What is an NDA

A non-disclosure agreement is one of the most common contracts in business, and also one of the most casually signed. It arrives before a partnership talk, a funding round, a vendor evaluation, or a new hire's first day, and it usually gets a quick skim and a signature. That is a mistake worth avoiding, because an NDA creates real, enforceable obligations that can outlast the deal it was meant to protect.

This guide explains what an NDA is, what it does, who signs it, the terms that matter, and how to keep track of one after it is signed. If you already know the basics and want a clause-by-clause review before you sign, read what to look for in an NDA instead.

Key takeaways

• A non-disclosure agreement (NDA) is a contract in which the parties agree to keep specified information confidential and not share it with anyone the agreement does not authorize.¹
• NDAs come in three structures: unilateral (one side discloses), mutual or bilateral (both sides disclose), and multilateral (three or more parties).²
• The core of any NDA is how it defines confidential information, what it excludes, how long the obligation lasts, and what happens on breach.
• Breaching an NDA is a breach of contract. Remedies can include damages and injunctions, and where trade secrets are involved, federal law adds its own civil remedies.¹³
• Some NDAs are unenforceable. Since December 2022, pre-dispute NDAs cannot silence claims of sexual assault or sexual harassment.⁴
• Most NDA problems appear after signing: expiration dates nobody tracks, return-or-destroy obligations nobody acts on, and confidentiality terms that quietly survive for years.

What an NDA is

A non-disclosure agreement is a contract in which the parties agree that certain information will remain confidential. It legally binds the people who sign it and prevents them from sharing any information covered by the contract with anyone the agreement does not authorize.¹ You will also see it called a confidentiality agreement, a confidential disclosure agreement (CDA), or a secrecy agreement. These names describe the same instrument.

The practical job of an NDA is narrow and useful: it lets two or more parties exchange sensitive information for a specific purpose without giving up control of that information. A startup can show its financials to an investor, a manufacturer can share a design with a supplier, and an employer can give a new hire access to internal systems, all while keeping a legal claim on how that information is used and who else sees it.

An NDA does not stop a leak from happening. What it does is define, in advance, what counts as confidential, what the receiving side is allowed to do with it, and what the disclosing side can demand if the obligation is broken.

Purpose and common uses of an NDA

The purpose of an NDA is to protect information that has value precisely because it is not public: trade secrets, business negotiations, client lists, pricing, product plans, source code, and financial data.¹ Once that information is disclosed without protection, it is difficult to claw back, so the agreement front-loads the terms of exchange.

Common situations where an NDA is used include:

• Hiring and onboarding. Employees and contractors often sign an NDA before they get access to internal information, systems, or customer data.
• Vendor and supplier relationships. Sharing specifications, roadmaps, or operational data with an outside provider usually calls for a confidentiality agreement first.
• Business negotiations and partnerships. Two companies exploring a deal exchange sensitive information before anything is signed, so they protect it with a mutual NDA.
• Investor and fundraising discussions. Founders share financials and strategy with prospective investors, though many investors decline to sign NDAs at the earliest stage.
• Mergers and acquisitions. Due diligence exposes a target company's full internal picture, and an NDA governs that exchange.

If information has commercial value and you are about to hand it to someone outside your control, that is the moment an NDA is meant to cover.

Parties involved in an NDA

Every NDA is built around two roles, and the structure of the agreement depends on which sides hold them.

• The disclosing party shares confidential information and wants it protected.
• The receiving party gets access to that information and takes on the obligation to keep it confidential.

From those roles come the three standard NDA types:²

• Unilateral NDA. One party discloses, the other receives. Common when a company shares information with an employee, contractor, or vendor who has nothing confidential to share in return.
• Mutual (bilateral) NDA. Both parties disclose and both receive, so each side is bound to protect the other's information. Common between two companies negotiating a partnership or transaction.
• Multilateral NDA. Three or more parties are involved, and at least one discloses to the others. Using a single multilateral agreement can be simpler than negotiating separate two-party NDAs across a group.

Knowing which role you hold changes how you read the document. A receiving party should focus on how heavy the obligations are and how long they last. A disclosing party should focus on whether the definition of confidential information is broad enough to actually cover what it is sharing.

Key terms and clauses in an NDA

An NDA is short compared with most contracts, but a handful of clauses carry almost all of its weight. This section is an overview of what each one does. For a detailed, clause-by-clause reading guide before you sign, see what to look for in an NDA.

• Definition of confidential information. This is the heart of the agreement. It sets the boundary of what is protected. Too narrow and real secrets fall outside it; too broad and the clause becomes hard to enforce.
• Exclusions from confidentiality. Standard carve-outs cover information that is already public, was already known to the receiving party, is independently developed, or is lawfully obtained from a third party. Most NDAs also permit disclosure that is required by law or court order.
• Obligations of the receiving party. What the receiving side must do: keep the information secret, use it only for the agreed purpose, and limit access to people who need it.
• Term and duration. How long the confidentiality obligation lasts. It can run for a fixed number of years or, for genuine trade secrets, continue for as long as the information stays secret.¹
• Return or destruction of information. A requirement to return or destroy confidential materials when the agreement ends or on request.
• Remedies for breach. What the disclosing party can pursue if the obligation is broken. Because money often cannot undo a disclosure, NDAs frequently allow for injunctive relief, a court order to stop further disclosure, on top of damages.¹
• Governing law. Which jurisdiction's law applies and where disputes are resolved.

Important dates and lifecycle events

An NDA looks like a one-time document, but it has a lifecycle, and the dates in it are the part most often lost after signing.

