Confidentiality Clause: Definition, Exclusions, Term, and the Residuals Trap

A confidentiality clause controls who can see your sensitive information and what they can do with it. It defines what counts as Confidential Information, lists the standard exclusions that fall outside that definition, sets how long the duty to protect lasts, and limits use to the deal at hand. The fights worth having are over the definition, the survival term, and a quiet provision called a residuals clause that can let the other side keep using what they remember.

Reviewed and corrected on 12 October 2026. This is general information, not legal advice; check the cited statute or opinion before relying on it.

TL;DR

• A confidentiality clause has four moving parts: the definition of Confidential Information, the exclusions, the use and disclosure restrictions, and the term. Negotiate each separately.
• The four standard exclusions (already public, already known to the recipient, independently developed, received from a third party) are non-negotiable in principle, and a compelled-disclosure carve-out sits beside them. The fight is over how each is drafted and proven.
• Trade secrets should be protected for as long as they stay secret, not for a fixed two- or three-year term. A flat sunset on everything can hand the recipient an argument that you stopped protecting the secret: a federal court applying New York law rejected a trade secret claim, on an independent ground, because the plaintiff had earlier disclosed the information to a third party under an NDA that expired after one year.
• The residuals clause is the most dangerous thing in a one-way NDA you sign as the discloser. It lets the recipient freely use anything its people remember "without reference to" your documents, which can swallow the whole agreement.
• Read the confidentiality clause with the survival, IP, and data protection clauses. Confidentiality protects secrecy; it does not assign ownership or cover regulated personal data.

What a confidentiality clause actually does

The clause builds a fence around information and tells the recipient what they may and may not do with it. Four mechanics do the work.

1. The definition. This says what is protected. Broad definitions cover "all information disclosed, in any form, whether or not marked." Narrow ones cover only material marked "Confidential" or identified as such within a set number of days. Broad protects the discloser; narrow protects the recipient.

2. The exclusions. These carve information back out of the definition: anything already public, already known to the recipient, independently developed, or rightfully received from someone else. Without them, the recipient is on the hook for information they were free to use anyway.

3. The use and disclosure restrictions. The recipient may use the information only for the defined Purpose, must protect it with at least reasonable care, and may share it only with people who need to know and are bound by similar duties. The Purpose definition is the leash; a vague Purpose is a long one.

4. The term. How long the duty lasts after the information is disclosed or the agreement ends. This is where trade secrets and ordinary confidential information should be treated differently.

Why it matters: the dollars at stake

Picture a manufacturer (call it the discloser) that shares a proprietary process spec with a contract supplier under a mutual NDA. The NDA has a flat three-year confidentiality term and a residuals clause.

Two years later the supplier starts making a competing product using the same process. Here is the example math on what the NDA is worth in each version.

• With a flat three-year term that covers everything, the process spec stops being protected by the contract once the term runs, even though it is still a live trade secret. The discloser is left arguing trade-secret law with no contractual backstop, and the supplier can argue the discloser stopped taking reasonable measures to keep the spec secret. In Structured Capital Solutions, LLC v. Commerzbank AG, 177 F. Supp. 3d 816 (S.D.N.Y. 2016), the plaintiff had disclosed its transaction in 2009 to a third party under an NDA that expired a year later, and the court granted summary judgment on the trade secret claim on that separate ground, saying that "a temporary pledge to secrecy is exactly that: temporary. Once a third party's confidentiality obligation ... expires, so does the trade secret protection."
• With a trade-secret carve-out ("for trade secrets, until they cease to be trade secrets"), the duty survives indefinitely and the discloser can sue on the contract for breach years later.
• Add a residuals clause, and the supplier argues its engineers used only what they remembered, not your documents, so no breach at all.

Same NDA, same leak. The difference between a recoverable breach and an unenforceable one comes down to two clauses most people skim. That is why in-house counsel read the term and the residuals language line by line.

Who wants what

The pattern: the discloser wants a wide net that lasts, and the recipient wants a narrow, time-limited duty with an escape hatch for what its people learn.

Market-standard language

A typical mutual confidentiality clause for a commercial agreement reads close to this:

CONFIDENTIALITY.

(a) Definition. "Confidential Information" means non-public information
disclosed by one party (the "Discloser") to the other (the "Recipient"),
whether oral, written, or electronic, that is marked confidential or that
a reasonable person would understand to be confidential given the nature
of the information and the circumstances of disclosure.

