Confidentiality Clause: Definition, Exclusions, Term, and the Residuals Trap

A confidentiality clause controls who can see your sensitive information and what they can do with it. It defines what counts as Confidential Information, lists the standard exclusions that fall outside that definition, sets how long the duty to protect lasts, and limits use to the deal at hand. The fights worth having are over the definition, the survival term, and a quiet provision called a residuals clause that can let the other side keep using what they remember.

TL;DR

• A confidentiality clause has four moving parts: the definition of Confidential Information, the exclusions, the use and disclosure restrictions, and the term. Negotiate each separately.
• The five standard exclusions (already known, publicly available, independently developed, received from a third party, compelled by law) are non-negotiable in principle. The fight is over how each is drafted and proven.
• Trade secrets should be protected for as long as they stay secret, not for a fixed two- or three-year term. A flat sunset on everything can extinguish trade-secret protection you would otherwise keep forever.
• The residuals clause is the most dangerous thing in a one-way NDA you sign as the discloser. It lets the recipient freely use anything its people remember "without reference to" your documents, which can swallow the whole agreement.
• Read the confidentiality clause with the survival, IP, and data protection clauses. Confidentiality protects secrecy; it does not assign ownership or cover regulated personal data.

What a confidentiality clause actually does

The clause builds a fence around information and tells the recipient what they may and may not do with it. Four mechanics do the work.

1. The definition. This says what is protected. Broad definitions cover "all information disclosed, in any form, whether or not marked." Narrow ones cover only material marked "Confidential" or identified as such within a set number of days. Broad protects the discloser; narrow protects the recipient.

2. The exclusions. These carve information back out of the definition: anything already public, already known to the recipient, independently developed, or rightfully received from someone else. Without them, the recipient is on the hook for information they were free to use anyway.

3. The use and disclosure restrictions. The recipient may use the information only for the defined Purpose, must protect it with at least reasonable care, and may share it only with people who need to know and are bound by similar duties. The Purpose definition is the leash; a vague Purpose is a long one.

4. The term. How long the duty lasts after the information is disclosed or the agreement ends. This is where trade secrets and ordinary confidential information should be treated differently.

Why it matters: the dollars at stake

Picture a manufacturer (call it the discloser) that shares a proprietary process spec with a contract supplier under a mutual NDA. The NDA has a flat three-year confidentiality term and a residuals clause.

Two years later the supplier starts making a competing product using the same process. Here is the example math on what the NDA is worth in each version.

• With a flat three-year term that covers everything, the process spec stops being protected by the contract once the term runs, even though it is still a live trade secret. The discloser is left arguing trade-secret law with no contractual backstop.
• With a trade-secret carve-out ("for trade secrets, until they cease to be trade secrets"), the duty survives indefinitely and the discloser can sue on the contract for breach years later.
• Add a residuals clause, and the supplier argues its engineers used only what they remembered, not your documents, so no breach at all.

Same NDA, same leak. The difference between a recoverable breach and an unenforceable one comes down to two clauses most people skim. That is why in-house counsel read the term and the residuals language line by line.

Who wants what

The pattern: the discloser wants a wide net that lasts, and the recipient wants a narrow, time-limited duty with an escape hatch for what its people learn.

Market-standard language

A typical mutual confidentiality clause for a commercial agreement reads close to this:

CONFIDENTIALITY.

(a) Definition. "Confidential Information" means non-public information
disclosed by one party (the "Discloser") to the other (the "Recipient"),
whether oral, written, or electronic, that is marked confidential or that
a reasonable person would understand to be confidential given the nature
of the information and the circumstances of disclosure.

(b) Exclusions. Confidential Information does not include information that:
(i) is or becomes public through no fault of the Recipient; (ii) was
rightfully known to the Recipient without a duty of confidentiality before
disclosure; (iii) is independently developed by the Recipient without use
of the Confidential Information; or (iv) is rightfully received from a
third party without a duty of confidentiality.

(c) Obligations. The Recipient will (i) use the Confidential Information
only to perform under this Agreement (the "Purpose"); (ii) protect it with
at least the degree of care it uses for its own confidential information,
and in no event less than reasonable care; and (iii) disclose it only to
its personnel and advisors who need to know it for the Purpose and who are
bound by confidentiality duties at least as protective as these.

(d) Compelled Disclosure. The Recipient may disclose Confidential
Information to the extent required by law or court order, provided it gives
the Discloser prompt notice (where legally permitted) and cooperates in
seeking protective treatment.

(e) Term. The obligations in this Section survive for three (3) years after
disclosure, except that for Confidential Information that constitutes a
trade secret, the obligations continue for as long as the information
remains a trade secret under applicable law.

Note subsection (e). The split term is the single most important drafting choice in the clause: a flat term for ordinary confidential information, indefinite protection for trade secrets.

The negotiation: standard, fallback, walk-away

Treat the definition, the term, and the residuals separately.

The trade-secret carve-out is the workhorse compromise. The recipient gets its short, clean sunset for routine information, and the discloser keeps indefinite protection for the handful of things that actually qualify as trade secrets.

