What Is an NDA? A Plain-English Guide to Non-Disclosure Agreements

A non-disclosure agreement (NDA) is a contract where one or both parties promise to keep certain information secret and use it only for an agreed purpose. It turns "please keep this quiet" into a legal obligation you can enforce in court. That is the whole idea.

The catch is that most NDAs are copy-pasted from a template nobody reads. Some of those are toothless. Others are so broad a judge would not enforce them. The strength of an NDA lives in two places: how it defines the confidential information, and whether its limits are reasonable.

This is general information for US in-house teams, not legal advice for a specific deal.

TL;DR

• An NDA is a contract that legally binds a party to keep specified information confidential and use it only for a stated purpose. It is the same thing most people call a confidentiality agreement.
• One-way (unilateral) NDAs protect one side's information. Mutual NDAs protect both. Pick the one that matches who is actually sharing secrets.
• The terms that decide everything: the definition of Confidential Information, the exclusions, the permitted use, the term and survival period, return or destruction, and the remedies.
• Yes, NDAs are enforceable when the scope, the definition, and the duration are reasonable. Overbroad, vague, or perpetual ones (for ordinary information) invite a court to narrow or strike them.
• An NDA's confidentiality can outlive the deal. Ordinary secrets get a fixed survival period. Trade secrets can be protected for as long as they stay secret, potentially forever.
• An NDA is not a non-compete. An NDA protects information; a non-compete restricts where someone can work. The two are governed by different rules.

If you handle inbound NDAs at volume, we cover the tooling side separately in guides on AI NDA triage and building an NDA playbook an AI can enforce. This post is the definitional one: what an NDA is, what its parts do, and whether it holds up.

What an NDA is and what it protects

An NDA (also called a confidentiality agreement or CA) is a legally binding contract. One party discloses information. The other party, the recipient, agrees not to share it and to use it only for the agreed purpose. If the recipient leaks or misuses it, the disclosing party can sue for breach.

The reason NDAs exist is timing. You often have to share sensitive information before a deal is signed. A startup pitching an investor, a vendor scoping a build, two companies exploring a merger: all of them need to show their cards early. Cornell's Legal Information Institute describes an NDA as a contract that protects confidential information shared between parties, so business can happen before trust is fully established.

What an NDA typically covers: product plans, source code, financials, customer lists, pricing, business strategy, and trade secrets. What it does not cover is anything the agreement itself excludes, which is where the exclusions clause earns its place. More on that below.

Mutual vs one-way NDAs

There are two shapes, and the difference is simply who is bound.

A one-way NDA (also called a unilateral NDA) protects one party's information. Only the recipient has confidentiality obligations. You use this when the flow of secrets runs one direction: hiring a contractor, onboarding an employee, or pitching your idea to someone who is not sharing anything sensitive back.

A mutual NDA (bilateral or two-way) protects both parties, because both are disclosing. Each side is both a discloser and a recipient. This fits a partnership discussion, a potential acquisition, or a joint venture where both companies open their books.

The practical tell: figure out who is actually sharing secrets. If it is genuinely one direction, a one-way NDA is cleaner and easier to negotiate. If both sides are exposed, a mutual NDA is fairer and usually signs faster, because neither party is asking the other to accept a burden it will not carry itself.

The key terms that actually matter

Most of an NDA is boilerplate. A handful of clauses decide whether it protects you or falls apart. Read these before you sign anything.

• Definition of Confidential Information. The single most important clause. It sets the boundary of what is protected. Too narrow and real secrets leak through the gaps. Too broad ("all information disclosed") and a court may find it unreasonable and refuse to enforce it. Good definitions are specific about categories and often require a marking or a written follow-up for oral disclosures.
• Exclusions from confidentiality. Standard carve-outs that keep the definition honest. Information is usually not confidential if it is already public, was already known to the recipient, is independently developed without using the disclosed material, comes lawfully from a third party, or must be disclosed by law or court order. These are not loopholes. They are what makes the agreement enforceable and balanced.
• Permitted use. What the recipient is allowed to do with the information, and only that. "Solely to evaluate a potential transaction between the parties" is a typical purpose limit. Use outside that purpose is a breach even if nothing is disclosed.
• Term and survival. How long the agreement runs, and how long the confidentiality duty lasts after it ends. These are two different clocks. We break them apart in the next section.
• Return or destruction. On request or at the end, the recipient returns or destroys the confidential material and certifies they did. This limits how long your secrets sit on someone else's servers.
• Remedies. What the disclosing party gets on a breach. Money damages are hard to prove for leaked information, so NDAs almost always allow injunctive relief (a court order to stop), and some add attorney fees to the winner.

