NDA confidentiality exclusions and carve-outs are the categories of information a non-disclosure agreement cannot restrict, even when the rest of the contract is enforceable. The standard set covers six situations: information already in the public domain, information the receiving party already knew, information developed independently, information obtained lawfully from a third party, disclosures compelled by a court or government agency, and protected whistleblower reports. Two further provisions shape how far the obligation reaches: a residuals clause, which some agreements include, and the duration term, which decides when the obligation ends.
If any of these carve-outs is missing from an NDA you are asked to sign, you are accepting a narrower set of defenses than most counterparties would consider standard. Each exclusion exists for a reason, and each has limits worth knowing before you need them.
Information Already in the Public Domain
If information is generally known or readily accessible through legitimate channels, an NDA cannot treat it as confidential. This tracks the legal definition of a trade secret itself. Under the Defend Trade Secrets Act, information qualifies as a trade secret only if the owner has taken reasonable steps to keep it secret and it derives economic value from not being generally known or easily discoverable through proper means.1Office of the Law Revision Counsel. 18 U.S. Code 1839 – Definitions Once information fails either prong, it stops being protectable.
A common trigger is patent publication. Federal law requires the U.S. Patent and Trademark Office to publish most utility and plant patent applications 18 months after the earliest filing date, which moves the disclosed technical details into the public domain.2Office of the Law Revision Counsel. 35 U.S. Code 122 – Confidential Status of Applications; Publication of Patent Applications The same applies to information that appears in trade journals, regulatory filings, or academic publications.
The critical limitation: the information must have become public through no fault of the receiving party. If you leak a secret and then argue it is no longer confidential because everyone knows it, courts will not let you benefit from your own breach. The public domain exclusion protects people who encounter information that was already out there, not people who put it there.
Prior Knowledge of the Receiving Party
Confidentiality obligations do not attach to information you already possessed before the NDA existed. If you knew a manufacturing technique, pricing model, or customer list before the disclosing party ever shared it with you, the NDA cannot retroactively restrict that knowledge. The exclusion typically requires that you obtained the information on a non-confidential basis from a source unrelated to the current transaction.
The catch is proving it. The receiving party carries the burden of demonstrating prior possession, and vague recollections will not hold up. Dated internal documents, time-stamped server logs, archived emails, and version-controlled files are the kinds of evidence that work. A research memo from six months before the NDA was signed, containing the same formula the disclosing party later shared, is your defense. Without contemporaneous records, you are asking a court to take your word for it against documentary evidence of a formal disclosure.
Build a habit of dating and archiving internal work product. It pays off if a dispute ever surfaces.
Independently Developed Information
You are not liable for creating something that resembles another company’s trade secret, as long as you arrived at it through your own work rather than by referencing the protected material. The Defend Trade Secrets Act provides that independent derivation does not constitute improper means of acquiring a trade secret.1Office of the Law Revision Counsel. 18 U.S. Code 1839 – Definitions
Proving it is harder than it sounds. The gold standard is a clean room protocol, where researchers work in deliberate isolation from the disclosing party’s information. Federal Judicial Center guidance on trade secret litigation describes what courts expect: specifications defined to ensure the team does not use any protected information, a research design that isolates the team, and a coordination group that screens everything entering and leaving the clean room.3Federal Judicial Center. Trade Secret Case Management Judicial Guide Documentation must be created during the development process, not assembled after a lawsuit is filed.
Personnel separation matters as much as document separation. If the same engineer who reviewed the disclosing party’s files also worked on your internal project, the clean room defense falls apart. That kind of cross-contamination is exactly what opposing counsel will look for in discovery.
Reverse Engineering
Reverse engineering sits in its own lane. Where independent development means you never encountered the original product at all, reverse engineering means you lawfully acquired it and then took it apart to figure out how it works. The Defend Trade Secrets Act excludes reverse engineering from the definition of improper means.1Office of the Law Revision Counsel. 18 U.S. Code 1839 – Definitions
That federal protection is a default rule. NDAs can and frequently do include provisions prohibiting the receiving party from reverse engineering any materials or products shared under the agreement. When that clause exists, the contractual restriction controls, even though trade secret law alone would not penalize the activity. If the NDA bans reverse engineering, the federal carve-out will not save you from a breach-of-contract claim.
To preserve the defense, document how you acquired the product through a legitimate purchase or license, and keep records of the reverse engineering process itself.
Information Obtained from a Third Party
Data you receive from an independent third party falls outside your NDA obligations, provided that third party had the legal right to share it. If an unrelated supplier, consultant, or business partner hands you information that happens to overlap with what the disclosing party told you under the NDA, the agreement generally loses its enforcement power for that specific information.
The key word is “rightfully.” If the third party misappropriated the information, stole it, or violated their own confidentiality obligations to get it, the exclusion does not apply. Courts look closely at the chain of custody. You need to show that the third party had legitimate, unrestricted access to the information and was not bound by a separate NDA covering the same material. The tighter the industry, the harder this becomes, because competitors often share overlapping confidentiality relationships.
Note the date, source, and circumstances whenever you receive potentially sensitive information from a third party. That record becomes your evidence if the disclosing party later claims you could only have gotten the information from them.
Legally Compelled Disclosures
When a court order, subpoena, or government investigation requires you to hand over confidential information, complying with that legal demand does not breach the NDA. Nearly every well-drafted agreement includes a compelled-disclosure carve-out, but the protection comes with procedural strings.
