What is an NDA and how does it work?

What is an NDA?

A non-disclosure agreement (NDA) is a legally binding contract in which the parties agree to keep specified information confidential and not share it with anyone outside the agreement. Also called a confidentiality agreement, it lets people share sensitive material like trade secrets, financials, or product plans while keeping it protected. In healthcare and life sciences, the same document often goes by confidential disclosure agreement, or CDA.

An NDA works like a handshake with legal backing. One side, the disclosing party, shares confidential information. The counterparty, the receiving party, agrees to keep it secret and use it only for an agreed purpose.

If the receiving party leaks or misuses the information, they’ve breached the contract and can be sued. The link between confidentiality promises and trade secret protection runs deep — the Supreme Court grounded trade secret protection in the confidential relationship itself as early as 1917 (du Pont v. Masland, 244 U.S. 100). Under the federal Defend Trade Secrets Act, information only qualifies as a trade secret if its owner takes reasonable measures to keep it secret, and a signed NDA is one of those measures.

Key Takeaways

• Start with what counts as confidential and how long the obligation lasts. Those two terms decide most of what you’re agreeing to.
• Some obligations continue after the agreement ends, so an expired NDA doesn’t always mean you’re free to talk.
• Asking for a narrower definition, an end date, or mutual obligations is an ordinary request that contract teams field every day. When you can’t negotiate, and a job candidate usually can’t, whatever you sign is what you’re bound to, so the definition and the term deserve a second read.
• No NDA can stop a disclosure the law protects.

What is an NDA used for?

You use an NDA any time you share sensitive information with someone who could pass it on or use it against you. It turns “this doesn’t leave the room” into an enforceable promise.

Common situations include hiring employees and contractors, evaluating a vendor or partner, raising funding, and exploring a merger or acquisition. For example, a startup showing its product roadmap to a possible manufacturer would sign an NDA first, so the manufacturer can’t take those plans to a competitor.

Once you’re signing them regularly, they accumulate fast, and an obligation you can’t find is one you can’t honor. Because most NDAs carry the same core clauses, you can track everything you’ve signed in one consistent way, which is why high-volume teams keep them in CLM software rather than scattered across inboxes.

What are the types of NDAs?

There are three main types of NDA, and telling them apart comes down to one question. Who’s promising to keep quiet?

Which type fits depends on who’s actually sharing information, not on who started the conversation. A vendor answering questions about its own pricing or architecture is disclosing too, and a one-way NDA signed by that vendor alone leaves the vendor’s information unprotected.

What’s actually in an NDA?

Most NDAs are built from the same core components:

• Definition of confidential information: what information the agreement covers.
• Obligations of the receiving party: the duty to keep that information confidential, who on the recipient’s side is allowed to see it, and the limits on what it can be used for.
• Exclusions: what falls outside the definition, like information that’s already public, or information the receiving party developed on its own without using the confidential information.
• Permitted disclosures: when a court order or subpoena requires you to disclose the confidential information anyway.
• Protected disclosures: language confirming the agreement doesn’t bar a report to a government agency. Federal trade secret law requires employee and contractor confidentiality agreements to say so.
• Term: how long the agreement runs, and which duties continue after it ends.
• Return or destruction of information: what the receiving party has to do with the information once the NDA ends, whether that’s returning it or destroying it. In practice these clauses carve out automated backups, a single archival copy kept for compliance, and anything a litigation hold requires the recipient to preserve, all of which stay under the confidentiality obligation.
• Consequences of breach: what the disclosing party can do if the receiving party discloses or misuses the information.
• Governing law and jurisdiction: which state’s contract law applies, and where a dispute gets heard.

Of these, the definition of confidential information is the most critical clause of the whole agreement. Every other clause just says “confidential information.” Until you know what that phrase defines, you can’t tell what the rest of the NDA requires.

It’s also where most of the negotiating happens. Some NDAs cover only what the disclosing party stamps “confidential,” so if nobody stamps a document, it isn’t covered. Others cover information by its nature, stamped or not, which protects more but leaves the two sides room to disagree later over whether a particular document was obviously confidential.

The same clause decides who inside the receiving company can see what you share. Most NDAs name a permitted group, usually a defined term called “Representatives,” covering employees, officers, attorneys, accountants, and financial advisors, and limit it to the ones who need the information for the agreed purpose. Anyone outside that group, like a subcontractor or a lender, usually needs the disclosing party’s written consent.

How long does an NDA last?

NDA terms vary widely. Two years is the most common term according to a review of 143 merger-and-acquisition NDAs, but plenty run shorter, plenty run longer, and some state no end date at all.

