Checklist · Intellectual Property

Building an Enforceable NDA Clause by Clause: A Practical Checklist

Type
Checklist
Jurisdiction
National
Date
2026-02-05
Topic
Intellectual Property

The nondisclosure agreement is the most common contract in commercial life and among the most casually drafted, and the gap between a form that looks protective and one a court will enforce is measured in clauses, not pages. This checklist takes the NDA apart provision by provision and rebuilds it: choosing a mutual, unilateral, or reciprocal structure that tracks the real flow of information; defining confidential information through a layered mechanism with a working marking habit; pairing a non-use covenant with the non-disclosure covenant; stating the four standard exclusions; separating term from survival and giving trade secrets a perpetual proviso; and including the easily-forgotten DTSA whistleblower-immunity notice under 18 U.S.C. 1833(b) that unlocks exemplary damages and fees against a bound individual. It then works through compelled disclosure, return or destruction, injunctive-relief and cumulative-remedies clauses, choice of law and cross-border arbitration, and the two problems that break technology NDAs, residual knowledge and reverse engineering. Each item is paired with the reason it earns its place and the drafting trap it defuses, anchored in the case law that actually decides these disputes. The aim is an agreement that protects what matters rather than one that merely reassures the party signing it.

Building an Enforceable NDA Clause by Clause: A Practical Checklist

Intellectual Property > Trade Secret | Published 5 February 2026 - Updated 6 June 2026 | UpLaw - uplaw.us

A nondisclosure agreement is only as strong as its weakest operative clause. This resource dismantles the NDA into the provisions that carry the load, explains what each one is engineered to do, and flags the drafting mistakes that quietly render an agreement useless right when it is needed. Written for drafters, reviewers, founders, and judges alike, with the governing statutes and case law woven through.

Keywords: NDA, confidentiality agreement, definition of confidential information, non-use covenant, standard exclusions, marking requirement, survival period, DTSA whistleblower-immunity notice, 18 U.S.C. § 1833(b), compelled disclosure, injunctive relief, residual knowledge, reverse engineering, choice of law.

Almost every company signs nondisclosure agreements, and almost no company reads them. An NDA is the paperwork you sign to get to the meeting, the file the deal team recycles from the last transaction with two names swapped, the two-page attachment that circulates on autopilot. That casualness is exactly the problem. The NDA is frequently the only contract governing the single most dangerous moment in a commercial relationship: the moment one party hands its most valuable information to a party that could become a competitor. A form that looks like protection but does not function like protection is worse than no agreement at all, because it invites disclosure the discloser would otherwise never make.

The difference between an NDA that works and one that fails is rarely length or polish. It is whether the drafter understood what each clause was for. This checklist takes the agreement apart at the seams and rebuilds it clause by clause, pairing every provision with the reason it earns its place and the specific failure it prevents. Treat it as a drafting companion and a review protocol: read your form against it, and every gap it exposes is a gap a sophisticated adversary will find first.

An NDA never stands alone. It is one instrument inside a larger protection program, and it performs best alongside the measures described in standing up a trade secret protection program and the broader trade secret protection toolkit. For the narrative treatment aimed specifically at software and hardware deals, see nondisclosure agreements for technology deals; for the underlying doctrine that gives an NDA its teeth, see trade secret law.

What an NDA Actually Does, and What It Cannot

Before drafting a single clause, be honest about the instrument's limits, because half of all NDA disputes trace back to a party that expected the contract to do something contracts cannot.

An NDA does not create property rights in information. It does not stop a counterparty from independently developing the same idea. It does not, by its own force, transform ordinary business information into a trade secret. And it cannot un-ring a bell: once a secret is genuinely public, no contract restores its secrecy. The Practical Law treatment of confidentiality agreements puts the point bluntly, and it is worth internalizing: proving a breach can be very difficult, damages may be inadequate or nearly impossible to quantify, and a recipient who complies with every letter of the agreement may still put what it learned to indirect competitive use.

What an NDA does do is genuinely valuable, and understanding it precisely tells you which clauses matter. First, it creates a contractual duty of confidence that exists independent of trade secret law and reaches information that would never qualify as a trade secret: pricing on a single deal, the fact that negotiations are happening, a customer's identity, a roadmap slide. Second, and less obviously, the NDA is evidence. Trade secret protection under both the federal Defend Trade Secrets Act and the state Uniform Trade Secrets Act turns on whether the owner took "reasonable measures" (DTSA) or made "efforts that are reasonable under the circumstances" (UTSA) to keep the information secret. See 18 U.S.C. § 1839(3)(A); Unif. Trade Secrets Act § 1(4)(ii). A signed confidentiality agreement is Exhibit A of reasonable measures. Judge Posner's opinion in Rockwell Graphic Systems, Inc. v. DEV Industries, Inc., 925 F.2d 174 (7th Cir. 1991), remains the canonical explanation of why perfect secrecy is not required and why contractual and practical measures together carry the day.