The standard process: you receive a subpoena or court order demanding confidential material. Before producing anything, you give the disclosing party prompt written notice so they have the opportunity to seek a protective order or file a motion to quash. You then disclose only the minimum amount of information necessary to satisfy the legal demand. If the disclosing party obtains a protective order, you follow it. If they do not act, you comply with the order and produce only what was specifically requested.
Ignoring a valid court order to protect an NDA is not an option. A party that refuses to comply can be held in civil contempt, which may result in escalating daily fines or jail time for the responsible officers.4Legal Information Institute. Contempt of Court (Civil) Follow the notice procedure, limit the scope of the disclosure, and keep records of every step. That compliance trail is your shield against both the court and the disclosing party.
Whistleblower Immunity
This is the exclusion most people do not know about, and it overrides whatever the NDA says. Under the Defend Trade Secrets Act, any individual is immune from criminal and civil liability under federal or state trade secret law for disclosing a trade secret to a government official or attorney, as long as the disclosure is made confidentially and solely for the purpose of reporting or investigating a suspected violation of law.5Office of the Law Revision Counsel. 18 U.S. Code 1833 – Exceptions to Prohibitions The same immunity applies to disclosures made in a lawsuit filing, provided the document is filed under seal.
Employers must include notice of this immunity in every contract or agreement with an employee that governs the use of trade secrets or confidential information. An employer can satisfy the requirement by referencing a separate policy document that covers the reporting policy for suspected violations of law. Skipping the notice has a real cost: an employer that fails to provide it forfeits the right to recover exemplary damages or attorney fees in any trade secret action against that employee.5Office of the Law Revision Counsel. 18 U.S. Code 1833 – Exceptions to Prohibitions
The SEC enforces a parallel rule in the securities context. Federal regulations prohibit any person from impeding an individual from communicating directly with the SEC about potential securities law violations, including by enforcing or threatening to enforce a confidentiality agreement.6eCFR. 17 CFR 240.21F-17 – Staff Communications With Individuals Reporting Possible Securities Law Violations The SEC has brought enforcement actions against dozens of companies for using NDAs or separation agreements that restricted employees from reporting to the Commission, with cases continuing through 2025.7U.S. Securities and Exchange Commission. Whistleblower Protections NDA language that could be read as discouraging reports to any government agency is not just unenforceable; it may trigger regulatory action against the company that drafted it.
Residuals Clauses
Some NDAs, particularly in mergers-and-acquisitions contexts, include a residuals clause that permits the receiving party to use general ideas, concepts, and know-how retained in the unaided memory of its personnel after the NDA relationship ends. The theory is practical: you cannot erase someone’s brain. An engineer who reviewed technical documents during due diligence will inevitably retain some general understanding of what they saw.
These clauses are controversial because they shift the burden in any misappropriation dispute. Instead of simply proving that the receiving party used confidential information, the disclosing party must also prove that the use went beyond what the residuals clause permits. That additional burden can effectively neutralize the NDA’s core protections for anything short of copying a document outright.
If you are the disclosing party, approach residuals clauses with skepticism. Consider carving out specific categories of highly sensitive information, such as particular product lines, customer data, or proprietary algorithms, from the residuals permission. If you are the receiving party, a residuals clause gives you meaningful breathing room, but it does not protect deliberate memorization of detailed specifications or formulas. Courts have long recognized that misappropriation by memory is actionable, and no residuals clause changes that.
How Long the Obligation Lasts
Knowing when the obligation expires matters as much as knowing what it covers. NDAs typically distinguish between two categories of information, each with a different shelf life.
Trade secrets receive indefinite protection by default. Because a trade secret’s legal status depends on the information remaining secret and economically valuable, the obligation naturally ends whenever the secret stops being secret. A perpetual confidentiality term for genuine trade secrets is generally enforceable; it simply mirrors the reality that protection lasts as long as the underlying secret does.1Office of the Law Revision Counsel. 18 U.S. Code 1839 – Definitions
General business information that does not meet the trade secret threshold is a different story. Survival periods of one to five years are common for non-trade-secret confidential information, and courts in many jurisdictions are increasingly skeptical of perpetual obligations covering this broader category. A confidentiality clause that effectively prevents someone from working in their field indefinitely can be struck down as an unreasonable restraint of trade, particularly when it covers information that is generally known or part of an employee’s basic professional skill set. Some courts have voided these provisions entirely as de facto noncompete agreements.
Check your NDA for two things: whether it defines a specific term for the confidentiality obligations, and whether it distinguishes between trade secrets and other confidential information. An agreement that lumps everything together under a perpetual obligation may overreach for the non-trade-secret material.
If the Standard Carve-Outs Are Missing
Without a public-domain exclusion, you could theoretically be liable for sharing information anyone could find through a basic internet search. Without an independent-development exclusion, your own internal research might be treated as a breach if it produces results similar to the disclosing party’s data.
Courts will not always rescue you from a bad contract. Trade secret law provides some baseline protections, since publicly available facts cannot be turned into enforceable secrets regardless of what a contract says, but the absence of explicit carve-outs tilts every ambiguity in the disclosing party’s favor. Litigating the issue costs time and money, even if you ultimately win.
Before signing any NDA, confirm the standard exclusions are present: public information, prior knowledge, independent development, third-party acquisition, and compelled disclosure. If they are missing, negotiate them in. These are baseline terms that virtually every counterparty’s legal counsel will recognize as standard. Resistance to including them tells you something about how the agreement might be used later.