If you want the clause-level detail, our reference page on the confidentiality clause walks through the standard language and the negotiable positions.

What actually gets negotiated

The definition and exclusions are where the template stops and the deal starts. When an NDA comes back redlined at the last minute before a data room opens, these are the points in-house counsel push on:

• Residuals. A residuals clause lets the recipient use general know-how retained in memory, not written notes. Disclosers dislike it; large vendors and investors often insist on it. Whether it survives, and how narrowly it is worded, is frequently the entire negotiation.
• Compelled-disclosure notice. If a subpoena or regulator forces disclosure, the recipient should give prompt notice so the discloser can seek a protective order, unless giving notice is itself unlawful. Watch for drafts that quietly drop the notice duty.
• Affiliates and representatives. Ask who actually counts as the recipient. Employees only, or advisors, affiliates, and potential co-investors too? Every name added is another set of hands your secret passes through.
• No license. A good NDA states that disclosing information grants no license or ownership in it. Without that line, a recipient can argue the disclosure implied permission to use.
• Oral disclosures. If the definition only protects information marked confidential, a purely spoken secret can fall outside it. The fix is a clause requiring written confirmation of oral disclosures within a set window.

Are NDAs enforceable?

Yes. A properly drafted NDA is a binding contract and courts enforce it like any other. But "properly drafted" is doing real work in that sentence. Enforceability is not automatic, and the copy-pasted ones fail more often than people expect.

Courts apply a reasonableness test. They look at how broadly the agreement defines confidential information, how long the restriction lasts, and how heavy a burden it puts on the recipient, weighed against the discloser's legitimate interest in secrecy. The Association of Corporate Counsel's overview of issues enforcing nondisclosure agreements in the US is a useful practitioner reference on where these agreements run into trouble.

What makes an NDA unenforceable or gets it narrowed:

• An overbroad definition. "All information of any kind" with no limit reads as a restraint with no real boundary. Courts dislike it.
• No reasonable time limit on ordinary (non-trade-secret) information. A perpetual gag on routine business information often draws scrutiny.
• Missing consideration. Like any contract, an NDA needs something exchanged. For a new employee the job itself works; for an existing one, some states want fresh consideration.
• Public-policy conflicts. Terms that try to silence someone from reporting illegal conduct can be void. Under the federal Speak Out Act of 2022, a pre-dispute NDA is not enforceable to the extent it covers a sexual assault or sexual harassment dispute.

When a term is too broad, some courts use the blue pencil doctrine: they strike the offending words and enforce what is left, if the rest still stands on its own. Other courts will rewrite an overbroad term to a reasonable version. And some throw out the whole clause. You do not get to choose which, so it is safer to draft it reasonably from the start.

One more public-policy limit worth knowing: an NDA cannot lawfully gag protected reporting. It cannot stop an employee from reporting possible securities violations to the SEC, which SEC Rule 21F-17 bars any agreement from impeding. And under the Defend Trade Secrets Act, a whistleblower has immunity for confidential disclosure of a trade secret made to the government, or in a sealed court filing, to report a suspected legal violation. Drafting around those protections does not remove them, and a clause that tries can taint the rest of the agreement.

Weak vs strong: the definition clause in practice

Two definitions of Confidential Information, same deal:

Weak:   "Confidential Information means all information disclosed by either
         party, in any form, at any time."

Strong: "Confidential Information means non-public information the Discloser
         marks as confidential, or that a reasonable person would understand
         to be confidential given its nature and the circumstances of
         disclosure, including product roadmaps, source code, pricing,
         customer lists, and financial data."

