A confidential disclosure agreement (CDA) — the formal name for what most people call a non-disclosure agreement — is legally valid when it meets the basic requirements of contract law and contains terms specific enough for a court to enforce. The core CDA requirements fall into three buckets: contract fundamentals that apply to any agreement, clauses that define the scope of confidentiality, and compliance with federal and state limits on what secrecy can cover. Miss any of them and the document may not hold up when it matters.
Contract Fundamentals the Agreement Must Satisfy
A CDA is a contract first and a confidentiality document second. Four elements have to be in place before any of the specialized language carries weight.
- Mutual assent. Both parties must clearly agree to the same terms. One side offers the agreement, the other signs. Verbal acceptance creates enforcement problems, which is why CDAs are almost always written.
- Consideration. Each party must give or promise something of value. In a business deal, the exchange of confidential information itself usually counts. In the employment context it gets trickier: some states do not accept “continued employment” as enough consideration when an employer asks a current worker to sign a new CDA, so the employer needs to offer something extra like a bonus or raise.
- Legal capacity. Everyone signing must be of legal age, mentally competent, and, when signing for a company, authorized to bind it.
- Lawful purpose. A CDA cannot protect illegal activity. One drafted to hide evidence of fraud or criminal conduct is unenforceable on its face.
Clauses That Define Scope and Obligations
What separates an enforceable CDA from a useless one is the specificity of its key terms. Courts look at whether the agreement clearly establishes who owes what, to whom, and about what.
Identifying the Parties
The agreement needs to name the disclosing party (the one sharing information) and the receiving party (the one getting access). Problems arise when a company forgets to include subsidiaries, affiliates, or contractors who will also handle the information. A person or entity not covered by the agreement is not bound by it.
Defining Confidential Information
This is the most litigated part of any CDA. Courts expect a definition specific enough that both sides can tell what is protected and what is not. Broad catch-all language like “any information shared between the parties” often backfires, because a court may find it too vague to enforce. Workable agreements describe categories — technical designs, financial projections, customer data, pricing strategies — and leave room for information the disclosing party marks as confidential later.
Every well-drafted CDA also carves out information that does not qualify for protection. Standard exclusions cover information that was already publicly available, information the receiving party already knew before signing, information received from a third party with no confidentiality obligation, and information the receiving party developed on its own without using the disclosed material.
Obligations of the Receiving Party
The receiving party’s duties are the operational core of the agreement. At minimum, the receiving party must keep the information secret and use it only for the specific purpose described in the agreement. A company evaluating a potential acquisition can review the target’s financial records for due diligence, but cannot use that data to compete against the target. Most agreements also require internal access on a need-to-know basis and reasonable security measures to prevent leaks. What counts as reasonable scales with the sensitivity of the information.
Return or Destruction of Materials
A clause often overlooked requires the receiving party to return or destroy all confidential materials once the agreement ends or the business relationship concludes. Strong agreements set a specific deadline, typically between ten and thirty days, and require written confirmation. Many allow one archival copy if law or compliance requires it, but only under continued confidentiality restrictions.
Governing Law
A governing law clause specifies which jurisdiction’s rules will control any dispute. Without one, the parties may fight over which state’s law applies before they even argue about the breach. Enforceability standards for CDAs vary significantly between jurisdictions, which makes this clause more consequential than it looks.
How Long the Obligations Should Last
Duration trips up many agreements. Most CDAs set obligations lasting between three and five years from the date of disclosure. Trade secrets are usually protected for as long as they remain secret. Most states allow CDAs with no fixed end date, but a handful, particularly in the employment context, require a reasonable time limit and may void an agreement that lacks one. The safer approach is to set two durations: one for trade secrets that lasts as long as the information qualifies, and a fixed period for other confidential information.
Unilateral or Mutual
The structure should match the actual flow of information. A unilateral CDA works when only one side is sharing — a startup pitching investors, a company sending specifications to a potential manufacturer. Only the receiving party takes on obligations. A mutual (or bilateral) CDA applies when both sides will share, which is common in joint ventures, co-development, and merger talks. If your situation is genuinely one-directional, don’t sign a mutual CDA just because the other side offers one; you would be taking on obligations you do not need.