But note the flip side, because it disciplines everything that follows: an NDA is necessary but not sufficient. In nClosures Inc. v. Block & Co., 770 F.3d 598 (7th Cir. 2014), the Seventh Circuit held that a company which relied on a confidentiality agreement while failing to take other basic protective steps, no access restrictions, no marking, no locked files, had not made reasonable efforts and lost trade secret protection. The lesson for the drafter is that the NDA's clauses must describe measures the client will actually perform, and the client must perform them. A protection program that exists only on paper is a theory the other side gets to disprove in front of a jury. For the full architecture around the agreement, see building trade secret protection from the ground up and auditing your trade secrets.

With the instrument's job clear, work through the clauses.

Clause 1: Match the Structure to the Flow of Information

  • [ ] Choose mutual, unilateral, or reciprocal based on the actual direction of disclosure, not on which party has more leverage.
  • [ ] Use a unilateral form where information truly runs one way (a client feeding data to a consultant, a startup pitching a potential acquirer).
  • [ ] Use a mutual form where both sides will genuinely share, or where the flow is uncertain and symmetry is cheaper than guessing.
  • [ ] Consider a reciprocal form, defining each side's disclosures and obligations separately, where both disclose but the kind, volume, and sensitivity of information differ sharply.

The trade literature recognizes three structures, and the distinction is not cosmetic. A unilateral (one-way) agreement binds only the recipient; the operative restrictions run against a single party. A mutual agreement treats each party as both discloser and recipient, subject to identical obligations. A reciprocal agreement sits between them: both parties disclose, but the scope of what each shares, and the obligations attached, are defined separately because the exchange is genuinely asymmetric.

Why it matters. Choosing the wrong structure creates avoidable risk in both directions. A unilateral NDA that loads sweeping restrictions onto a recipient who receives little, with no reciprocity, invites an argument that the agreement is an overreaching adhesion contract, and it looks worse to a court weighing whether to grant equitable relief. A mutual NDA's symmetry generally reads as fairer and negotiates faster. But forcing mutuality where one party has nothing real to disclose is not a neutral choice: it hands the non-discloser a set of confidentiality rights it can wield as leverage later, and it clutters the agreement with obligations nobody intends to honor.

Worked example. Northwind Robotics, a twelve-person startup, is courting Continental Freight, a logistics giant, about a pilot deployment. Northwind will pour its navigation-stack architecture, sensor-fusion parameters, and pricing into the relationship. Continental will share warehouse layouts and throughput data, useful, but not crown jewels, and far less sensitive. A fully mutual form would subject Northwind's founders to identical obligations over Continental's floor plans while nominally reassuring Continental about Northwind's algorithms. The better fit is a reciprocal agreement: Northwind's disclosures get the tighter definition, the express non-use covenant, and the perpetual trade-secret survival; Continental's operational data gets a shorter, lighter regime. The structure follows the value at risk, not the size of the logo.

For the deeper analysis of structure selection in technology-specific deals, see nondisclosure agreements for technology deals.

Clause 2: The Preamble and the Load-Bearing "Purpose"

  • [ ] Identify the parties precisely, and decide whether affiliates (parents, subsidiaries, sister entities) are disclosers, recipients, or both, and name them if so.
  • [ ] Draft a Purpose clause that frames why information is being exchanged (for example, "to evaluate and, if warranted, to negotiate a pilot deployment of Recipient's platform").
  • [ ] Define the term "Purpose" so that every downstream use restriction can anchor to it.

The preamble looks like boilerplate. It is not. The defined Purpose is the single most load-bearing phrase in the agreement after the definition of confidential information, because it is the yardstick against which the non-use covenant is measured. If the Purpose is drafted as a throwaway, the use restriction it supports is a throwaway. If it is drafted with care, "solely to evaluate the Transaction and for no other purpose," it becomes the hook on which the disclosing party hangs its most important protection.

Scope the Purpose deliberately. Draft it broadly enough that the recipient can do the real work, the engineer can run the integration test, the analyst can build the model, without breaching. Draft it narrowly enough that competing development, benchmarking against the discloser's own products, or "market research" fall outside it. A Purpose defined as "to explore a potential business relationship" is nearly useless; it permits almost anything. A Purpose defined as "to evaluate a specific, described transaction" does real work.

Address affiliates explicitly. If the disclosing party's crown-jewel data actually lives in a subsidiary, and the subsidiary is not a party, the agreement may not cover it. If the recipient will share information with a parent company that is not bound, the discloser has a leak by design. The Practical Law guidance recommends deciding, at the outset, which affiliates are sources of information and which recipients may pass information to affiliates, and papering that decision rather than leaving it to inference.

Clause 3: Define Confidential Information, and Actually Operate the Marking Machinery

  • [ ] Use a layered definition: (1) information marked or designated confidential when disclosed in tangible or electronic form; (2) information disclosed orally or visually, identified as confidential at the time and confirmed in writing within a fixed window (30 days is common); and (3) information that a reasonable person would understand to be confidential from its nature or the circumstances.
  • [ ] Add, introduced by "without limiting the foregoing," an enumerated list keyed to this deal. For a technology transaction: source and object code, algorithms and model architectures, training data and weights, APIs, database schemas, security architecture, product roadmaps, performance and benchmark data.
  • [ ] Make the definition reach derivatives: notes, analyses, compilations, and reports the recipient creates from the disclosed information.
  • [ ] Specify the forms of disclosure covered (written, electronic, oral, visual) and the fact of the parties' discussions themselves, where secrecy of the relationship matters.
  • [ ] Build the operational habit to run the marking mechanism: name who sends the post-meeting confirmation, use a template, and treat the confirmation window as a hard deadline.

