Before you sign
A non-disclosure agreement (NDA) sets out what counts as confidential information, what the recipient may use it for, who they may share it with, the usual exceptions, how long the obligations last and what happens to the information at the end. NDAs can be one-way, where only one party discloses, or mutual.
If you are disclosing, the risk is an NDA that does not clearly cover what you are about to share, or that lets the recipient use it for more than the discussion in hand. If you are receiving, the risk is obligations you cannot realistically keep: a definition that covers everything, no right to share with your own team and advisers, and no end date.
QuickLegalCheck reads the whole NDA from your side, rates every clause, flags what is missing and suggests wording to send back. The full report is £49 + VAT.
Why it’s worth checking
An NDA only protects what it actually covers. If it is loosely drafted, the disclosing party may have less protection than it thinks; if it is over-drafted, the receiving party may be in breach almost as soon as it starts work.
Consider a hypothetical founder sharing a business plan with a potential investor under an NDA that defines confidential information as documents “marked confidential”. The most sensitive details were given in a meeting and never written down. Whether the NDA covers them is now open to argument. A definition that includes information given orally, or that the recipient should reasonably understand to be confidential, avoids that.
Now take the other side. Imagine a software company asked to sign an NDA before reviewing a prospective client’s systems. The NDA treats everything the client says as confidential, allows disclosure to no one, and has no exceptions. Read literally, the company cannot brief its own developers, store the material on its systems or ask its lawyers for advice. Signing that means accepting obligations it will breach in the ordinary course. The fix is simple: permit disclosure to employees, contractors and professional advisers who need to know, on condition they are bound by similar confidentiality obligations.
Duration is often overlooked. An NDA with no end date is not automatically unenforceable in a commercial context, but it means tracking and protecting information long after it has any value. Most commercial information goes stale within a few years, and a fixed period, with longer protection kept for genuine trade secrets, is easier for both sides to live with. Once information becomes public through no fault of the recipient, the obligations should stop applying to it anyway.
It is also worth remembering that an NDA does not protect information you have already shared before it was signed unless it says so, and it cannot make something confidential that is already in the public domain.
Key terms to look for
Definition of confidential information
Should cover what actually needs protecting. Too narrow and it misses things; too wide and it becomes hard to comply with and invites argument.
Purpose of disclosure
States why the information is being shared, for example to evaluate a possible deal, and limits its use to that purpose.
Obligations of confidentiality
What the recipient must do: keep the information secure, not disclose it and not use it except for the purpose.
Exclusions from confidentiality
Information that is already public, already known to the recipient, independently developed or received lawfully from someone else. There should also be a carve-out for disclosures required by law or a regulator.
Duration of obligations
How long confidentiality lasts. Two to five years is common for commercial information, with longer or open-ended protection sometimes sought for trade secrets.
Return or destruction
What happens to the information when discussions end, including copies held in automatic backups that cannot practically be deleted.
Remedies for breach
Damages and injunctions are available for breach of contract in any case. An express clause usually records that damages may not be enough, which can help an application for an injunction.
Mutual vs one-way
Whether both sides are disclosing and bound, or only one. Using a one-way NDA when both parties will share information leaves one side without contractual protection.
Common mistakes
A definition of confidential information that is too wide or too vague
A definition that catches general know-how or public information is hard to comply with and gives the recipient room to argue it is unreasonable. One that is too narrow, such as only documents marked confidential, can miss the information that matters most.
Missing or inadequate exclusions
Without the standard exclusions for public, already known, independently developed and lawfully received information, the recipient could be in breach for using information it was entitled to use anyway. A recipient should not sign without them.
Obligations that cannot be complied with in practice
Some NDAs forbid any disclosure, even internally, or impose storage rules that do not fit how the recipient works. A recipient who signs these will breach them in the ordinary course of business. Disclosure on a need-to-know basis, with sensible security, is the normal approach.
A confidentiality period that does not fit the information
An open-ended or very long period may be enforceable in a commercial NDA, but it is an ongoing burden for information that loses its value within a few years. Match the period to how long the information will genuinely be sensitive, with longer protection for true trade secrets.
Assuming the remedies clause is what makes an NDA enforceable
The disclosing party can sue for damages and apply for an injunction for breach whether or not the NDA mentions them. An injunction is always at the court’s discretion, so a clause saying damages would not be an adequate remedy helps but does not guarantee one. What matters more is being able to show what was disclosed and that it has been misused.
Best practice
If you are disclosing, define the information clearly and make sure the definition covers oral and visual disclosures as well as documents. Tie use to a specific purpose. Keep a record of what you share and when, because if there is a dispute you will need to show what the recipient received. Accept the standard exclusions: they are fair, and fighting them tends to slow things down without adding real protection. Choose a duration that matches how long the information will be sensitive, and share your most sensitive material only when you need to, since no NDA can undo a leak.
If you are receiving, check that the definition is workable, that the exclusions are all there, including disclosures required by law or a regulator, and that you can share the information with employees, contractors and advisers who need it. Make sure the duration has an end point unless the material really is a trade secret. Ask for a return or destruction clause that allows you to keep copies in automatic backups and any copy you must keep for legal or regulatory reasons, provided they stay confidential. If the NDA includes anything beyond confidentiality, such as a non-solicitation or non-compete clause, read that part particularly carefully.
Questions
What is the difference between a mutual and a one-way NDA?+
In a one-way NDA, one party discloses and the other agrees to keep the information confidential. That suits situations such as a business sharing information with a potential supplier or buyer. In a mutual NDA, both parties disclose and both are bound, which is usual when two businesses are exploring a joint venture or partnership. Employees are normally covered by the confidentiality terms in their employment contract rather than a separate NDA.
Can I share confidential information with my own team?+
Only if the NDA allows it. A reasonable NDA lets you disclose to employees, contractors and professional advisers who need the information for the stated purpose, provided they are told it is confidential and are bound by similar obligations. You usually remain responsible if they breach it. If the NDA you have been sent does not include this, ask for it before you sign.
What happens to confidential information when the NDA ends?+
The NDA should say. Usually the recipient must return or destroy the information on request or when discussions end, often with an exception for copies in automatic backups or copies it must keep by law, which remain confidential. The confidentiality obligations themselves typically continue for a set period after that, or indefinitely for trade secrets.
Is an NDA legally enforceable?+
Generally yes, as a contract, and English law also protects confidential information through the law of confidence even without one. To succeed on a claim you need to show the information was covered and still confidential, that the recipient used or disclosed it in breach, and what loss resulted, or that an injunction is needed to stop further misuse. Some limits apply whatever the NDA says: a worker cannot be prevented from making a protected whistleblowing disclosure, and a clause that tries to stop anyone reporting a crime to the police is unlikely to be enforced.