Review a contract in VaquillBook a demo

Common carve-outs and variations

The high-frequency variations that change how the clause behaves:

• Marking requirements. A recipient-friendly clause protects only information marked "Confidential," with a window (often 30 days) to confirm oral disclosures in writing. Miss the window and the information is unprotected.
• One-way versus mutual. If only one side discloses, use a one-way NDA. If both will share, make it mutual so the obligations and exclusions run symmetrically.
• Affiliates and advisors. The recipient usually wants to share with affiliates, lawyers, accountants, and financing sources. Fine, as long as each is bound by equivalent duties and the recipient stays liable for their breaches.
• Residuals. A residuals clause lets the recipient use general knowledge, ideas, and know-how retained in the unaided memory of its people. It is common in NDAs from large technology companies and it is the biggest trap for a discloser.

A narrow, discloser-protective residuals fallback looks like this:

Nothing in this Agreement grants the Recipient any license to use the
Discloser's Confidential Information beyond the Purpose. The Recipient
acquires no rights in any Confidential Information that constitutes a trade
secret or that is embodied in the Discloser's intellectual property,
whether or not retained in the memory of the Recipient's personnel.

Jurisdiction and enforceability notes

Confidentiality clauses are routinely enforced between businesses, but a few principles govern whether yours holds up:

• Trade-secret protection requires reasonable secrecy measures. Both the federal Defend Trade Secrets Act and state versions of the Uniform Trade Secrets Act protect a trade secret only if the owner took reasonable steps to keep it secret. A loose NDA, or sharing without one, can sink the trade-secret claim itself.
• Indefinite duties for ordinary information can be questioned. Courts are comfortable with indefinite protection for true trade secrets but may view a perpetual duty over ordinary, non-secret information as an unreasonable restraint. The split term avoids this.
• Overbroad definitions invite a reasonableness challenge. A definition so wide it covers public or trivial information can weaken enforcement. Keep the exclusions clean.
• Compelled disclosure cannot be contracted away. A subpoena or court order overrides the clause. Standard practice is notice and cooperation, not a promise to refuse.
• State law varies on enforceability of NDAs that touch employment. Some states restrict NDAs that cover wages, harassment, or discrimination claims. Confirm against the controlling state before relying on broad employee-facing language.

This is general information, not legal advice for a specific deal. Enforceability turns on the governing law and the facts, so confirm against the controlling state's law. For state-by-state specifics, see our NDA enforceability by state guide and the trade secrets enforceability by state guide.

Review checklist: red flags to catch

• The term sunsets everything, including trade secrets, on a fixed date.
• A residuals clause that lets the recipient use what its people remember, with no carve-out for trade secrets or your IP.
• The definition requires marking but there is no cure window for oral or visual disclosures.
• The Purpose is vague ("evaluating a potential relationship"), giving the recipient broad license to use the information.
• No obligation to return or destroy information on termination.
• The clause is one-way against you when the deal involves mutual disclosure.
• No injunctive-relief acknowledgment, leaving you to prove irreparable harm from scratch.
• The recipient can share with affiliates and contractors but is not made liable for their breaches.

How it interacts with other clauses

The confidentiality clause does not stand alone. Read it together with:

• Survival: the survival clause is what keeps the confidentiality duty alive after termination; confirm the trade-secret carve-out is not capped by a general survival period.
• Intellectual property: confidentiality protects secrecy but assigns no ownership. Sharing information is not transferring rights in it.
• Data protection: if the confidential information includes personal data, a separate data protection clause or DPA governs how it is processed and secured.
• Non-solicitation: the two often travel together to protect against a counterparty poaching staff who learned your confidential information.

For the broader workflow, see the in-house contract review playbook and our NDA playbook and template.

FAQ

What is a confidentiality clause? It is a contract provision that protects sensitive information. It defines what counts as Confidential Information, lists exclusions that fall outside that definition, limits how the recipient may use and disclose it, and sets how long the duty to protect lasts.

How long should a confidentiality obligation last? Use a split term. For ordinary confidential information, two to five years after disclosure is market standard. For trade secrets, the duty should last as long as the information stays a trade secret, which can be indefinite. A flat term that sunsets everything can extinguish trade-secret protection.

What are the standard exclusions in a confidentiality clause? Five: information that is or becomes public through no fault of the recipient, was already rightfully known to the recipient, is independently developed without using the confidential information, is rightfully received from a third party, or is required to be disclosed by law. These keep the recipient from being liable for information it was free to use.

What is a residuals clause and why is it dangerous? A residuals clause lets the recipient use ideas, know-how, and information retained in the unaided memory of its people, without reference to your documents. Drafted broadly it can let the other side use what your information taught them while claiming no breach. If you are the discloser, strike it or carve out trade secrets and any license to your IP.

Is an NDA the same as a confidentiality clause? An NDA is a standalone agreement built around a confidentiality clause. A confidentiality clause is the same protection embedded inside a larger contract such as a services or supply agreement. The mechanics are identical; the packaging differs.

Does a confidentiality clause transfer ownership of information? No. Confidentiality controls secrecy and use; it does not assign intellectual property. If you want the recipient to own or license anything, that has to come from a separate IP or license clause. Many disputes arise from assuming an NDA did work it never did.

Can you be forced to disclose confidential information despite the clause? Yes. A subpoena, court order, or legal requirement overrides the clause. The standard approach is not to promise refusal but to require the recipient to give prompt notice (where legally allowed) and cooperate in seeking a protective order.

Arshita Anand

Co-Founder & CEO · Attorney

Arshita leads product and strategy at Vaquill, building the legal AI suite that solo, small-firm, and in-house US lawyers use to run a matter end to end.