How long you need an NDA depends on how long the information could still hurt you if it got out. Once financial results are published, that particular information stops being confidential, so a five-year term on it does nothing (though forecasts and underlying detail stay protected). Meanwhile a manufacturing process can still be secret ten years later, long after a two-year NDA expired.

Trade secrets are why some NDAs run forever. Information keeps trade secret protection for as long as it stays secret, so an NDA covering it can outlive the rest of the agreement. Coca-Cola’s formula, for example, was never patented and is still a trade secret 140 years after Pemberton mixed the first syrup in 1886.

But an indefinite obligation still has to survive a challenge, and courts disagree. In Ashland Management v. Altair Investments, a New York appellate court refused to treat a confidentiality agreement as void just because it carried no time limit, though it noted a court could still reduce an unlimited term to something reasonable. In Brown v. TGS Management, a California court went the other way and struck a perpetual confidentiality provision, holding it worked as an illegal restraint on the employee’s right to work.

Courts are wary of confidentiality terms that keep someone from working, which is what sank the clause in Brown. And where an NDA says nothing about how long it lasts, a court will often read in a reasonable duration, so silence isn’t automatically forever. But obligations can outlast the agreement through a survival clause or trade secret law, so “the NDA expired” doesn’t always mean you’re free to talk.

What happens if you break an NDA?

Breaking an NDA is a breach of contract, and the disclosing party can take you to court. An accidental disclosure can still be a breach, so intent isn’t a reliable defense.

A court can do two things: first, stop the disclosure and second, make you pay for the harm it caused. The disclosing party usually wants the order more than the money, because it halts the use of the information instead of compensating you afterward. Legal fees are separate — in the U.S., each side normally pays its own, so the losing party covers fees only if the NDA says so.

Vulcan Materials got that order in 2012. Martin Marietta had received confidential information from Vulcan under an NDA and a joint defense agreement during merger talks, then used it to launch a hostile bid for the company. The Delaware Court of Chancery found it had breached both agreements and barred it for four months from pursuing the exchange offer or a proxy contest. Vulcan never collected damages. Blocking the bid was enough, and the Delaware Supreme Court upheld the order.

But enforcement must be realistic. You have to notice the breach first, then go to court, and litigation is slow and expensive. Even when nobody sues, the reputational cost of being known as the party that leaked has long-term damaging effects. An NDA gives you a claim after a leak, which is why it works best paired with sharing only what a counterparty genuinely needs to see.

How do you know if an NDA is enforceable?

An NDA isn’t automatically enforceable just because both sides signed it. A court can trim one that reaches too far, or refuse to enforce it at all.

An NDA may be unenforceable if there is:

• An overly broad definition of confidential information that effectively covers everything.
• An unreasonable or indefinite term that tries to bind someone forever.
• No consideration, meaning nothing was actually bargained for in exchange for the promise.
• Nothing legitimate to protect, because the information is already public or was independently known.

What happens next varies by state. Some courts trim an overbroad clause to something reasonable. Others decline to rewrite it and refuse to enforce it.

But there’s a floor no NDA can go below, whatever the paper says. Reporting a suspected legal violation to a government agency or an attorney is protected under the Defend Trade Secrets Act, and reporting a possible securities violation to the SEC is protected under Dodd-Frank. The National Labor Relations Board has also held that a severance agreement can’t use an overly broad confidentiality provision to waive an employee’s right to discuss workplace conditions.

And that cuts both ways for employers. A confidentiality agreement with an employee or contractor has to carry notice of that whistleblower immunity, and leaving it out costs the company the ability to recover exemplary damages or attorney’s fees under the Defend Trade Secrets Act against that person. The requirement applies to employee and contractor agreements, not to commercial NDAs between two companies.

Otherwise NDAs are governed by state contract law, so enforceability depends on where you are. A clause enforced in one state can be reduced or struck in another, and a term that looks standard may be interpreted differently under the drafting party’s law than under yours.

The more an NDA tries to lock down (everything, forever, everywhere), the less of it a court is likely to enforce. Reasonable and specific beats broad and permanent.

What should you check before you sign an NDA?

Before you sign, look for the terms that shift risk onto you or weaken the protection on what you share. Watch for these red flags:

• A definition of “confidential information” so broad it could cover things you already knew or will learn elsewhere.
• A perpetual term with no end date.
• Non-compete or non-solicit language sitting inside what’s supposed to be a confidentiality document.
• One-sided obligations, where you’re bound but the other party isn’t.
• A “residuals” clause, which allows the counterparty to use ideas and know-how their people take away from your confidential information, without breaching the NDA.

