2.1 Identifying the Parties
An NDA needs to clearly state who is bound by its terms. You should identify the “Disclosing Party” (the party that shares the information) and the “Receiving Party” (the party that receives it). In more complex organizational structures, it is important to identify “Affiliates” (such as subsidiaries, parent companies, or contractors) and “Representatives” (such as employees, officers, or agents) who may require information access. This helps ensure the NDA protects information across the entire organization. If you are the Receiving Party, you should ensure the definitions permit you to share information with your team as needed for your purposes.
 
2.2 Unilateral or Mutual Protection
NDAs can be either unilateral (one-way) or mutual (two-way). A unilateral NDA protects only one party’s information, while a mutual NDA protects the information of both parties. When you anticipate that both parties will disclose confidential information, even if only in a single conversation, you should require a mutual NDA.
 
Sometimes, initiating negotiations with a mutual NDA is more efficient than attempting to convert a unilateral NDA into a reciprocal one. Even if initially only one party expects to disclose confidential information, negotiations proceed more smoothly when the parties begin with a mutual NDA. Business relationships evolve dynamically. A relationship that begins with one-way disclosure can sometimes evolve into a mutual one as trust develops and strategic opportunities arise.
 
2.3 Specifying the Purpose
Specifying the purpose of disclosure in your NDA is a good practice. The purpose clause can control the use of information by the Receiving Party. A narrowly crafted purpose (such as “evaluating a potential acquisition of ABC Corporation”) substantially restricts the Receiving Party’s use of the information. A broadly stated purpose (such as “exploring business relationships”) provides greater flexibility. An ideal purpose clause should be specific enough to prevent information misuse for unrelated ventures, yet broad enough to enable comprehensive evaluation of your intended collaboration.
 
2.4 Defining Confidential Information
The definition of “Confidential Information” is at the heart of the NDA and is often heavily negotiated. As the Disclosing Party, you seek a broad definition for greater protection. As the Receiving Party, you prefer a specific definition for clear and manageable responsibilities. Two common methods for defining what is protected are the categorical approach, which lists specific types of information (e.g., technical data, product plans, or customer lists), and the marking approach, which requires labeling information as “Confidential” for it to be protected.
 
A common compromise is to merge both methods, providing breadth with specificity to create strong yet practical definitions. For instance, “‘Confidential Information’ means any non-public information disclosed by one party (the ‘Disclosing Party’) to the other party (the ‘Receiving Party’), whether disclosed orally, in writing, or in any other form. It includes, without limitation, trade secrets, know-how, customer lists, and other non-public information of the Disclosing Party. Information will be deemed Confidential Information when marked ‘Confidential’ at the time of disclosure. For oral disclosures, the Disclosing Party must identify information as confidential during disclosure and confirm this designation with a written summary provided to the Receiving Party within fifteen (15) days. However, absence of marking or confirmation shall not exclude information as Confidential Information if a reasonable person would recognize its confidential nature under the circumstances.”
 
2.5 Confidentiality Exceptions
Exceptions to the definition of “Confidential Information” are equally important. Standard exceptions encompass information that: (1) existed in the public domain before disclosure; (2) became public through no fault of the Receiving Party; (3) was rightfully obtained from third parties without confidentiality restrictions; (4) was already in the Receiving Party’s possession before disclosure; (5) was independently developed by the Receiving Party without reference to the Disclosing Party’s Confidential Information; or (6) requires disclosure under law or court order. The Receiving Party typically bears the burden of proving the applicability of the exception. If you are the Receiving Party, you should maintain records of how you obtained or developed the information.
 
2.6 Standard of Care
NDAs often require the Receiving Party to exercise “reasonable care” or, more stringently, the same degree of care used for the Receiving Party’s own confidential information. The latter standard benefits a sophisticated Receiving Party by anchoring obligations to its own internal practices. A good compromise requires reasonable care, but not less than the care used for your own confidential information. This hybrid approach sets an objective floor (“reasonable care”) while holding sophisticated parties to their potentially higher internal standards.
 
2.7 Controlling Information Use and Access
A well-drafted NDA specifies how the Receiving Party may use confidential information and restricts disclosure of confidential information to personnel on a need-to-know basis. As the Disclosing Party, you should ensure your NDA holds the Receiving Party fully responsible for breaches by its personnel. This prevents the Receiving Party from shifting accountability onto its personnel.
 
Moreover, we would like to alert you to the residuals clause, which permits the Receiving Party’s personnel to use information retained in unaided memory. Some people might argue that their personnel cannot “unlearn” what they have learned. This can undermine the NDA’s protections. If you cannot remove the residuals clause that you encounter, you should try to mitigate risks by narrowing its application to general concepts or securing commitments that personnel exposed to your confidential information will avoid participation in competing projects for a specific period.
 
2.8 Duration
Most NDAs specify the period during which the Receiving Party must keep information confidential. Some NDAs establish fixed terms, while others impose an indefinite period. The duration must be reasonable, as courts may decline to enforce unreasonably lengthy time restrictions. When determining an appropriate duration, you may consider factors such as (1) the nature, type, and commercial lifespan of the protected information, (2) the legitimate timeframe needed for the protection of information and the maintenance of competitive advantage, and (3) the prevailing industry standards.
 
A practical approach is to set a fixed term for general confidential information, while maintaining indefinite protection for specific categories that possess lasting value, such as trade secrets. This hybrid approach provides long-term protection for your valuable assets while offering reasonable expiration for less sensitive information.
 
2.9 Return and Destruction Obligations
 NDAs generally address what happens to confidential information when the relationship ends or upon request. Typically, the Disclosing Party requires the Receiving Party to return or destroy all confidential materials upon request, or upon termination or expiration of the relationship. If you are the Receiving Party, you should negotiate two practical exceptions. First, you should require permission to retain copies for compliance purposes, subject to continuing confidentiality obligations. Second, you should seek an acknowledgment that destruction obligations exclude information on automated backup systems, provided such backups are not accessed except for legally required purposes. These reasonable exceptions reflect regulatory compliance requirements and modern data management realities.
 
2.10 Remedies
Because confidentiality breaches cause immediate and irreversible harm, monetary damages alone are often insufficient to compensate for the harm. In addition, unauthorized disclosure likely destroys or diminishes the value of confidential information. A critical remedy for confidentiality breaches is injunctive relief (e.g., court orders compelling the cessation of unauthorized disclosure). Thus, many NDAs explicitly provide for injunctive relief. An ideal clause states that parties acknowledge that breach would cause irreparable harm, entitling the Disclosing Party to seek injunctions. While courts retain discretion and are not absolutely bound by such language, it contractually prevents the breaching party from arguing that monetary damages provide an adequate remedy. This substantially eases the Disclosing Party’s burden when persuading courts to grant injunctive relief. It also demonstrates the parties’ mutual understanding of the value of information at the time of contract formation.