This is the heart of the agreement, and it is where drafters most often steer into one of two ditches. Define confidential information too narrowly and genuinely valuable material sits outside the fence, unprotected. Define it too broadly, "all information disclosed by either party," and a court may decline to enforce a definition so sweeping that the recipient cannot tell what is covered and cannot conduct its ordinary business without risking breach. In Lasership, Inc. v. Watson, 79 Va. Cir. 205 (2009), a Virginia court refused to enforce a confidentiality restriction whose definition was so broad it functioned as an unbounded restraint. Breadth is not strength; a definition that protects everything reliably protects nothing.

The layered approach threads the needle. The marking prong gives certainty: stamped documents are covered, full stop. The oral-disclosure prong with a confirmation window captures the live whiteboard session, the architecture walkthrough, the number blurted out in a hallway, which are frequently the most valuable disclosures of an entire engagement and the ones no one remembers to stamp. The reasonable-person prong is the safety net for the material that is obviously sensitive from its nature even if the paperwork lapsed.

But the confirmation mechanism is a trap for the party that drafts it and then never runs it. If your NDA says oral disclosures are protected only if "summarized in writing and designated as confidential within thirty days," and your team never sends the summaries, you have contracted your own most sensitive disclosures out of protection. This is not hypothetical. In Convolve, Inc. v. Compaq Computer Corp., 527 F. App'x 910 (Fed. Cir. 2013), the parties' NDA required that orally disclosed information be reduced to a writing marked confidential within a set period; where Convolve failed to follow that contractual procedure, the disclosed information fell outside the agreement's protection, gutting a chunk of the trade secret case. The clause did exactly what it said. The lesson is operational as much as legal: whoever attends the technical sessions must own the follow-up email, and the thirty-day clock must live on a calendar, not in someone's good intentions.

Worked example. During a Tuesday design review, Northwind's CTO sketches the exact latency-optimization technique that lets its robots reroute in crowded warehouses, the one parameter set that makes the whole product work. Nobody hands over a marked document; it lives on a whiteboard and in three minds. Under a marking-only definition, that disclosure is unprotected the moment the meeting ends. Under the layered definition, it is protected if Northwind's counsel-designated note-taker sends Continental a short email within thirty days: "Confirming as Confidential Information under Section 2 the latency-optimization approach discussed on [date]." One templated email preserves the crown jewel. Its absence forfeits it. The clause is only as good as the habit.

Two more drafting points. Reach derivatives expressly, because the recipient's own model built on your data, or its internal memo summarizing your architecture, is often where the real value migrates, and a definition that covers only "information disclosed by the Discloser" may not capture what the recipient made from it. And cover the fact of the discussions where premature disclosure of a deal would itself cause harm, a common and easily overlooked category.

Clause 4: The Standard Exclusions, and Why Deleting Them Backfires

  • [ ] State the four standard exclusions. Confidential information does not include information that: (1) is or becomes public other than through the recipient's breach; (2) was already in the recipient's possession, per its written records, before disclosure; (3) is independently developed by the recipient without use of the disclosed information; or (4) is rightfully received from a third party without a duty of confidentiality.
  • [ ] Resist the instinct to trim the exclusions to "capture more." The exclusions are not concessions; they are what keeps the definition enforceable.

An anxious disclosing party often wants to delete these carve-outs to lock up as much as possible. That instinct is backwards. An NDA that purports to bind a recipient to keep secret information that is already public, or that the recipient demonstrably knew beforehand, or that it developed entirely on its own, overreaches in a way courts notice, and the overreach can corrode enforceability of the whole definition. The exclusions also track the substantive law: trade secret protection does not extend to information that is generally known or readily ascertainable, and contract cannot manufacture a secret out of public knowledge.

The independent-development exclusion draws the most heat, and for a real reason: disclosers of highly sensitive material worry, legitimately, that a recipient will "independently develop" a suspiciously similar product and dare the discloser to prove otherwise. The answer is not to delete the exclusion, which weakens the whole agreement, but to pair it with a robust non-use covenant (next clause), a clean-room discipline for the recipient, and, where the stakes justify it, tight controls on who sees the most sensitive material in the first place so that "independent" development is genuinely traceable. The prior-possession exclusion should be tied to the recipient's contemporaneous written records, so that "we already knew that" is a documented fact, not a convenient after-the-fact assertion.

Clause 5: Two Covenants, Not One, Non-Disclosure and Non-Use

  • [ ] Include a non-disclosure covenant: the recipient will not reveal confidential information to third parties except as the agreement permits.
  • [ ] Include a separate non-use covenant: the recipient will use confidential information solely for the Purpose and for no other purpose.
  • [ ] In technology deals, add an express prohibition on using confidential information to reverse engineer, design around, benchmark against, or replicate the discloser's products.