• Effective date. When the obligations begin. This is not always the signature date, so check the wording. NDAs are routinely signed electronically, and the same laws that validate other e-signed business contracts apply here: the federal ESIGN Act and state-level UETA.
• Disclosure period. The window during which shared information is treated as confidential. Some NDAs protect only what is exchanged during a defined period.
• Term of the agreement. How long the overall agreement is in force.
• Survival period. The confidentiality obligation often outlives the agreement itself. It is common for an NDA to expire while the duty to keep specific information secret continues for a set number of years afterward, or indefinitely for trade secrets.
• Expiration. The point at which the confidentiality obligation ends. After it, the parties are generally free of the duty unless another clause extends it.¹
• Return-or-destroy deadline. The date by which materials must be returned or destroyed, often triggered by termination or a written request.

The recurring risk here is simple: obligations that survive long after everyone has moved on. An NDA signed for a deal that never happened can still bind you years later, and the only way to manage that is to record its key dates somewhere you will actually see them.

Risks and common mistakes

Most NDA problems are not dramatic breaches. They are quieter failures of drafting and tracking.

• A definition that is too broad or too narrow. An overbroad definition of confidential information is harder to enforce, and a narrow one may leave your real secrets unprotected. This clause deserves more attention than any other.
• Missing exclusions. Without carve-outs for public, pre-known, or independently developed information, a receiving party can be bound to treat as secret things it already knew or could learn freely.
• Confidentiality with no end. An indefinite obligation may be appropriate for trade secrets, but applying it to ordinary business information creates a burden that is hard to justify and hard to track.
• Assuming every NDA is enforceable. Some are not. A pre-dispute NDA cannot be used to bar someone from speaking about sexual assault or sexual harassment, following the federal Speak Out Act enacted in December 2022.⁴ Overly broad agreements can also run into limits under the National Labor Relations Act where they restrict employees' protected rights.¹ An NDA is not a way to contract around the law.
• Losing track after signing. The most common failure is administrative. The agreement gets filed and forgotten, its expiration and return obligations go unmonitored, and nobody notices when a duty lapses or when a materials-return deadline passes.

The first four mistakes are matters of drafting and review. The last one is a matter of contract management, and it is the one most within your control after the ink dries.

Related contract types

NDAs sit alongside several other agreements, and it helps to know where the lines fall.

• Confidentiality agreement / CDA. Generally the same instrument as an NDA under a different name.¹
• Non-compete and non-solicitation agreements. These restrict what a person can do (work for a competitor, solicit clients or staff) rather than what they can disclose. They are often confused with NDAs but serve a different purpose and face tighter legal limits.
• Data processing agreement (DPA). Where personal data is involved, confidentiality alone is not enough. A DPA governs how one party processes personal data on another's behalf. See what is a data processing agreement for the distinction.
• Master service agreement, statement of work, and engagement letter. In a service relationship, confidentiality is usually one clause within a larger agreement. See what is a statement of work and what is an engagement letter.
• Service level agreement. A related schedule you will often see in the same vendor relationship. See what is a service level agreement.

An NDA is frequently embedded as a confidentiality clause inside these broader contracts rather than signed as a standalone document, so it is worth checking whether the deal in front of you needs a separate NDA at all.

Contract-management checklist

An NDA's value comes from being enforced, and enforcement depends on knowing what you agreed to. Once one is signed, record and monitor the following.

What to record	What it is	What it triggers
Parties and roles	Who is disclosing, who is receiving	Determines whose obligations you are tracking
Effective date	When obligations begin	The start of every downstream date
Term and expiration	When the agreement ends	A review before you rely on protection that may have lapsed
Survival period	How long confidentiality outlives the agreement	Continued obligations after the term ends
Return-or-destroy deadline	When materials must be returned or destroyed	An action item on termination or request
Permitted purpose	What the information may be used for	A check whenever the information is reused
Governing law	Which jurisdiction applies	Where and how any dispute would proceed

The practical goal is that no obligation quietly outlives your awareness of it. A contract management platform helps here by keeping signed NDAs in one place, extracting the key dates and parties automatically, and sending reminders before survival periods lapse or return deadlines arrive, so the obligations stay visible after signature rather than sitting in a folder nobody opens. You can try Contracko free if you want to centralize and track NDAs alongside the rest of your contracts.

Sources

Images in this article were generated with the assistance of AI.

Footnotes

1. Legal Information Institute, Cornell Law School, "Non-disclosure agreement (NDA)," Wex legal dictionary. Defines an NDA as a contract to keep specified information confidential, describes what it protects (trade secrets, business negotiations, client information), covers duration and remedies including injunctions, and notes limits under the Speak Out Act and the National Labor Relations Act. law.cornell.edu/wex/non-disclosure_agreement_(nda) ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹

2. Icertis, "What is a Non-Disclosure Agreement (NDA)?" describes the three standard NDA structures: unilateral, bilateral (mutual), and multilateral. icertis.com/contracting-basics/what-is-an-nda/ ↩ ↩²

3. Defend Trade Secrets Act of 2016, 18 U.S.C. § 1836, establishes a federal civil cause of action allowing a trade secret owner to sue for misappropriation, with remedies including injunctive relief and damages. law.cornell.edu/uscode/text/18/1836 ↩

4. Speak Out Act, Public Law 117-224, signed into law December 7, 2022, makes pre-dispute nondisclosure and non-disparagement clauses unenforceable in disputes involving sexual assault or sexual harassment. congress.gov/117/plaws/publ224/PLAW-117publ224.htm ↩ ↩²