What to include in an NDA

An NDA should include nine things: what counts as confidential, what the recipient must do with it, what is not covered, when disclosure is allowed anyway, what the agreement does not do, how information is given back, how long it lasts, what happens on a breach, and general terms such as governing law.

That is the whole of the mutual NDA published on this site, and eight of the nine are the same eight you will meet in almost any other one. What separates a good draft from a careless one is not the list, it is the choice made inside each clause, and two of those choices carry most of the risk.

What an NDA does and does not protect

An NDA creates a contractual duty of confidence over information handed to someone for a stated purpose. That is all it does. It does not make information secret, it does not transfer any rights in it, and it does not oblige either side to go on and do a deal.

The limits are worth stating plainly, because they are where people are surprised. UK government guidance on non-disclosure agreements makes the point that once information has become public, an NDA cannot be enforced over it. The same guidance notes that an NDA can cover material shared verbally in a meeting or presentation, not just documents, which is the opposite surprise and works in your favour.

This is general information, not legal advice. Contract law differs by jurisdiction, and whether a particular clause is enforceable where you are is a question for a lawyer admitted there. UK government guidance recommends asking an intellectual property attorney or a solicitor before you sign one.

Clause by clause

The table below lists the nine numbered clauses of the mutual NDA example, what each one actually decides, and the wording you get instead in drafts that skip the decision. The example is an Australian robotics company and a British parts maker sizing each other up before a manufacturing deal, so it has a genuine reason to run both ways.

Read the middle column as the question, not the answer. Your version of clause 7 will not say five years because this one does.

Definition and exclusions, the two that matter

The definition clause has two shapes. The broad shape covers anything disclosed for the purpose, in any form, and adds that marking is not required: if a reasonable person in the same industry would treat it as confidential, it is. The narrow shape lists categories, or protects only what is stamped confidential.

The broad shape is the safer one for a discloser and it is what the example uses, on the practical ground that it stops an argument about a missing label on page four of a specification. The cost is that everything becomes confidential, including material you would rather were not, which is why the weight then falls on the exclusions.

The four standard exclusions are information that is already public, information the recipient already held, information lawfully received from a third party free to disclose it, and information independently developed by people with no access to what was disclosed. Most drafts list all four. The better ones say who has to prove each, and the example does exactly that: already held has to be shown from the party’s own written records, and independent development has to be demonstrable. A bare list of four leaves the burden unallocated, which is where a dispute starts.

Four gaps worth closing

Information shared before signing. Many NDAs are signed after a first meeting where figures or plans were already mentioned. A definition that covers only information disclosed after the signing date leaves that earlier material out, so say the agreement applies from a named earlier date or from the first discussion of the opportunity.

The named purpose. The permitted use clause is what stops a party learning something in a partnership discussion and building it themselves. It only has teeth when the purpose is a specific opportunity, named in the clause, rather than “the business relationship”.

Residuals. Common in technology deals, a residuals clause lets the recipient use general knowledge its staff retain in memory. It is a real concession: resist or narrow it as the discloser, and ask for it as a recipient whose engineers cannot be asked to forget.

Third party tools. If the worry is confidential material being pasted into AI services, say so directly: the information may not be entered into third party services. Pair the clause with a practical instruction to the people handling it, because a general prohibition nobody reads is hard to police.

Term and survival

An NDA runs two clocks and they are often confused. One is how long you can keep disclosing under it. The other is how long the duty runs over material already handed over.

The mutual example lets either party end the discussions at any time, then runs the confidentiality obligation for five years from the date each item was disclosed, with design files, tooling drawings and cost breakdowns protected for as long as they remain trade secrets. That phrasing matters more than the number. A term measured from the signature date quietly shortens the protection on anything disclosed late in the process, which is usually the most sensitive material.

The one-way NDA example makes the same structural choice with different numbers: three years from each disclosure, with the clinical protocol and the patient research protected with no time limit at all. UK government guidance describes three to five years as the typical range and points to categories that justify running indefinitely.

Remedies, governing law and return of materials

Three clauses cluster at the back and get the least attention.

Return of materials. The mutual example gives 20 business days from a written request, written confirmation that it has been done, samples returned rather than destroyed, and a narrow carve out for legal files and automatic backups. The one-way example tightens this to 10 business days and adds a director’s certificate naming the systems checked. Without the backup carve out you are promising something no ordinary business can actually deliver.

Remedies. Cornell’s Legal Information Institute notes that money damages are the primary remedy for breach of contract, and that specific performance is generally awarded only where the subject matter is one of a kind. A confidentiality breach is exactly the case where money arrives too late, which is why both examples record that damages may not be an adequate remedy and reserve the right to seek an injunction without proving loss first. That wording does not bind a court, but it is the groundwork for asking quickly.

Governing law. The mutual example picks Queensland and submits both parties to the courts of that state, even though one party is in Sheffield. When the parties sit in different countries, this is the clause that decides where a dispute is fought, and it is worth deciding on purpose.

Mutual or one-way

The test is whether both sides will actually disclose. The two examples on this site differ most in who may see the information, how subcontractors are handled and how fast a breach must be reported, and the one-way draft is stricter because only one side carries the cost. The full comparison is on mutual vs one-way NDA.

Signing it

Both examples end the same way, with a block reading “For [party name]” and then Name, Position and Date lines for each side. That shape is doing a job beyond looking formal. When a document like this is handed to the signing flow, each party in the signature block becomes one recipient with its own name, email and place in the signing order. The signature area becomes a signature field, a Date line is stamped from the moment of signing rather than typed by the signer, and Name, Title and Company lines become fields of those types.

Documents built here never carry fillable input boxes, so everything printed in the body is settled content rather than something the reader completes. If you want an initial on every page as well as a signature at the back, that is a separate field placed in the signing editor, not something the block produces on its own.

The example

Read the finished mutual NDA next to the one-way version and the differences above stop being abstract. If you want the same numbered structure for something else, the numbered clause document page covers that shape, and the sibling post on common contract clauses takes the same approach across twelve longer agreements.