Here is the mistake that hollows out more NDAs than any other: the agreement contains a non-disclosure covenant and stops. It tells the recipient not to tell anyone the secret. It says nothing about the recipient using the secret. The harm the disclosing party most fears is not usually that the recipient will publish the algorithm; it is that the recipient will quietly build a competing product informed by it, having told no one. A pure non-disclosure covenant permits exactly that. The non-use covenant closes the gap, and it must be a distinct promise, not a clause you assume is implied.

The non-use covenant is what makes the "Purpose" clause pay off. "Recipient shall use Confidential Information solely to evaluate the Transaction and for no other purpose" ties every permitted use to the narrowly drafted Purpose from Clause 2. Without it, a recipient can honor the letter of a non-disclosure clause while draining the disclosure of all its competitive value.

The non-use covenant also carries the doctrine of misuse into a space that outstrips ordinary trade secret law. Even where a departing employee or counterparty takes nothing tangible, the risk that they will inevitably rely on what they learned animates the "inevitable disclosure" doctrine recognized in PepsiCo, Inc. v. Redmond, 54 F.3d 1262 (7th Cir. 1995), where the court enjoined a former executive from taking a competing role because he could not perform it without drawing on the plaintiff's trade secrets. A crisp contractual non-use covenant gives the disclosing party a cleaner, more predictable route to the same protection than the contested inevitable-disclosure theory, which many states (California most prominently) reject outright. For how this interacts with employee mobility and the collapsing non-compete regime, see protecting trade secrets when employees leave and the future of non-competes.

Clause 6: Need-to-Know and the Representatives Problem

  • [ ] Permit disclosure only to Representatives (officers, employees, directors, legal counsel, accountants, financial advisors) who need to know the information for the Purpose.
  • [ ] Require that each Representative be informed of the confidential nature and be bound by obligations at least as protective as the agreement's.
  • [ ] Make the recipient responsible for its Representatives' breaches, so the disclosing party has a single, solvent, contractually bound counterparty to sue.
  • [ ] Decide whether especially sensitive material should require Representatives to sign separate confidentiality agreements directly with the discloser.

An NDA that binds only the signing entity leaks through its own people. The recipient is a company; the actual humans who see the information are employees, advisors, and subcontractors. The need-to-know and Representatives machinery closes that leak by confining internal access to those who genuinely need the information for the Purpose and by ensuring that everyone who touches it is bound by equivalent obligations, with the recipient standing behind them.

The critical drafting choice is the responsibility clause: "Recipient shall be responsible for any breach of this Agreement by its Representatives." This gives the disclosing party a clean claim against a known, contractually committed party, rather than forcing it to chase individual employees or advisors with whom it has no privity. For the highest-sensitivity disclosures, consider requiring key Representatives, an outside consultant with deep access, a subcontractor, to sign a separate NDA directly with the discloser, so the discloser has a direct claim and the recipient is not the only line of defense. The tension here, whether to accept responsibility for representatives or push them into direct agreements, is a standard negotiation point, and either resolution can be sound if it is deliberate.

Clause 7: Standard of Care and Security

  • [ ] Set a standard of care: the recipient will protect confidential information with at least the degree of care it uses for its own comparable information, and in no event less than reasonable care.
  • [ ] Where warranted, add specific security requirements, no less rigorous than reasonable industry standards, and consider segregation, access logging, and breach-notification duties.
  • [ ] Add a duty to notify the disclosing party promptly of any suspected unauthorized access or disclosure.

A recipient that is careless with its own secrets should not get to be equally careless with yours; that is why the "same care as its own, but no less than reasonable" formulation has a floor. For sensitive technical material, go beyond a generic standard: require the information to be segregated, access to be logged, and specific safeguards to be maintained. This clause does double duty. It protects the information operationally, and, because reasonable measures are the touchstone of trade secret status, it strengthens the disclosing party's own downstream position if the matter ever becomes litigation under the DTSA or UTSA. In a distributed, cloud-first workplace, the security clause has to be written for the way work actually happens; see guarding trade secrets without a perimeter. Pair the notification duty with a real plan for what happens when the phone rings, as detailed in when a breach hits your crown jewels.

Clause 8: Term Versus Survival, and the Perpetual Trade-Secret Proviso

  • [ ] Distinguish two periods: the term (the window during which the parties may disclose information) and the survival period (how long the confidentiality obligations continue after the term ends).
  • [ ] Use a fixed survival period (commonly three to five years) for ordinary confidential information.
  • [ ] Add a proviso that obligations as to any information that constitutes a trade secret continue for as long as the information remains a trade secret.

Conflating term and survival is a classic error. The term governs when disclosures happen; the survival period governs how long the recipient's duties last afterward. A one-year term with a five-year survival means: we will exchange information for a year, and you must keep it confidential for five years after each disclosure. Spell out both.

The genuinely dangerous mistake is applying a single fixed cutoff to everything, including trade secrets. Survival periods of one to five years are typical and sensible for information that ages quickly, next quarter's pricing, this year's marketing plan. But a flat "obligations expire after five years" clause silently authorizes the recipient to use the disclosing party's crown-jewel trade secret, the formula, the source code, the algorithm, on a calendar date the parties forgot they set. Worse, that arbitrary cutoff is a gift to every future defendant: it lets them argue that the owner itself did not treat the information as a perpetual secret, undercutting the "reasonable measures" and even the existence of a trade secret in later litigation.

