So I Just Need One Confidentiality Agreement Template, They’re All Just Forms, Right?

Wrong, and sometimes dangerously wrong from a legal and business perspective. There are many different types of confidentiality agreements, also known as non-disclosure agreements (NDAs), and choosing the right type (and the terms and conditions in them) is important for each transaction.

Mutual or Unilateral? A mutual NDA is used when both parties have information they want to keep confidential and they agree to keep each other’s information confidential. A unilateral NDA is used when one party has information they want to keep confidential but the NDA does not protect the other party’s confidential information.

Employee NDA. This type of NDA is used to protect a company’s confidential information and trade secrets from being disclosed by employees. It often contains other terms relating to intellectual property rights and other restrictive covenants.

Client NDA. A client NDA is used to protect the confidential information of a client from being disclosed by a service provider or consultant. Often, a client NDA is used as a preliminary agreement to enable discussions to see if the parties can agree upon the terms of a potential transaction. Then, the definitive agreement follows this preliminary NDA.

Research NDA. A research NDA is used to protect the confidentiality of research results, data, and other information obtained during the course of a research project. It is not often used in a stand-alone context and may be associated with other agreements relating to the research.

Development NDA. A development NDA is used to protect the confidentiality of product development plans, prototypes, and other information related to the development of a new product. In many cases, the party with the product will have conducted patent searches and filings prior to entering into development NDAs with a counterparty as a separate but important additional layer of protection.

Acquisition NDA. A M&A is used to protect the confidentiality of information related to a potential business acquisition or merger. It may be stand-alone early on in the due diligence process, and then carried forward and included or referenced in a letter of intent and finally, if the parties reach terms, it will also be contained in a stock purchase, asset sale or merger agreement.

Embedded NDA: This type of NDA is embedded as a set of provisions in another agreement – often a Master Services Agreement, Professional Services Agreement or other commercial agreement. It is meant to protect confidential information within the context of the activities occurring under the main agreement itself.

As you can see, there are different types of NDAs for different circumstances. Many will contain similar legal concepts, but these concepts are often deployed in significantly different ways. And some NDAs have terms and conditions that are common in one type of NDA, but that you would rarely see in another type of NDA.

Indeed, in some cases, certain terms in one type of NDA would violate the law if they were included in another type. Thus, care must be taken to ensure that you are using a NDA that is appropriate for the context in which it is being used.

Confidentiality agreements are often the first thing topic that comes up when parties want to start discussions with one another, and choosing an inappropriate form of NDA can get things off to a bad start and have a negative impact on the potential relationship.

What Are Some Of The Key Things A Confidentiality Agreement Might Address?

There are several important concepts that are typically included in a confidentiality agreement. Here are some you often see included:

Definition of Confidential Information. A NDA should clearly define what is considered confidential information, such as trade secrets, proprietary information, and other sensitive data. In addition, it is just as important to define what items are not included within the scope of confidential information, and you often see .

Purpose of the NDA. A NDA often expressly states the purpose for which the confidential information is being shared as it sets the context for the NDA, which can be important if the NDA needs to be enforced.

Duration of the NDA. The NDA should state the length of time that the recipient is required to maintain the confidentiality of the information, which can vary from a number of years to perpetual when it comes to specified items such as trade secrets.

Disclosure/Permitted Disclosures. The NDA should have terms and conditions addressing any circumstances under which the recipient is permitted to disclose confidential information, such as when required by law or when necessary to protect their legal rights. In addition, the NDA should specify to whom a party is able to disclose the confidential information and subject to what terms. In some cases, NDAs are drafted so broadly that a recipient can disclose a disclosing party’s confidential information far and wide, and even to parties not bound by the agreement. These provisions must be tailored – and additional protections added – if a wide scope of permitted disclosure is contemplated.

Maintenance Obligations. The NDA should include the obligations of the recipient in regard to maintaining the confidentiality of the information, including any required safeguards or measures to prevent unauthorized disclosure. This is sometimes tied to a degree of care, but not less than a reasonable degree of care, but stronger terms and conditions are often included depending on the facts and circumstances and involved and the information that will be disclossed.