The weak version tries to protect everything, which is why a court may enforce none of it: with no boundary, the recipient cannot tell what is off-limits, and the clause reads as an unreasonable restraint. The strong version draws a line a judge can apply. That is the practical drafting rule for the whole agreement: broad enough to catch the unmarked deal information that matters, tight enough that the recipient can actually tell what is prohibited.

How long does an NDA last?

This is where two clocks get confused. An NDA has a term and a survival period, and they are not the same.

The term is how long the agreement is active, the window during which new disclosures are covered. Often one to three years for a commercial NDA, sometimes tied to the length of a project or relationship.

The survival period is how long the confidentiality duty continues after the term ends. Read where the clock starts, because the same two numbers behave differently depending on the base date. If survival runs "for five years after termination" (the common default), a two-year term plus a five-year survival can protect information for up to seven years: the two active years, then five more. If it runs "for five years from the date of disclosure," each item is protected for five years from when it was shared, and no longer. The survival clause is what actually keeps your secrets safe after the deal is done or dead, so the base date is not a line to skim.

Then there is a special case: trade secrets. Under the federal Defend Trade Secrets Act and the state Uniform Trade Secrets Act, a trade secret is protected for as long as it stays secret and keeps its value, which can be indefinite. Because of that, well-drafted NDAs often split the clock:

• Ordinary confidential information gets a fixed survival period (say, three or five years).
• Trade secrets stay protected for as long as they remain trade secrets under the law.

There is a real trap here. If you put a short expiration on everything, including trade secrets, you may be telling a court you did not make reasonable efforts to keep the trade secret confidential. That can strip its trade-secret status entirely. So a blanket "this NDA expires in two years" is not always the safe, tidy choice it looks like.

NDA vs confidentiality agreement

There is no legal difference. A non-disclosure agreement and a confidentiality agreement are the same instrument under two names. You will also see confidentiality agreement (CA), confidential disclosure agreement (CDA), and proprietary information agreement. They all do the same job: bind someone to keep information secret.

If anyone tells you a "confidentiality agreement" is stronger or weaker than an "NDA," they are reading the label, not the clauses. What matters is the definition, the exclusions, the survival period, and the remedies inside the document, not which of the interchangeable names sits on the cover page. We take the comparison apart in NDA vs confidentiality agreement.

NDA vs non-compete

This is the comparison people get wrong most often, and the difference is not subtle.

An NDA protects information. It says: do not share or misuse our secrets. A non-compete restricts activity. It says: do not work for a competitor or start a competing business for a set time in a set area. One guards knowledge. The other limits where a person can earn a living.

They also live in very different legal worlds. NDAs are broadly enforceable across the country. Non-competes are not. The FTC's 2024 rule that would have banned most non-competes nationwide was struck down by a federal court in Ryan LLC v. FTC, and in September 2025 the FTC voted to drop its appeal and accede to vacatur of the non-compete rule. So there is no federal ban. Non-competes are governed by state law, and it swings hard: California voids nearly all of them, while other states enforce reasonable ones. Our non-compete clause reference covers the state-by-state picture.

The takeaway: if your goal is protecting information, use an NDA. It travels well and holds up. If your goal is stopping someone from competing, you are in non-compete territory, and you need to check the law of the specific state. If you are weighing which restrictive covenant you actually need, we compare all three in NDA vs non-compete vs non-solicit.

When you need an NDA

Reach for an NDA before you disclose anything sensitive to someone outside the circle that already has to keep it quiet. Common triggers:

• Sharing product, financial, or strategic details with an investor, buyer, or partner during early talks.
• Hiring a contractor, vendor, or freelancer who will touch confidential systems, data, or plans.
• Onboarding an employee who will have access to trade secrets or proprietary methods.
• Exploring a deal, merger, or joint venture where both sides open the books (use a mutual NDA here).
• Beta testing or demoing something not yet public.

You do not need one for information that is already public, or where no genuinely sensitive information changes hands. An NDA on a routine, public conversation is friction with no benefit, and asking for one where none is warranted can slow a deal and signal inexperience.