The fix is the two-tier survival clause: a fixed period for ordinary confidential information, plus a proviso that trade secret obligations run as long as the information qualifies as a trade secret under applicable law. This mirrors the substance of trade secret protection, which is potentially perpetual and endures precisely as long as secrecy is maintained. It costs one sentence.

Clause 9: The DTSA Whistleblower-Immunity Notice, the Clause Everyone Forgets

  • [ ] In every agreement that binds an individual (employee, contractor, consultant), include the notice of immunity under 18 U.S.C. § 1833(b), either set out in the text or incorporated by cross-reference to a policy document that contains it.
  • [ ] Confirm the notice is present in employee confidentiality and invention-assignment forms, not just standalone NDAs.

This is the provision most often missing from recycled forms, and the omission has teeth. The Defend Trade Secrets Act grants immunity to individuals who disclose a trade secret in confidence to a government official or attorney solely to report or investigate a suspected violation of law, or in a sealed court filing. 18 U.S.C. § 1833(b)(1)-(2). Congress then created a powerful incentive to tell employees about that immunity: an employer that fails to provide the required notice "in any contract or agreement with an employee that governs the use of a trade secret or other confidential information" cannot recover exemplary damages or attorney's fees against that employee in a DTSA action. § 1833(b)(3).

Read that consequence carefully, because it is the whole point. The DTSA authorizes exemplary damages of up to two times the actual damages for willful and malicious misappropriation, 18 U.S.C. § 1836(b)(3)(C), and attorney's fees for willful and malicious misappropriation, § 1836(b)(3)(D). Those are frequently the most valuable remedies in a misappropriation case. Omit the one-paragraph § 1833(b) notice from your NDA with an individual, and you forfeit both against that individual, no matter how egregious the theft. The notice costs nothing, changes no other term, and is almost never present in a form someone grabbed from a prior deal. Include it every time an individual signs. (The definition of "employee" for this purpose is broad and reaches contractors and consultants, so err toward inclusion.)

Because the same notice belongs in the invention-assignment paperwork individuals sign, coordinate the NDA with those agreements; see employee invention assignment agreements. For the full remedial architecture of the DTSA, including ex parte seizure under § 1836(b)(2), see trade secret law and what an IP case is worth.

Clause 10: Compelled Disclosure

  • [ ] Address the situation in which the recipient is legally compelled (subpoena, court order, regulatory demand) to disclose confidential information.
  • [ ] Require prompt notice to the disclosing party where lawful, so it can seek a protective order or move to quash.
  • [ ] Require cooperation at the disclosing party's expense in resisting or narrowing the demand.
  • [ ] Limit the recipient to disclosing only the portion legally required, and to seeking confidential treatment for it.
  • [ ] Clarify that a compliant compelled disclosure is not a breach.

Sooner or later a recipient gets a subpoena that sweeps in the discloser's information. Without a compelled-disclosure clause, the recipient faces a lose-lose bind: comply with the subpoena and risk breaching the NDA, or honor the NDA and risk contempt. The clause resolves the tension in the disclosing party's favor while protecting the recipient. The recipient tips off the disclosing party (where the law allows), cooperates in resisting or narrowing the demand, hands over only what it must, and asks the tribunal to keep the material under seal, and doing so is expressly not a breach.

Two refinements matter. First, the notice obligation should bend to reality: some legal processes (grand jury secrecy, certain regulatory demands) forbid the recipient from tipping off the disclosing party, so draft the notice duty as "to the extent legally permitted." Second, when the compelled material is genuinely sensitive, coordinate this clause with a protective order and, if privilege is implicated, a defensible log; see building a privilege log.

Clause 11: Return or Destruction of Materials

  • [ ] Require the recipient to return or destroy confidential information on the disclosing party's request or on termination or expiration.
  • [ ] Where destruction is permitted, require written certification (often by an officer).
  • [ ] Carve out retention required by law, professional standards, or routine automated backup, provided retained copies remain subject to the confidentiality obligations.
  • [ ] Consider requiring that any litigation-hold or evidentiary copies be held by outside counsel.

On termination, the disclosing party wants its information back or gone. Recipients usually prefer the destruction option, and for good reasons: returning everything is administratively painful for a company that signs many NDAs, and recipients often blend the discloser's information with their own analyses, so "return" would mean handing over the recipient's own work product. The standard compromise is destruction with written certification.

The realistic drafter also concedes what technology makes unavoidable. No recipient can truthfully certify that every trace is gone when email archives and automated, immutable backups exist. So permit retention of (a) copies buried in routine backup systems and (b) copies required by law or professional obligation, with the essential condition that anything retained stays subject to the confidentiality obligations for as long as it is kept. Recipients also legitimately want to retain a copy for evidentiary purposes if a dispute is brewing; disclosing parties often accept this but require that such copies be held by the recipient's outside attorneys to guard against misuse. A standardized destruction certificate keeps this clean and creates a paper record of compliance.