Return or Destruction of Confidential Information. A NDA often contains triggers relating to the return or destruction of the confidential information once the NDA has expired or been terminated, or after discussions have ended.

Ownership of Confidential Information. A NDA may specify the ownership of the confidential information and any rights or licenses granted to the recipient in regard to its use. Typically NDAs state that no intellectual property licenses are being granted in connection with the NDA, but this differs in active commercial agreements like Master Services Agreements and Professional Services Agreements where access to intellectual property may be needed and where the parameters must be spelled out.

Relationships and Restrictive Covenants. The NDA may include provisions related to the recipient’s relationships with the disclosing party, such as non-solicitation provisions to protect an organization’s business and staff from poaching.

Remedies: The NDA should provide for multiple avenues of relief – both monetary damages and equitable relief. When a confidentiality agreement is breached, the first step is often to stop the bleeding. Monetary damages are the typical remedy under most contracts, but when someone runs off with your secret sauce, you will be heading to Court to ask a Judge to also grant you equitable relief – injunctions or orders of specific performance to try to stop the breaching party from further use or disclosure of your confidential information in breach of the NDA. Specific language is used in NDA to indicate that the parties agree to this type of relief, often with other terms to make it easier for equitable relief to be ordered.

These are just examples of concepts you will find in confidentiality agreements, but their deployment and the language used can vary significantly depending on the context.

What About Third Party Confidential Information?

An organization typically accesses, uses and holds a significant amount of confidential information of third parties. For example, a business may hold significant confidential information about its own customers, vendors, and contractors that it is required to keep confidential by express confidentiality and non-disclosure provisions in its commercial agreements.

Some of this information may be subject to laws governing personally identifiable information (PII) or personal health information (PHI), and additional provisions may be needed to address the related compliance issues.

When contracting, organizations have to keep in mind what confidential information it has that needs to be protected – whether its own or that of third parties – or more often than not, both. In some cases, the terms and conditions of a commercial agreement require that any further sharing of confidential information, such as by a contractor with its subcontractor, is only permitted subject to specific contractual requirements.

What About The Defend Trade Secrets Act (DTSA)?

The Defend Trade Secrets Act (DTSA) is a federal law in the United States that provides a private cause of action for trade secret misappropriation. The DTSA allows individuals or businesses to file a lawsuit in federal court to protect their trade secrets and seek damages for any misappropriation.

The DTSA provides a range of remedies for trade secret misappropriation, including injunctive relief to prevent further disclosure or use of the trade secret, damages for actual loss and any unjust enrichment caused by the misappropriation, and attorney’s fees in certain circumstances. The DTSA also includes provisions for ex parte seizure orders, which allow a court to order the seizure of any property necessary to prevent the dissemination of a trade secret, in exceptional circumstances.

The DTSA includes a notice requirement for employers that wish to take advantage of the immunity provisions for reporting a suspected violation of the DTSA. The DTSA provides immunity for individuals who report a suspected violation of the DTSA to their employer or to a federal official, as long as the individual acts in good faith and has a reasonable belief that the information reported relates to a violation of the DTSA.

To take advantage of this immunity, an employer must provide notice of the immunity provisions to its employees, contractors, and agents in any contract or agreement that governs the use of a trade secret or other confidential information. This notice can be provided through a variety of means as specified in the DTSA.

Data Security Requirements in NDAs

NDAs often have specific security requirements tied to how confidential information should be protected, maintained and stored. In some NDAs this may be tied to detailed requirements and examples, especially with embedded NDAs in commercial agreements such as Master Services Agreements or Professional Services Agreements where sensitive data, PII and PHI are involved, or where laws and regulations impose specific requirements.

Other simpler NDAs may have a requirement that the recipient treat the confidential information with the same degree of care that they use to protect their own confidential information of a similar nature, but in no event less than a reasonable degree of care.

