What Are NDAs? A Complete Guide to Non-Disclosure Agreements

Only one party discloses information and the other party receives it. The receiving party owes the confidentiality duty. This is common when a company shares its business plan with a potential investor or a supplier.

Both parties disclose confidential information to each other and both owe confidentiality duties. This is standard in joint ventures, mergers and acquisitions, and co-development agreements where each side shares sensitive data.

A specialised NDA used when a job candidate or employee will be exposed to trade secrets. It defines what information is confidential, how long the duty lasts, and can include non-solicitation and non-compete clauses in some jurisdictions (subject to local law).

Precisely who is disclosing and who is receiving. Ambiguous party definitions are a common reason NDAs fail in court.

A definition of confidential information. The best NDAs describe categories of information (financial data, technical specifications, customer lists) rather than relying only on a 'confidential' marking requirement.

The duration of the confidentiality duty (often 2-5 years, or indefinitely for trade secrets), the permitted purpose of use, exclusions (public information, independently developed information), and the governing law and dispute resolution mechanism.

Signature blocks that capture who signed, when, and in what capacity. Electronic signature platforms record this automatically with an audit trail, which strengthens enforceability.

The definition drives everything: information is only protected if it falls inside this clause. Weak drafting says 'all information disclosed orally' with no written confirmation mechanism. Strong drafting lists categories (financial, technical, customer, strategic) plus a catch-all for information 'marked confidential or reasonably identifiable as confidential', and requires oral disclosures to be confirmed in writing within 30 days.

The duty must state what the recipient may do with the information (evaluate the transaction, perform the engagement) and who may access it (named employees, advisers bound by equivalent duty). A common failure is omitting a 'need to know' limit, which lets a recipient argue the duty was open-ended.

The term is usually 2-5 years for ordinary business information, but trade secrets should survive the agreement (indefinitely, in effect). The expiry clause must distinguish 'information' from 'trade secrets'; if it does not, a court may treat the whole duty as time-limited and strip trade-secret protection.

The most-litigated carve-outs are: publicly known information (must be 'through no breach of this agreement'), independently developed information (requires the recipient to prove independent development with records), and information already known to the recipient (best evidenced in writing before disclosure).

A remedy clause should preserve injunctive relief because damages are often inadequate for leaked trade secrets, and should state the governing law and forum. Cross-border NDAs should add an arbitration clause (e.g., SIAC, HKIAC, ICC) to avoid multi-jurisdiction litigation.

The ESIGN Act and UETA provide that electronic signatures and records have the same legal effect as their paper equivalents for most contracts, including NDAs, provided the parties consent to electronic transactions.

The eIDAS Regulation gives electronic signatures legal effect across the EU, with higher evidential weight for advanced (AES) and qualified (QES) signatures. An NDA signed with a simple electronic signature (SES) is generally valid; AES/QES strengthen the evidence chain.

The Electronic Transactions Act and the Electronic Transactions Ordinance (Cap. 553) recognise electronic signatures for most commercial documents, with certain exclusions for deeds and court documents.

The Electronic Signatures Law (2005) and the Civil Code recognise electronic signatures for commercial contracts. China also has specific rules for electronic contracts in e-commerce (E-Commerce Law 2019), and courts have upheld e-signed NDAs in trade secret disputes.

If the NDA is silent, a dispute can turn into a fight over which court hears the case before the merits are ever discussed. Choose the governing law and forum explicitly: the disclosing party's jurisdiction is the usual choice, because the law that protects the trade secret is the one the disclosing party knows. Some jurisdictions (e.g., EU member states) may override contractual choice of law with mandatory rules protecting employees and consumers.

For multi-country deals, arbitration (SIAC, HKIAC, ICC, LCIA) is often more enforceable than court judgments because the New York Convention (172+ states) recognises arbitral awards nearly everywhere. Court judgments still require local recognition proceedings in many countries.

Sharing personal data across borders (customer lists, HR data) triggers data-transfer rules: GDPR adequacy decisions or SCCs in the EU, PIPL cross-border transfer rules in China, and PDPA restrictions in Singapore and Malaysia. An NDA cannot override these; pair the NDA with a data-processing agreement where needed.

Trade secret protection is not automatic everywhere. In the EU, the Trade Secrets Directive (2016/943) harmonises protection; in China, the Anti-Unfair Competition Law protects trade secrets but requires the holder to have taken confidentiality measures - which is exactly what a signed NDA evidences. In the US, the Defend Trade Secrets Act (2016) provides a federal cause of action, but state law varies.

Defining confidential information so narrowly that routine disclosures fall outside protection, or so broadly that a court finds the clause unreasonable. Use defined categories plus a 'marked or reasonably identifiable' catch-all.

No expiry or an unrealistic perpetual term. Trade secrets may need indefinite protection, but non-trade-secret information should have a defined term. Courts dislike indefinite duties for ordinary business information.

An NDA that covers confidentiality but not what happens on breach, or that lacks an exclusive-remedy clause. Include injunctive relief, damages, and attorney-fee provisions where appropriate.

Sending an unsigned NDA, losing the signed copy, or failing to capture identity verification. An e-signature platform with an audit trail solves this: the signed PDF, timestamp, and signer identity records become the evidence package.

Country, state or sector and the transaction entities involved.

Primary source, effective date and reviewer.

Completed test and retained evidence package for the target process.