A quick NDA review checklist

Before you sign or send one, run these:

• Right shape. One-way if secrets flow one direction, mutual if both sides disclose.
• Definition of Confidential Information is specific, not "everything." Oral disclosures are addressed.
• Exclusions include public, already-known, independently developed, third-party, and required-by-law carve-outs.
• Permitted use is tied to a specific purpose.
• Term and survival are separate, and trade secrets are protected for as long as they stay secret.
• Return or destruction obligation on request or termination.
• Remedies include injunctive relief, since money damages alone rarely fit leaked information.
• Governing law and venue are named, and you are comfortable with them.
• Nothing tries to bar lawful reporting of illegal conduct.

For the drafting mechanics behind these clauses, our guide on how to draft a contract covers the structure that applies to NDAs and everything else.

The verdict

An NDA is a simple idea with a lot riding on the details. It makes confidentiality a legal duty, in one direction or both, for a period you set. It is enforceable when it is reasonable and clear, and shaky when it is vague or overbroad. It protects ordinary secrets for a fixed window and trade secrets for as long as they stay secret. And it is a different animal from a non-compete, which restricts work, not information.

The non-obvious part: an NDA is only as strong as its definition of Confidential Information and its reasonableness. The boilerplate ones people copy without reading tend to be either toothless (a definition too narrow to catch the real secret) or unenforceable (a definition so broad a court will not back it). The fix is not a longer template. It is reading the two or three clauses that decide the outcome and matching them to the deal in front of you.

If your team reviews inbound NDAs at any volume, the bottleneck is usually reading time, not drafting. Vaquill AI helps in-house teams review, redline, and track those agreements against a consistent standard in one place. You can try it free.

FAQ

Are NDAs enforceable?

Yes. A well-drafted NDA is a binding contract and courts enforce it. Enforceability depends on reasonableness: the definition of confidential information, the duration, and the burden on the recipient all have to be reasonable. Overbroad, vague, or perpetual terms (for ordinary information) can get an NDA narrowed or struck down.

How long does an NDA last?

It depends on two clocks. The term is how long the agreement is active. The survival period is how long the confidentiality duty continues after the term ends, often three to five years for ordinary information. Trade secrets can be protected for as long as they remain secret, which may be indefinite.

Is an NDA the same as a confidentiality agreement?

Yes. A non-disclosure agreement and a confidentiality agreement are the same thing under different names. You will also see confidential disclosure agreement (CDA) and proprietary information agreement. The name does not change the legal effect; the clauses inside do.

What is the difference between a mutual and a one-way NDA?

A one-way (unilateral) NDA binds only the recipient, used when secrets flow in one direction. A mutual NDA binds both parties, used when both sides disclose sensitive information. Choose based on who is actually sharing secrets.

What is the difference between an NDA and a non-compete?

An NDA protects information; a non-compete restricts where someone can work. NDAs are broadly enforceable across the US when reasonable. Non-competes are governed by state law, banned in some states like California, and there is no federal ban after the FTC's rule was vacated in 2025.

What makes an NDA unenforceable?

Common failure points are an overbroad or vague definition of confidential information, no reasonable time limit on ordinary information, missing consideration, and terms that conflict with public policy. Under the federal Speak Out Act, a pre-dispute NDA is not enforceable to the extent it covers a sexual harassment or assault dispute.

Do I always need an NDA before sharing information?

No. You need one before disclosing genuinely sensitive information to someone outside the circle already bound to keep it quiet. You do not need one for information that is already public or where nothing sensitive changes hands. Asking for an NDA where none is warranted can slow a deal.

Can an NDA last forever?

For ordinary confidential information, a perpetual obligation often draws scrutiny and may be found unreasonable. For trade secrets, an indefinite obligation is appropriate, because trade-secret protection lasts as long as the information stays secret. Well-drafted NDAs treat the two categories differently.

Last updated: July 2026.

Arshita Anand

Co-Founder & CEO · Attorney

Arshita leads product and strategy at Vaquill, building the legal AI suite that solo, small-firm, and in-house US lawyers use to run a matter end to end.