The Whistleblower Notice Employers Must Include
Any CDA between an employer and a worker, including contractors and consultants, must include a notice about whistleblower immunity under the Defend Trade Secrets Act. Federal law provides that a person cannot be held liable for disclosing a trade secret in confidence to a government official or an attorney solely to report a suspected legal violation, or in a court filing made under seal.1Office of the Law Revision Counsel. 18 USC 1833 – Exceptions to Prohibition
Employers can satisfy this requirement by referencing a separate policy document that explains the company’s reporting procedures for suspected violations of law. The penalty for leaving the notice out is real: an employer who skips it loses the ability to recover exemplary damages or attorney fees in any trade secret action against that worker.1Office of the Law Revision Counsel. 18 USC 1833 – Exceptions to Prohibition
What a CDA Cannot Cover
Not everything can be locked behind a confidentiality agreement, even when both parties sign willingly.
The Speak Out Act
Since 2022, federal law has made pre-dispute nondisclosure clauses unenforceable when they cover sexual assault or sexual harassment claims. If a dispute arises involving conduct that allegedly violates federal, state, or tribal law, any NDA or nondisparagement clause signed before the dispute occurred cannot be enforced to silence the claimant.2Office of the Law Revision Counsel. 42 USC 19403 – Limitation on Judicial Enforceability of Nondisclosure and Nondisparagement Contract Clauses The law applies to claims filed on or after its enactment date and does not interfere with agreements protecting legitimate trade secrets or proprietary information.
State Restrictions on Workplace NDAs
A growing number of states have gone further. California, Colorado, Illinois, Maine, and others have enacted laws that void or limit NDA provisions preventing employees from discussing unlawful workplace conduct. Some impose financial penalties on employers who present prohibited agreements. Because these rules vary widely, any CDA used in employment should account for the specific laws in the states where the workers are located.
Overbroad Agreements That Act as Non-Competes
The FTC has recognized that NDAs and trade secret laws give employers established tools for protecting sensitive information without restricting where workers can go next.3Federal Trade Commission. FTC Announces Rule Banning Noncompetes That said, a CDA drafted so broadly that it effectively prevents someone from working in their field can be treated as a disguised non-compete and face the same scrutiny or outright bans that apply to non-compete agreements.
When Courts Refuse to Enforce an Agreement
Even a properly signed CDA can be struck down or narrowed if a court finds its terms unreasonable. Courts weigh the disclosing party’s legitimate interest in secrecy, how long the restrictions last, the burden on the receiving party, and the public interest. An agreement that labels an employee’s general industry knowledge as “confidential information” is the kind of overreach that courts routinely reject. Information that has entered the public domain, through no fault of the receiving party, cannot be protected either.
Many jurisdictions apply the blue-pencil doctrine when a CDA contains some enforceable and some unenforceable provisions. Rather than voiding the whole thing, the court strikes or modifies the unreasonable terms and enforces the rest. It is not a safety net to rely on. Some jurisdictions refuse to blue-pencil at all, and even where the doctrine applies, a court will only narrow terms that can be trimmed without changing the agreement’s fundamental meaning.
Remedies to Build In
The most effective CDAs address remedies before any breach happens.
Injunctive Relief
The most urgent remedy is usually an injunction, a court order stopping the receiving party from continuing to disclose or use the protected information. Under the Defend Trade Secrets Act, federal courts can grant injunctions to prevent actual or threatened misappropriation of trade secrets, though the injunction cannot prevent someone from taking a new job and any conditions must be based on evidence of threatened misappropriation, not merely on what the person knows.4Office of the Law Revision Counsel. 18 USC 1836 – Civil Proceedings
To get an injunction, the disclosing party typically needs to show irreparable harm (damage that money alone cannot fix) and a likelihood of winning the underlying case. Many CDAs include language where both parties acknowledge that a breach would cause irreparable harm, which can help in obtaining an injunction. The clause alone will not guarantee one; a judge still evaluates the actual circumstances.
Monetary and Liquidated Damages
The disclosing party can also sue for the actual financial losses caused by the breach. Because those losses can be hard to quantify, some CDAs include a liquidated damages clause that sets a predetermined amount owed on breach. For these clauses to hold up, the amount must be a reasonable estimate of the probable loss. Clauses pegged to the breaching party’s profits rather than the disclosing party’s actual injury are vulnerable to being struck down as unenforceable penalties.
Attorney Fees
The default rule in American litigation is that each side pays its own legal fees. A CDA can change this with a prevailing-party clause that shifts fees and costs to the losing side. These clauses should specify whether they apply only to contract disputes or also to related claims like fraud, and whether they cover arbitration, mediation, and appeals as well as court proceedings.
A boilerplate template may cover the basics, but an agreement written for the actual information being shared, the industry involved, and the jurisdictions in play will hold up far better if it ever has to be enforced.