Clause 12: Remedies, Where the Agreement Earns Its Keep

  • [ ] Include an injunctive-relief acknowledgment: the parties agree that breach may cause irreparable harm for which monetary damages are inadequate, and that the disclosing party may seek equitable relief.
  • [ ] Consider language that equitable relief may be sought without proving actual monetary damages and, where appropriate, without posting a bond.
  • [ ] Add a cumulative-remedies clause preserving trade secret, statutory (DTSA/UTSA), and tort claims alongside the contract claim.
  • [ ] Use a liquidated-damages clause only where actual damages are genuinely hard to estimate and the stipulated sum is a reasonable pre-estimate, not a penalty.

Because money damages for a confidentiality breach are notoriously hard to prove and rarely adequate, once a secret is out, no check restores it, injunctive relief is the main event. The contractual acknowledgments in this clause speak directly to the equitable factors a court weighs. Under the modern standard, a party seeking a preliminary injunction must show likelihood of success, irreparable harm, a favorable balance of equities, and the public interest, Winter v. Natural Resources Defense Council, Inc., 555 U.S. 7 (2008), and courts no longer presume irreparable harm merely because a right has been infringed, eBay Inc. v. MercExchange, L.L.C., 547 U.S. 388 (2006). The Second Circuit applied that skepticism squarely to trade secrets in Faiveley Transport Malmo AB v. Wabtec Corp., 559 F.3d 110 (2d Cir. 2009), holding that irreparable harm is not automatically presumed once a trade secret is disclosed.

Understand what the acknowledgment clause can and cannot do against that backdrop. A stipulation that breach "will cause irreparable harm" does not bind the court's discretion, no contract can compel a judge to issue an injunction, but it removes an easy argument, frames the equities, and is persuasive evidence on the adequacy-of-damages question. Draft it, but do not oversell it to the client. The provision permitting relief without posting a bond is worth including because Federal Rule of Civil Procedure 65(c) otherwise conditions a preliminary injunction or TRO on security in an amount the court considers proper; a contractual waiver invites the court to dispense with or minimize the bond, though the court retains discretion.

The cumulative-remedies clause is the strategic partner to the § 1833(b) notice from Clause 9. Where the notice keeps the DTSA's exemplary damages and fees available, the cumulative-remedies clause keeps the contract from throwing them away by making clear that the NDA supplements, and does not supersede, the disclosing party's statutory and common-law claims. Together they preserve the full arsenal: contract damages, plus DTSA remedies (including up to double damages and fees for willful, malicious misappropriation), plus state UTSA claims. On measuring the money once liability is established, see what an IP case is worth.

A word on liquidated damages. It is tempting to fix a large per-breach sum, but a liquidated-damages clause is enforceable only if actual damages were difficult to estimate at contracting and the amount is a reasonable forecast of probable loss; a sum set as a threat to compel performance is an unenforceable penalty. Restatement (Second) of Contracts § 356. Because confidentiality damages are genuinely hard to quantify, the "difficult to estimate" prong is often satisfied, but a number that looks punitive will be struck, and the effort will have signaled bad faith. Use the clause sparingly and calibrate the figure to a real estimate of harm. For the doctrine, see contract damages.

Clause 13: Ownership, Warranties, No-Obligation, and Non-Solicitation

  • [ ] State that the disclosing party retains all intellectual property rights in its confidential information and that the agreement grants no license, express or implied.
  • [ ] Disclaim warranties on the accuracy or completeness of the disclosed information (the recipient evaluates at its own risk).
  • [ ] State that neither party is obligated to proceed with any transaction beyond the NDA itself.
  • [ ] If including a non-solicitation covenant, draft it narrowly, tied to a legitimate interest and reasonable in scope and duration, or risk unenforceability as a restraint of trade.

These general provisions prevent the NDA from doing more, or less, than intended. The IP-ownership and no-license clause forecloses the argument that handing over source code or a design during due diligence somehow conveyed rights in it; disclosure for evaluation is not a grant. The warranty disclaimer protects the disclosing party from a recipient who later claims it relied on incomplete or inaccurate information, appropriate because an NDA is an evaluation instrument, not a representation-backed deal document. The no-further-obligation clause makes explicit that signing an NDA commits neither side to the underlying transaction.

Non-solicitation deserves caution. NDAs sometimes bolt on a promise not to poach the other side's employees or customers. Such covenants are restraints on trade and are enforceable only when narrowly tailored to a legitimate protectable interest and reasonable in geography, scope, and time; drafted broadly, they are frequently struck. State law varies enormously, and the ground is shifting as regulators and legislatures scrutinize worker-mobility restrictions. If you include a non-solicit, keep it tight, and check the governing state's rules; see the future of non-competes. For where the NDA sits among the other agreements in a deal, consult the IP transactions toolkit and, on the buy-side of software paper, reviewing a software license agreement.

Clause 14: Governing Law, Forum, and Cross-Border Arbitration

  • [ ] Fix governing law, adding "without regard to its conflict-of-laws principles" so the chosen state's substance actually applies.
  • [ ] Fix jurisdiction and venue, or, for cross-border deals, an arbitration clause.
  • [ ] Confirm the chosen law will enforce the agreement's key provisions (survival duration, non-solicitation scope, injunctive relief), since state law varies.

