Every properly drafted NDA says what isn’t confidential as well as what is. These exclusions (often called carve-outs) take certain information outside the obligations altogether, and they’re a normal, expected part of the document. When they’re missing, or drafted badly, the recipient can end up bound in respect of information it had all along. When they’re drafted too loosely, they can let the recipient walk away from the NDA.
Why exclusions matter
Imagine an NDA with no exclusions at all. The recipient would be barred from using information even after it became common knowledge in the industry, and from using its own ideas if they happened to overlap with something disclosed. No sensible recipient would sign that, and a discloser gains little from it. The exclusions let the NDA protect what is genuinely confidential and nothing more, which also makes it easier to enforce.
The four standard exclusions
1. Information in the public domain
Information that is or becomes publicly available, other than through a breach by the recipient, isn’t protected. Typical wording: “information which is or becomes generally available to the public other than as a result of its disclosure by the Recipient or its Representatives in breach of this agreement”.
“Generally available” matters. Information known to a handful of people, or findable only with real effort, isn’t necessarily public. Published material, information in public filings and knowledge that is common in the industry usually is. The words “in breach of this agreement” matter too: a recipient that caused the leak can’t then rely on the exclusion.
2. Information the recipient already had
If the recipient knew something before it was disclosed, it didn’t learn it from the NDA and shouldn’t be restricted by it. Typical wording: “information which the Recipient can show by its written records was in its possession before disclosure by the Discloser, free of any obligation of confidence”.
Wording like “can show by its written records” puts the burden on the recipient and requires documents, not just recollection. That’s a reasonable position for a discloser to take, and a good reason for recipients to keep dated records of their own work before talks start.
3. Information received from a third party
If the recipient obtains the same information from someone else who was entitled to share it, the NDA shouldn’t prevent its use. Typical wording: “information which the Recipient receives from a third party who, so far as the Recipient is aware, is not under any obligation of confidence to the Discloser in respect of it”.
The key condition is that the third party wasn’t itself bound to keep the information confidential. If it was, the exclusion shouldn’t apply. Disclosers sometimes resist a knowledge qualifier like “so far as the Recipient is aware”; recipients argue they can’t be expected to know about confidentiality arrangements they were never told about. Both positions are reasonable, and it’s a common point of negotiation.
4. Information developed independently
A recipient that develops the same thing itself, without using the disclosed information, shouldn’t be stopped from using its own work. Typical wording: “information which is independently developed by or for the Recipient without use of or reference to the Discloser’s Confidential Information”.
This is the exclusion most likely to cause a dispute, because independence is hard to prove once the recipient has seen the other side’s material. Where the parties work in the same field, a court is likely to look closely at timing, who had access to what, and how similar the results are. Recipients in that position sometimes separate the people who see disclosed information from those doing their own development work, and keep records to show it.
Combinations and partly public information
Information can be confidential even if some of its components are public. A compilation of publicly available data, such as a curated customer list or a set of supplier prices gathered over years, may be valuable precisely because of the work that went into assembling it. Well-drafted NDAs deal with this by saying that information isn’t treated as public just because individual parts of it are, or because it could be put together from public sources. If you’re the discloser and your value lies in a compilation, make sure the NDA says so.
When information becomes public through someone else’s breach
Once information is genuinely public, a recipient that didn’t cause the leak can usually rely on the public domain exclusion from that point. That doesn’t mean everything is forgiven. The recipient remains liable for any breach it committed before the information became public, and where it has already misused the information to get a head start, a court may in some cases restrict it from continuing to benefit for a limited period. The precise answer turns on the wording and the facts.
Disclosure required by law
This isn’t strictly an exclusion, because the information stays confidential, but it is an essential carve-out. If a court, regulator or law requires the recipient to disclose, it must be able to comply without breaching the NDA. Typical wording: “the Recipient may disclose Confidential Information to the extent required by law, by any court of competent jurisdiction or by any regulatory authority, provided that, to the extent it is legally permitted to do so, it gives the Discloser prompt written notice so that the Discloser may seek to limit the disclosure”. The recipient should disclose only what is actually required.
Drafting exclusions fairly
Exclusions should protect the recipient from unreasonable restrictions without swallowing the NDA whole. The practical points are these. Tie prior knowledge to written records. Make the public domain exclusion conditional on the information not having become public through the recipient’s breach. Require that the third party in the third-party exclusion was free to disclose. Frame independent development as work done “without use of or reference to” the disclosed information. Deal expressly with compilations if they matter to you. And decide who has to prove an exclusion applies; many NDAs put that on the recipient.
Common disputes about exclusions
Was it really public? The recipient says the information was freely available; the discloser says only a few insiders knew it. The court will look at how widely it had actually been published or used.
Did they really know it already? Without contemporaneous documents, claims of prior knowledge are difficult to make good, especially where the NDA requires written records.
Was the development genuinely independent? Timing, access to the disclosed material and close similarity will all count against the recipient. If it looks like copying, the exclusion is unlikely to help.
If the exclusions in your NDA are missing, lopsided or so wide that they undo the protection, it’s far easier to fix them before signing. You can upload the NDA to QuickLegalCheck for a review of what it covers and what it leaves out.
Related: what the NDA review covers, and a complete sample report.