics depend on the agreement’s wording and whether the information qualifies as a trade secret, but federal law sets a floor that applies regardless of the state you’re in.
What Information You Are Actually Bound to Protect
Not everything shared during a business discussion falls under the NDA. Most agreements require written materials to carry a visible “Confidential” label or similar marking. If a document isn’t marked, it may sit outside the agreement’s protection, and you have no duty to treat it as restricted.
Oral disclosures work differently. The standard approach requires the disclosing party to follow up in writing within a set window, often 10 to 30 days, identifying what was said and confirming it as confidential. If that written confirmation never arrives, you typically have no duty to protect what was said. Reading your own agreement’s marking and confirmation rules closely is worth the time; assuming everything discussed in a meeting is off-limits can leave you overcautious, while assuming nothing is can leave you exposed.
Several categories of information fall outside your confidentiality duty even under a broad NDA:
- Information you already possessed before signing. Documenting what you knew beforehand protects you from later disputes.
- Information that becomes publicly known through no fault of yours, whether published, announced, or disclosed by the owner itself.
- Information your team develops independently, without relying on anything the disclosing party shared. Clean internal records of development timelines are what prove this.
- Information obtained through reverse engineering. Federal trade secret law excludes reverse engineering and independent derivation from the definition of “improper means” for acquiring trade secrets, though some NDAs contractually prohibit reverse engineering, so check your specific agreement.1Office of the Law Revision Counsel. 18 USC 1839 – Definitions
Your Duty of Care and the Limits on Use
Once you accept the role, you have a legal obligation to actively safeguard what you receive. Agreements describe this duty one of two ways. The more common version requires “reasonable care,” meaning the level of protection a sensible business would apply in similar circumstances. The alternative requires you to treat the information with the same care you use for your own most sensitive internal records, which can be a higher or lower bar depending on your actual habits.
Federal trade secret law reinforces this. The owner of a trade secret must take “reasonable measures” to keep it secret for the information to qualify for protection at all.1Office of the Law Revision Counsel. 18 USC 1839 – Definitions That standard flows down to you. In practice, reasonable measures include encrypting digital files, restricting access to employees who genuinely need it, and storing physical documents in locked spaces. Courts look at how information is stored, who can access it, and whether confidentiality provisions existed when deciding whether protection was adequate.
Use is limited to the specific purpose stated in the agreement. That purpose clause is the single most important limitation on what you can do with someone else’s data. If the agreement says you’re evaluating a potential acquisition, you cannot repurpose the financial projections for an unrelated product launch. Use outside the stated purpose is a breach.
Who You Can Share With Inside Your Organization
Most agreements let you share the information with a limited group of representatives: attorneys, accountants, financial advisors, and senior employees who need the information to fulfill their role in the transaction. These individuals typically must either sign their own confidentiality acknowledgments or already be bound by professional ethics rules that impose equivalent duties.
Here is the part receiving parties underestimate. You are almost always held responsible for breaches committed by those representatives. Standard NDA language makes you liable if an attorney, consultant, or employee you authorized to see the information goes on to misuse it. That liability sits on top of whatever direct claims the disclosing party might bring against the representative individually. Every person you loop in is a risk you personally carry.
When You Can Disclose Despite the NDA
Confidentiality agreements do not override a court order or lawful subpoena. Nearly every well-drafted NDA includes a carve-out allowing you to disclose protected information when legally compelled, but that carve-out usually comes with conditions.
The standard procedure: if you receive a subpoena or court order demanding information covered by your NDA, promptly notify the disclosing party in writing. Most agreements require that notice to include a copy of the subpoena or order. The purpose is to give the disclosing party time to seek a protective order or negotiate another remedy before you hand anything over. Federal Rule of Civil Procedure 26(c) allows any party to request a protective order requiring that trade secrets or other confidential commercial information not be revealed, or be revealed only in a limited way.2Cornell Law School – Legal Information Institute. Federal Rules of Civil Procedure Rule 26 – Duty to Disclose; General Provisions Governing Discovery
If no protective order materializes and you remain legally required to disclose, share only the specific portion the subpoena or order actually demands. Handing over an entire data room because one document was subpoenaed would likely be treated as a breach of your confidentiality obligations for everything beyond what was compelled.
