What to include in an NDA

Nine numbered clauses. That is the whole of the mutual NDA published on this site, and eight of the nine are the same eight you will meet in almost any other one. What separates a good draft from a careless one is not the list, it is the choice made inside each clause, and two of those choices carry most of the risk.

What an NDA does and does not protect

An NDA creates a contractual duty of confidence over information handed to someone for a stated purpose. That is all it does. It does not make information secret, it does not transfer any rights in it, and it does not oblige either side to go on and do a deal.

The limits are worth stating plainly, because they are where people are surprised. UK government guidance on non-disclosure agreements makes the point that once information has become public, an NDA cannot be enforced over it. The same guidance notes that an NDA can cover material shared verbally in a meeting or presentation, not just documents, which is the opposite surprise and works in your favour.

This is general information, not legal advice. Contract law differs by jurisdiction, and whether a particular clause is enforceable where you are is a question for a lawyer admitted there. UK government guidance recommends asking an intellectual property attorney or a solicitor before you sign one.

Clause by clause

The table below lists the nine numbered clauses of the mutual NDA example, what each one actually decides, and the wording you get instead in drafts that skip the decision. The example is an Australian robotics company and a British parts maker sizing each other up before a manufacturing deal, so it has a genuine reason to run both ways.

Read the middle column as the question, not the answer. Your version of clause 7 will not say five years because this one does.

Definition and exclusions, the two that matter

The definition clause has two shapes. The broad shape covers anything disclosed for the purpose, in any form, and adds that marking is not required: if a reasonable person in the same industry would treat it as confidential, it is. The narrow shape lists categories, or protects only what is stamped confidential.

The broad shape is the safer one for a discloser and it is what the example uses, on the practical ground that it stops an argument about a missing label on page four of a specification. The cost is that everything becomes confidential, including material you would rather were not, which is why the weight then falls on the exclusions.

The four standard exclusions are information that is already public, information the recipient already held, information lawfully received from a third party free to disclose it, and information independently developed by people with no access to what was disclosed. Most drafts list all four. The better ones say who has to prove each, and the example does exactly that: already held has to be shown from the party’s own written records, and independent development has to be demonstrable. A bare list of four leaves the burden unallocated, which is where a dispute starts.

Term and survival

An NDA runs two clocks and they are often confused. One is how long you can keep disclosing under it. The other is how long the duty runs over material already handed over.

The mutual example lets either party end the discussions at any time, then runs the confidentiality obligation for five years from the date each item was disclosed, with design files, tooling drawings and cost breakdowns protected for as long as they remain trade secrets. That phrasing matters more than the number. A term measured from the signature date quietly shortens the protection on anything disclosed late in the process, which is usually the most sensitive material.

The one-way NDA example makes the same structural choice with different numbers: three years from each disclosure, with the clinical protocol and the patient research protected with no time limit at all. UK government guidance describes three to five years as the typical range and points to categories that justify running indefinitely.

Remedies, governing law and return of materials

Three clauses cluster at the back and get the least attention.

Return of materials. The mutual example gives 20 business days from a written request, written confirmation that it has been done, samples returned rather than destroyed, and a narrow carve out for legal files and automatic backups. The one-way example tightens this to 10 business days and adds a director’s certificate naming the systems checked. Without the backup carve out you are promising something no ordinary business can actually deliver.

Remedies. Cornell’s Legal Information Institute notes that money damages are the primary remedy for breach of contract, and that specific performance is generally awarded only where the subject matter is one of a kind. A confidentiality breach is exactly the case where money arrives too late, which is why both examples record that damages may not be an adequate remedy and reserve the right to seek an injunction without proving loss first. That wording does not bind a court, but it is the groundwork for asking quickly.

Governing law. The mutual example picks Queensland and submits both parties to the courts of that state, even though one party is in Sheffield. When the parties sit in different countries, this is the clause that decides where a dispute is fought, and it is worth deciding on purpose.

Mutual or one-way

The test is not politeness, it is whether both sides will actually disclose. Here is what changes between the two examples on this site, both drawn from the finished documents:

• Who is bound. Mutual: every obligation binds both parties in the same words. One-way: the recipient only.
• Confidentiality period. Mutual: five years from each disclosure, indefinite while trade secret status holds. One-way: three years, indefinite for the clinical protocol and the patient research.
• Who may see it. Mutual: no named list. One-way: four named individuals, each with what they may access, consent required to add anyone, and access removed within two business days of leaving.
• Subcontractors. Mutual: not addressed separately. One-way: no freelancer, partner studio or offshore team without written consent, and any approved one signs directly with the discloser.
• Handling. Mutual: a general standard of care. One-way: five specific controls, including no third party AI or transcription tools and a monthly access review.
• Breach reporting. Mutual: two business days. One-way: one business day.

One-way drafts get to be stricter because only one side carries the cost of the strictness. The mutual example says why it is not one of them: a one-way version would have made the manufacturer the only party at risk, and would have stopped it showing the tooling costs the whole evaluation turns on.

Signing it

Both examples end the same way, with a block reading “For [party name]” and then Name, Position and Date lines for each side. That shape is doing a job beyond looking formal. When a document like this is handed to the signing flow, each party in the signature block becomes one recipient with its own name, email and place in the signing order. The signature area becomes a signature field, a Date line is stamped from the moment of signing rather than typed by the signer, and Name, Title and Company lines become fields of those types.

Documents built here never carry fillable input boxes, so everything printed in the body is settled content rather than something the reader completes. If you want an initial on every page as well as a signature at the back, that is a separate field placed in the signing editor, not something the block produces on its own.

The example

Read the finished mutual NDA next to the one-way version and the differences above stop being abstract. If you want the same numbered structure for something else, the numbered clause document page covers that shape, and the sibling post on common contract clauses takes the same approach across twelve longer agreements.