Per the last bullet, a residuals clause cancels part of the confidentiality promise the rest of the NDA makes. It lets the receiving party use anything its people carry in “unaided memory,” even when that information is confidential.

For example, say a consultant reviews your product spec under an NDA. Six months later they design a competing product for another client, working from memory instead of your documents. A broad residuals clause means they haven’t breached anything.

The reason this clause exists is because a consultant or an engineer can’t unlearn a field they work in every day. Without it, a consulting firm would risk a claim every time an employee used what they learned on an earlier project. That makes residuals useful when you’re the one receiving information, and a problem when you’re the one sharing designs or specs.

However, residuals covers memory, not materials. A consultant who recalls an approach or a technique from working with you is inside the clause. One who goes back to your spec or copies your figures is outside it, and many clauses put deliberate memorization outside it, too.

Don’t assume trade secret law backstops you here. Memory alone isn’t a loophole, because trade secret law looks at the information rather than the format. But misappropriation requires use without the owner’s consent, and a residuals clause is that consent, which is why disclosing parties negotiate it hard instead of relying on trade secret law to save them.

Disclosing parties usually tighten the clause in one of two ways. Some carve out named products, business lines, or customers. Others limit it to general know-how and exclude anything that appeared in the documents they handed over.

Companies draft NDAs to limit their own risk, so the version handed to you will undeniably favor whoever wrote it. That’s how two parties who want the same protection end up redlining for a week, and it’s the argument for sending back only the terms that actually change your exposure.

Do you need a standalone NDA or a confidentiality clause?

Sometimes a confidentiality clause inside the main contract does the same job with less paperwork, so you don’t always need a separate NDA.

A standalone NDA makes sense early, when two parties are still exploring a deal and there’s no other agreement yet. Once a deal is underway and you’re signing a contract, a confidentiality clause built into that contract is usually cleaner than managing a second document. Either way, keep the signed version searchable so you can prove the terms if you ever need to.

Wrapping Up

An NDA is a confidentiality promise, and once you sign, you’re bound by all of it.

If you only remember one thing, look at how “confidential information” is defined and how long the obligation lasts. Those two lines decide how you’re obligated by an NDA.

For more contract lifecycle management insights, tips, and breakdowns, subscribe to the IntelAgree blog.

Frequently asked questions

Q: What does NDA stand for?

NDA stands for non-disclosure agreement. You’ll see the same document called a confidentiality agreement, and the terms are used interchangeably. A two-way version is sometimes written as MNDA, for mutual non-disclosure agreement. In healthcare and life sciences it’s often a confidential disclosure agreement, or CDA.

Q: Is an NDA legally binding?

Yes. A properly written NDA is an enforceable contract. Formation takes three things: both sides agreeing to the same deal, something of value exchanged, and terms definite enough for a court to tell whether the agreement was broken. Enforceability is a separate question — an NDA can be validly formed and still have a term a court won’t enforce because it reaches too far.

Q: Can you get out of an NDA once you’ve signed?

Usually only by agreement or expiration. Most NDAs end on a set date or when the information stops being confidential, and both parties can agree to release each other early. An NDA that’s unenforceable, or that tries to cover a disclosure the law protects, isn’t enforceable in the first place.

Q: Can a court force you to break an NDA?

A subpoena or court order can require you to disclose information an NDA covers, and complying isn’t a breach when the agreement allows for it. NDAs commonly include a permitted-disclosure provision: give the counterparty notice where you’re legally allowed to, so they can seek a protective order, and disclose only what the law requires. Notice isn’t always permitted, and it’s never required before reporting a suspected legal violation to a government agency.

Q: What is a standstill provision in an NDA?

A standstill provision bars a party from buying the other’s shares, launching a takeover, or running a proxy contest for a set period. It appears in NDAs signed during merger talks, so a potential acquirer can review confidential information without using it to mount a hostile bid. Not every NDA has one, and its absence doesn’t leave the disclosing party without recourse.

Q: Do you need a lawyer to review an NDA?

Not always, but it helps for anything high-stakes or unusual. A routine mutual NDA is often fine to sign as-is. If the terms are one-sided, the duration is open-ended, or real trade secrets are involved, legal review is beneficial.

Additional Reading

• 
  Why You Need an AI-Powered Contract Repository — How a searchable, AI-powered repository turns a scattered archive into portfolio-level insight, and what it takes to implement one.
• 
  Contract Metadata: Types & How to Use It to Drive Business Value — A look at the three types of contract metadata, and why accurate fields are what make a contract searchable, reportable, and easy to act on.
• 
  From Scattered to Structured: 3 Tips for Contract Management Organization — Why permissions are the right starting point for structuring contracts in a CLM software, and how to test your naming conventions in a pilot first.