Whistleblower Immunity You Keep
One disclosure right the NDA cannot take from you: under the Defend Trade Secrets Act, an individual who discloses a trade secret to a government official or an attorney solely to report a suspected legal violation cannot be held liable under any federal or state trade secret law for that disclosure.3Office of the Law Revision Counsel. 18 USC 1833 – Exceptions to Prohibitions The same protection covers disclosures made in sealed court filings as part of a retaliation lawsuit. If you are a contractor or consultant rather than a traditional employee, the protection still covers you.
What a Breach Actually Costs
Breach opens the door to several categories of legal consequences, and they stack.
Injunctions
The most immediate remedy is a court order directing you to stop disclosing or using the information. Under the Defend Trade Secrets Act, a court can grant an injunction to prevent actual or threatened misappropriation of a trade secret on whatever terms the court considers reasonable.4Office of the Law Revision Counsel. 18 USC 1836 – Civil Proceedings The court can also order you to take affirmative steps to protect the trade secret, such as retrieving copies that were improperly shared. One limitation: an injunction cannot prevent someone from taking a new job, and any employment-related restrictions must be based on evidence of actual threatened misappropriation rather than the knowledge someone carries in their head.
Damages
The disclosing party can recover damages for actual losses caused by the misappropriation, plus any additional profits you gained from the unauthorized use that aren’t already captured in the actual loss calculation. Alternatively, a court can award damages based on a reasonable royalty for the unauthorized use.4Office of the Law Revision Counsel. 18 USC 1836 – Civil Proceedings
If the misappropriation was willful and malicious, the court can award exemplary damages up to twice the amount of actual damages on top of the base award.4Office of the Law Revision Counsel. 18 USC 1836 – Civil Proceedings Attorney fees can also be awarded to the prevailing party in cases involving willful misappropriation or bad-faith claims. The math adds up fast. Actual damages plus unjust enrichment plus a 2x multiplier plus legal fees can turn a single confidentiality breach into a seven-figure judgment.
One wrinkle on the multiplier and fee award: if the agreement covers trade secrets and the employer failed to include the required whistleblower immunity notice (or at least a cross-reference to a policy document explaining it), the employer loses the right to recover exemplary damages or attorney fees against that employee or contractor.3Office of the Law Revision Counsel. 18 USC 1833 – Exceptions to Prohibitions
Liquidated Damages
Some agreements sidestep the difficulty of proving actual losses by setting a predetermined dollar amount or formula that applies if a breach occurs. These clauses are enforceable so long as the amount reflects a reasonable estimate of potential harm and isn’t so large that a court would consider it a penalty. Courts refuse to enforce liquidated damages provisions that look punitive or unconscionable.
Deadlines to Sue
Under federal law, a trade secret misappropriation claim must be filed within three years of the date the misappropriation was discovered or should have been discovered through reasonable diligence.4Office of the Law Revision Counsel. 18 USC 1836 – Civil Proceedings For breach of contract claims based on the NDA itself rather than the DTSA, the limitations period varies by state but commonly falls between four and six years.
How Long Your Duty Lasts
Check the agreement’s survival clause, which governs how long the confidentiality duty extends after the agreement itself expires or the business relationship ends. For general business information, survival periods typically run from one to five years, depending on the sensitivity of the data and how quickly it becomes stale.
Trade secrets are different. Because trade secret protection under both federal and state law lasts as long as the information remains secret and commercially valuable, courts generally allow confidentiality obligations for trade secrets to run indefinitely. The obligation effectively self-terminates once the information stops qualifying as a trade secret, whether because it leaked, became obsolete, or entered public knowledge through legitimate channels. For information that doesn’t rise to trade-secret status, courts in many jurisdictions view perpetual confidentiality obligations with skepticism and may refuse to enforce them as unreasonably broad.
Returning or Destroying the Information at the End
When the NDA expires or the business relationship terminates, you typically must either return all confidential materials or destroy them. Physical documents such as financial statements, blueprints, and printed reports are usually returned by secure courier or hand delivery. Digital files require permanent deletion from every location, including email archives, cloud storage, local backups, and server caches.
Most agreements require you to provide a written certificate of destruction confirming that all copies have been eliminated, signed by a company officer or authorized representative. This serves as the disclosing party’s proof that you no longer possess any protected materials. Skipping this step, or completing it carelessly, leaves you exposed to claims that you retained and kept using the information after the agreement ended.
If you need to retain certain records for legal compliance or regulatory reasons, well-drafted agreements account for that by allowing you to keep copies required by law or internal compliance policies, provided those copies remain subject to the confidentiality obligations even after the agreement terminates. If your agreement doesn’t address that explicitly and you have retention duties, raise it before signing rather than after.