NDA checklist: 10 things to check before you sign

You’ll usually be asked to sign a non-disclosure agreement (NDA) early on, before a buyer looks at your accounts, before a supplier shows you its pricing, or before you pitch an idea to a potential partner. Most NDAs are short and plenty are fair. They are, though, nearly always drafted by the party handing over the information, and the terms that matter are easy to skim past when everyone is keen to get on with the real conversation. These are the ten points worth checking first.

1. What counts as confidential information

The definition drives everything else in the document. Some NDAs list categories (financial information, customer lists, pricing, product plans, source code); others say “all information disclosed, in whatever form”. A wide definition isn’t automatically unfair, particularly if the exclusions are properly drafted, but it makes it harder to know afterwards what you can and can’t do. Check whether information has to be marked or identified as confidential to be covered, and whether things said in meetings count. Some NDAs only protect oral information if it is confirmed in writing within a set period. If you’re receiving information, a narrower definition limited to marked material is easier to live with. If you’re disclosing, you’ll want the opposite.

2. One-way or mutual

A one-way NDA binds only the recipient. A mutual NDA binds both sides. Which is right depends on who is actually sharing. The trap is signing a one-way NDA as the recipient and then handing over your own sensitive information during the talks. Your information may then have no contractual protection at all, and you’d be left relying on the general law of confidence, which is harder to prove. If information will flow both ways, ask for a mutual NDA.

3. What you’re allowed to use it for

A good NDA restricts use as well as disclosure. You can use the information only for a defined purpose, such as “evaluating a possible acquisition of the company”. Read that purpose closely. If it is drawn too narrowly you may breach the NDA just by doing the ordinary work the discussions need. If you’re the discloser and there is no purpose clause at all, the recipient may argue it can use your information for anything as long as it doesn’t pass it on.

4. How long the obligations last

There is no standard answer. Many commercial NDAs run for a fixed number of years; others last indefinitely, or for as long as the information remains confidential, and some mix the two by protecting trade secrets for longer than general business information. Check what the period runs from (the date of the NDA, the date of each disclosure, or the end of the discussions) because that can make a real difference. Also check whether there are two periods: the time during which disclosures are covered, and the time for which the confidentiality obligations survive afterwards.

5. Who you can share it with

You’ll almost certainly need to share the information with someone: your directors and staff, your accountant, your lawyer, and perhaps a lender or investor. The NDA should allow disclosure to those people on a need-to-know basis. It will normally make you responsible for making sure they keep it confidential, and sometimes for any breach they commit, so check that you can live with that. An NDA that requires written consent before you can speak to your own professional advisers is impractical and worth changing.

6. The exclusions

Certain information should fall outside the NDA altogether: information that is or becomes public other than through your breach, information you already had before it was disclosed, information you develop independently without using the disclosed material, and information you receive from a third party who was free to give it to you. These exclusions are standard and a well-drafted NDA will include all four. Without them you could find yourself technically bound not to use something the whole market already knows. Some NDAs require you to prove an exclusion applies with written records, which is fair enough, but it means you should keep those records.

7. Disclosure required by law

There should be a carve-out allowing you to disclose where you’re required to by law, by a court order or by a regulator. The usual quid pro quo is that you tell the other party first, where you’re legally allowed to, so they can try to protect the information. That’s reasonable. What isn’t reasonable is an NDA with no carve-out at all, or one that requires you to resist a regulator’s request on the other party’s behalf.

8. Returning or destroying the information

Most NDAs require you to return or destroy the information when the talks end or when asked. Check whether that is practical. Deleting every copy from email archives and automatic backups often isn’t, so a sensible clause lets you keep copies that can’t reasonably be deleted, and copies you need to keep for legal or regulatory reasons, on the basis that the confidentiality obligations continue to apply to them. If you’re asked to certify destruction, make sure you can do so honestly.

9. The remedies clause

Many NDAs say that damages may not be an adequate remedy for breach and that the discloser may seek an injunction. That’s common and generally fine. A court still decides for itself whether to grant one, and the clause doesn’t oblige it to. Look harder at wording that goes further, such as an indemnity for all losses and legal costs arising from any breach, a fixed sum payable on breach, or a clause that makes you liable for anything your advisers do. Some NDAs based on US templates also mention waiving a “bond”; that concept doesn’t translate neatly to the courts of England and Wales and is worth querying.

10. Governing law and jurisdiction

Check which country’s law governs the NDA and which courts deal with disputes. There is no single UK law of contract, so for a business in England or Wales you’d normally want English law and the courts of England and Wales. If the NDA is governed by another country’s law, the rules on confidentiality and remedies may be quite different, and you’d need advice from someone qualified in that system. If the other party is based abroad, think about where you’d actually have to go to enforce it.

Clauses that don’t belong in a simple NDA

Occasionally an NDA carries terms that have nothing to do with confidentiality: a promise not to poach the other party’s staff or customers, a restriction on competing, an assignment of rights in anything you develop, or a broad indemnity. Some of these can be legitimate in the right deal, but they deserve their own negotiation and shouldn’t slip through in a document everyone assumed was routine.

If the answers to these ten points are clear and proportionate, the NDA is probably fine to sign. If they’re vague, open-ended or heavily one-sided, raise them now, when changing the wording costs nothing. Our NDA review service checks these points and flags the clauses worth negotiating.