State law diverges on the enforceability of exactly the provisions an NDA depends on, the permissible duration of confidentiality obligations, the scope of non-solicitation, the availability and terms of injunctive relief. The governing-law clause chooses the rules of the game, and the "without regard to conflict-of-laws principles" tag prevents the chosen state's choice-of-law doctrine from bouncing the dispute somewhere less favorable. Choose a law that will actually enforce what you drafted; a beautifully drafted perpetual survival clause is worthless under a law that caps confidentiality duties.

For cross-border relationships, an arbitration clause is often the better forum choice, because arbitral awards are enforceable across borders under the Convention on the Recognition and Enforcement of Foreign Arbitral Awards (New York Convention), June 10, 1958, 21 U.S.T. 2517, in a way that court judgments frequently are not. Weigh the tradeoffs, confidentiality of the proceeding, limited appellate review, cross-border enforceability, deliberately; see choosing a dispute-resolution forum and the arbitration and ADR toolkit. Where the information includes personal data crossing the EU border, the confidentiality regime must coordinate with transfer law; see moving personal data out of the EU after Schrems II.

The Technology Industry's Two Hard Problems

Everything above applies to any NDA. Technology deals add two provisions that routinely decide whether the agreement is worth anything, and both require genuine care rather than a form paragraph.

Residual Knowledge: the Clause That Can Swallow the Agreement

  • [ ] Treat any residual-knowledge (or "residuals") clause as a major concession, and negotiate it deliberately.
  • [ ] If granted at all, confine it to general knowledge, skills, and experience retained in unaided memory, and expressly exclude the specific technology, its parameters, methodology, and source code.
  • [ ] Control who sees the most sensitive material in the first place, so that little of value can be "retained in memory."

A residuals clause says the recipient may freely use "residual" information, ideas, know-how, or techniques retained in the unaided memory of its personnel, notwithstanding the rest of the NDA. Recipients, especially large technology companies whose engineers see many parties' confidential information, want this clause; it protects them from being contaminated by every disclosure. But a broad residuals clause can swallow the entire agreement, reducing a know-how NDA to one that protects only paper. If everything an engineer remembers is fair game, the NDA barely constrains the use that matters.

If the disclosing party must grant a residuals right to close the deal, cabin it hard. Limit it to general skills and experience, the kind of professional growth every engineer accumulates, and to what is genuinely retained in unaided memory (no notes, no exports). Then carve out, explicitly, the crown jewels: the specific architecture, the parameter values, the training methodology, the source code. And back the clause with practical control: if only two of the recipient's people ever see the most sensitive material, there is little for a residuals clause to reach. The clause and the access discipline work together, which is precisely the interplay covered in nondisclosure agreements for technology deals.

Reverse Engineering: Enforceable by Contract, but Watch the Interoperability Floor

  • [ ] Prohibit reverse engineering, decompilation, and disassembly of any disclosed software, firmware, or hardware.
  • [ ] Qualify the prohibition with "except to the extent such restriction is prohibited by applicable law," because some jurisdictions grant non-waivable rights to reverse-engineer for interoperability.
  • [ ] Understand the background rule: absent a contract, reverse engineering is a lawful means of acquiring information.

Start with the default the contract is overriding. Under trade secret law, reverse engineering is a fair and lawful means of discovering a secret; the Supreme Court said as much in Kewanee Oil Co. v. Bicron Corp., 416 U.S. 470 (1974), and the principle that the public may study and reverse-engineer unpatented articles runs through Bonito Boats, Inc. v. Thunder Craft Boats, Inc., 489 U.S. 141 (1989). Improper means, theft, bribery, aerial espionage, are a different matter, as E.I. duPont deNemours & Co. v. Christopher, 431 F.2d 1012 (5th Cir. 1970), memorably held, but honest reverse engineering is not misappropriation. That is exactly why the disclosing party needs a contractual prohibition: it forecloses conduct the law would otherwise permit.

Contract can do this. A party that agrees not to reverse-engineer is generally bound by that promise, even as to material that intellectual property law would leave free. The Federal Circuit enforced precisely such a contractual bar in Bowers v. Baystate Technologies, Inc., 320 F.3d 1317 (Fed. Cir. 2003), holding that a shrinkwrap prohibition on reverse engineering was enforceable and not preempted by the Copyright Act. The Seventh Circuit's reasoning in ProCD, Inc. v. Zeidenberg, 86 F.3d 1447 (7th Cir. 1996), points the same way: private contracts can restrict use of information that IP law itself would not protect, because a contract binds only its parties, not the world.

But the prohibition is not absolute everywhere, which is why the "except to the extent prohibited by applicable law" qualifier is not throat-clearing, it is load-bearing. United States copyright law recognizes that intermediate copying to reverse-engineer software for interoperability can be fair use, Sega Enterprises Ltd. v. Accolade, Inc., 977 F.2d 1510 (9th Cir. 1992); Sony Computer Entertainment, Inc. v. Connectix Corp., 203 F.3d 596 (9th Cir. 2000), and one court refused to enforce a state-law ban on decompilation that conflicted with the Copyright Act's own reverse-engineering allowance, Vault Corp. v. Quaid Software Ltd., 847 F.2d 255 (5th Cir. 1988). More pointedly for cross-border deals, the European Union's Software Directive grants a non-waivable right to decompile a program for the limited purpose of achieving interoperability, Directive 2009/24/EC, art. 6, and expressly voids contract terms that contradict it, art. 8. A flat, unqualified reverse-engineering ban is therefore unenforceable against a European counterparty exercising that right, and an unqualified clause can look overreaching even where it would otherwise hold. The qualifier keeps the clause enforceable where it can be and gracefully yields where it cannot.

