Return of confidential information clause after an NDA or due diligence

Sample clause

Written for the end of a due diligence process between Fernhill Consulting and Marlow Logistics, a fictional freight business in Brisbane.

Return or Destruction. (a) Within 14 days after receiving a written request, or within 14 days after this agreement ends, the Receiving Party must return or destroy all Confidential Information in its possession or control, including all copies, notes and analyses derived from it. (b) Physical samples and original documents must be returned rather than destroyed. (c) Paragraph (a) does not require deletion of a copy held in a routine system backup that cannot reasonably be isolated. Any such copy remains subject to clause 8 until it is deleted in the ordinary course of the Receiving Party's backup cycle, and must not be restored for any purpose other than disaster recovery. (d) The Receiving Party may retain one copy of the Confidential Information where it is required to do so by law, by a regulator, or by its professional insurer, and must tell the Disclosing Party what it has kept and why. (e) Within 5 business days of complying with paragraph (a), the Receiving Party must give the Disclosing Party a certificate signed by an officer confirming what was returned and what was destroyed.

Sample wording, not legal advice.

Variants

What to negotiate

• Return or destroy, and who chooses

  Disclosing parties often want the choice, because returning a prototype and destroying a spreadsheet are different outcomes. Receiving parties want to destroy, since shipping material back costs money and returns nothing to the sender. The practical settlement is destruction by default, return for physical items and originals, with the disclosing party able to direct otherwise in the request.

• The backup carve out

  No standard backup system lets an operator pull one counterparty's files out of a nightly snapshot. Receiving parties ask for an express carve out; disclosing parties accept it once they understand the alternative is a promise that will simply be broken. The carve out should be paired with a continuing confidentiality obligation over the retained copy and a bar on restoring it for any other purpose.

• Whether a certificate is required

  A certificate signed by an officer turns an unverifiable promise into a document somebody has put their name to, which changes how seriously the task is treated internally. Receiving parties resist only where the deadline is unrealistic. Five business days after completing the work is usually enough, and naming the method of destruction adds little burden.

• Derived materials and notes

  Analyses, models and summaries built from the information are often more useful than the source files. Disclosing parties want them covered expressly. Receiving parties ask that internal board papers and legal advice referring to the material be excluded, which is reasonable, provided those documents stay subject to the confidentiality obligation.

The risk of leaving it out

Without the clause there is no deadline, no method and no proof, so material stays on laptops and shared drives indefinitely with nobody responsible for it. When a leak happens years later, the disclosing party finds that the other side was never obliged to return anything, and that the confidentiality obligation it relied on may have already expired.

Deletion promises that cannot be kept

A clause requiring deletion of every copy is common and rarely achievable. Backups run on cycles, disaster recovery systems replicate across sites, and email archives are retained under separate policies, often because a regulator requires it. Signing up to delete everything means signing up to a breach, which helps nobody. The honest version carves out routine backups, keeps them under the confidentiality obligation until they age out, and bars restoring them for any purpose other than disaster recovery. That gives the disclosing party a real protection instead of an unenforceable promise, and it gives the receiving party something its own technology team can actually implement.

Lawful retention and personal information

Advisers, auditors and regulated businesses often must keep engagement records for a fixed period, and insurers frequently require the same. A clause with no retention exception forces those parties either to breach the contract or to breach their own obligations. Where the material includes personal information, the Privacy Act 1988 and the Australian Privacy Principles also apply, and APP 11.2 requires an entity to take reasonable steps to destroy or de identify personal information it no longer needs for a permitted purpose, unless a law or court order requires it to be kept. A return of materials clause that ignores privacy leaves the receiving party balancing two sets of rules with no guidance.

After a deal that did not proceed

This clause is mostly used at the end of a non disclosure agreement or a due diligence process, often one where the deal fell through. That makes it different from a data return clause in a services contract, which deals with the customer's operating data held on the supplier's systems. Here the risk is the bidder's own work: the valuation model, the board paper recommending the price, the notes from the site visit. Those derived materials are what a failed bidder is most tempted to keep, so the clause should name them. Physical items matter too. Product samples, prototypes and original signed documents cannot be meaningfully destroyed without loss to the owner, so the sample requires them to come back. For operational data at the end of an outsourcing contract, use a data return and deletion clause instead.

Documents that carry this clause

Mutual NDAA robotics company and a British parts maker want to look inside each other before agreeing to anything. Both sides are handing over trade secrets, which is the only real reason to make an NDA mutual.Consulting agreementAn advisory firm reviews three bakeries over seven weeks. What makes this agreement useful is not the fee clause but the two clauses that say what the advice is not.Employment contractA full time ongoing contract for an operations coordinator on $86,000 plus $10,320 of superannuation. Eleven numbered clauses, a leave table drawn from the National Employment Standards, and a notice table that scales with service.Employee confidentiality agreement with information classesMost employee confidentiality agreements treat every secret the same way. This one sorts information into four classes, gives each its own handling rule and its own survival period, and is executed as a deed so it still binds after the salary that supported it has stopped.

Questions people ask