We Have A NDA In Place, So We Can Disclose Our Secret Sauce, Right?

In short, no. Even with a NDA in place, most organizations do not disclose their most sensitive information to third parties. A NDA is a contract that must be enforced, and only disclosing what needs to be disclosed is considered by most to be a best practice in not having to get involved in expensive litigation over a breached NDA. NDAs are like other contracts, and if they are breached the party suffering damages often must sue to obtain equitable relief and monetary damages.

Litigation is expensive and time-consuming, and not disclosing your most sensitive information is a good way to manage risk. By not disclosing sensitive information, and limiting disclosures to what is needed to continue discussions and services, a party to a NDA can limit serious damage should a breach occur. Some NDAs will contain an attorneys’ fees provision (i.e., permitting a party to collect attorneys’ fees in the event of a breach), but not all do. Like all commercial agreements, many parties do not want to expose themselves to attorneys’ fees which can often exceed the amount of damages.

However, as is the rule generally with limited exceptions, not including an attorneys’ fees provision may mean that you cannot collect the amounts you pay your attorney to enforce the NDA. While certain statutes and court rules may provide for the possibility of collecting attorneys’ fees, the safest way to ensure you will be able to collect them is to include an appropriate provision in your NDA. With mutual NDAs, this typically means exposing yourself to attorneys’ fees as well should you breach the NDA, which is why some parties to NDAs make the decision to include an attorneys’ fee provision on a case by case basis (and often only when they feel they will benefit).

The flip side of this issue is whether or not you are comfortable receiving certain confidential information from the disclosing party. In many situations, it is wise not to have certain types of another party’s confidential information in your possession as it becomes vulnerable to third parties who may try to access it. Further, receiving confidential information from a third party can also raise the risk of claims between the parties, especially where confidential information could be exchanged that both parties believe they own. This issue is often addressed through exceptions to the definition of Confidential Information, but claims can still arise regardless of this language.

What Else Can I Do To Decrease Confidentiality Risks?

Organizations should not rely solely on contracts to manage risk. Instead, they should employ a multi-pronged approach to confidentiality risks. These can include:

Know Thine Counterparty. As noted above, in some cases the risk of exchanging confidential information with certain counterparties may be too great. For example, many companies refuse to disclose any confidential information to competitors, whether or not a NDA is in place. This may make business sense in many instances, but is not practical if a business is being sold to a competitor. In that case, special protections must be employed to manage the risks involved.

Obtain Insurance. There is a wide variety of insurance that may cover risks associated with confidential information, and it is far more extensive and cost-effective than in years past. Certain carriers now have whole teams dedicated to managing, responding to, and handling data-related claims, ransomware attacks, and other incidents that affect confidential information. As with all types of insurance, not all policies are created equal, so it is important to work with an experienced broker or insurance advisor who understands your business and the risks involved. And remember, not all risks are caused by third-party actors. Many data breaches and other technology attacks are caused by insiders or recently departed personnel, sometimes negligently and sometimes intentionally.

Security Hardening. Your organization’s security posture should not rest solely on contractual documents such as NDAs. A specific set of plans and policies should be implemented that cover administrative, technical, and procedural safeguards designed to decrease risk to data and other confidential information. If you do not have an IT team in place that is actively managing these risks, there are plenty of well-qualified specialty managed services providers and security-as-a-service companies that can assist your organization.

Shared by Geoffrey G. Gussis, Esq., a business lawyer and technology lawyer licensed in New Jersey and New York. Learn more about me, the legal services I provide, and articles I have written. Contact: geoff@gussislaw.com or (732) 898-0549 or (646) 389-2946 for a free consultation.
The materials available at or through this website are for informational purposes only and do not constitute legal advice. You should contact a licensed attorney in your jurisdiction to obtain advice with respect to any particular issue or problem. Use of and access to this website, or any of the information or links contained within the website, does not create an attorney-client relationship.
Share with your friends and colleagues!
X Facebook LinkedIn Email Buffer