For the wider picture of how contract interacts with the CFAA and copyright when someone accesses or extracts data they were told not to, see web scraping and the law after hiQ v. LinkedIn; for how these contractual layers fit the larger software-protection strategy, see how the law protects software and software license agreements.

Two Fast-Moving Traps: Export Control and Open Source

  • [ ] Add an export-control acknowledgment where disclosed technical data may be subject to the EAR or ITAR, so that sharing information with foreign persons does not become an unlicensed export.
  • [ ] Add an open-source provision requiring consent before the recipient combines disclosed confidential code with copyleft-licensed software that could trigger disclosure obligations.

Technical disclosures can implicate United States export controls: sharing controlled technical data with a foreign national, even inside the United States, can be a "deemed export" requiring authorization under the Export Administration Regulations or the International Traffic in Arms Regulations. A short acknowledgment that both parties will comply and will not disclose controlled data to persons who lack the necessary authorization keeps an NDA from quietly facilitating a violation. Separately, in software deals, guard against the recipient combining the disclosing party's confidential code with copyleft-licensed open source in a way that could obligate disclosure of the combined work; a consent requirement before any such combination protects the secret code from the licensing gravity of the open-source component. On that gravity, see open source licensing traps in enterprise software.

The Consolidated Drafting Checklist

Use this as a final pass before signature. Every unchecked box is a question to answer on purpose, not by omission.

  • [ ] Structure matches the real flow of information (unilateral, mutual, or reciprocal).
  • [ ] Parties and affiliates correctly identified as disclosers and recipients.
  • [ ] Purpose defined narrowly enough to anchor the non-use covenant.
  • [ ] Confidential information defined in layers (marking + oral-confirmation window + reasonable-person), keyed to this deal, reaching derivatives, and someone owns the confirmation habit.
  • [ ] Four standard exclusions present and intact.
  • [ ] Both a non-disclosure covenant and a distinct non-use covenant, with a reverse-engineering bar in tech deals.
  • [ ] Need-to-know / Representatives clause with recipient responsibility for its people.
  • [ ] Standard of care and, where warranted, specific security and breach-notification duties.
  • [ ] Term and survival separated, with a perpetual trade-secret proviso.
  • [ ] DTSA § 1833(b) whistleblower-immunity notice in every agreement binding an individual.
  • [ ] Compelled-disclosure clause (notice, cooperation, minimal disclosure, not a breach).
  • [ ] Return or destruction with certification and realistic backup/legal-hold carve-outs.
  • [ ] Remedies: injunctive-relief acknowledgment, no-bond language, and a cumulative-remedies clause; liquidated damages only if genuinely calibrated.
  • [ ] IP ownership / no license, warranty disclaimer, no-obligation, and any non-solicit narrowly drawn.
  • [ ] Governing law (with conflicts tag), forum or arbitration, chosen to enforce the key terms.
  • [ ] For technology: residuals cabined and carved out, reverse-engineering bar qualified, export-control and open-source traps addressed.

Common Failure Modes

The recurring ways NDAs fail are worth naming, because they are predictable and each maps to a clause above.

  • Half an NDA. A non-disclosure covenant with no non-use covenant. The recipient promises not to tell, remains free to use, and builds the competing product it was never going to talk about.
  • The silent trade-secret sunset. A single fixed survival period that, on a forgotten date, authorizes free use of the crown-jewel secret and hands future defendants an argument that the owner never treated it as perpetual.
  • The forfeited remedies. No § 1833(b) notice in an individual's agreement, quietly surrendering exemplary damages and attorney's fees under the DTSA.
  • Overreach that boomerangs. Deleting the standard exclusions or writing an all-encompassing definition to "capture more," and drawing a ruling that the whole definition is too broad to enforce, as in Lasership.
  • The marking mechanism no one runs. A definition that protects oral disclosures only if confirmed in writing within a window, paired with a team that never sends the confirmations, contracting the most valuable disclosures out of coverage, the Convolve trap.
  • The residuals clause that ate the agreement. A broad "unaided memory" carve-out that leaves a know-how NDA protecting only paper.
  • The unqualified reverse-engineering ban that is unenforceable against a counterparty exercising a non-waivable interoperability right, and that looks overreaching even where it might otherwise hold.

Primary Authority

Related UpLaw Resources

Related Guides

Related Articles

Related Checklists

Related Toolkits

This checklist is a research resource for general informational purposes only. It is not legal advice and does not create an attorney-client relationship. Contract and trade secret law vary by jurisdiction and continue to evolve. Consult qualified counsel to prepare or review a nondisclosure agreement for your specific transaction.