(b) Exclusions. Confidential Information does not include information that:
(i) is or becomes public through no fault of the Recipient; (ii) was
rightfully known to the Recipient without a duty of confidentiality before
disclosure; (iii) is independently developed by the Recipient without use
of the Confidential Information; or (iv) is rightfully received from a
third party without a duty of confidentiality.

(c) Obligations. The Recipient will (i) use the Confidential Information
only to perform under this Agreement (the "Purpose"); (ii) protect it with
at least the degree of care it uses for its own confidential information,
and in no event less than reasonable care; and (iii) disclose it only to
its personnel and advisors who need to know it for the Purpose and who are
bound by confidentiality duties at least as protective as these.

(d) Compelled Disclosure. The Recipient may disclose Confidential
Information to the extent required by law or court order, provided it gives
the Discloser prompt notice (where legally permitted) and cooperates in
seeking protective treatment.

(e) Term. The obligations in this Section survive for three (3) years after
disclosure, except that for Confidential Information that constitutes a
trade secret, the obligations continue for as long as the information
remains a trade secret under applicable law.

Note subsection (e). The split term is the single most important drafting choice in the clause: a flat term for ordinary confidential information, indefinite protection for trade secrets.

The negotiation: standard, fallback, walk-away

Treat the definition, the term, and the residuals separately.

The trade-secret carve-out is the workhorse compromise. The recipient gets its short, clean sunset for routine information, and the discloser keeps indefinite protection for the handful of things that actually qualify as trade secrets.

Common carve-outs and variations

The high-frequency variations that change how the clause behaves:

• Marking requirements. A recipient-friendly clause protects only information marked "Confidential," with a window (often 30 days) to confirm oral disclosures in writing. Miss the window and the information is unprotected.
• One-way versus mutual. If only one side discloses, use a one-way NDA. If both will share, make it mutual so the obligations and exclusions run symmetrically.
• Affiliates and advisors. The recipient usually wants to share with affiliates, lawyers, accountants, and financing sources. Fine, as long as each is bound by equivalent duties and the recipient stays liable for their breaches.
• Residuals. A residuals clause lets the recipient use general knowledge, ideas, and know-how retained in the unaided memory of its people. It is the biggest trap for a discloser, because it can let the recipient use what it learned without any claim of copying.

A narrow, discloser-protective residuals fallback looks like this:

Nothing in this Agreement grants the Recipient any license to use the
Discloser's Confidential Information beyond the Purpose. The Recipient
acquires no rights in any Confidential Information that constitutes a trade
secret or that is embodied in the Discloser's intellectual property,
whether or not retained in the memory of the Recipient's personnel.

Jurisdiction and enforceability notes

Confidentiality clauses are routinely enforced between businesses, but a few principles govern whether yours holds up:

• Trade-secret protection requires reasonable secrecy measures. The federal Defend Trade Secrets Act defines a trade secret as information whose owner "has taken reasonable measures to keep such information secret" and that derives independent economic value from not being generally known (18 U.S.C. 1839(3)). State trade-secret statutes have their own wording, which was not checked state by state in our October 2026 review. A loose NDA, a flat sunset, or sharing without an NDA can undercut the trade-secret claim itself.
• Perpetual duties over ordinary information. Courts are comfortable with protection that lasts as long as a trade secret does. How a court treats a perpetual duty over information that is not a trade secret depends on the state, and was not verified in our October 2026 review. Check the controlling state's cases. The split term in the model clause avoids the question.
• Keep the definition and exclusions clean. A definition tied to non-public information, with the exclusions listed, is easier to prove and to defend than "everything the parties share."
• Compelled disclosure cannot be contracted away. A subpoena or court order overrides the clause. Standard practice is notice and cooperation, not a promise to refuse.
• Employee and contractor NDAs need the federal whistleblower notice. An employer must give notice of the immunity in 18 U.S.C. 1833(b) in any contract or agreement with an employee that governs the use of a trade secret or other confidential information, and "employee" includes contractors and consultants. If the employer does not, it "may not be awarded exemplary damages or attorney fees" under the Defend Trade Secrets Act in an action against that employee. The rule applies to agreements entered into or updated after May 11, 2016 (18 U.S.C. 1833(b)(3), (4)).
• Injunction bonds are the court's call. A contract can waive a bond, but under the federal rules a court may issue a preliminary injunction "only if the movant gives security in an amount that the court considers proper" (Fed. R. Civ. P. 65(c)). Do not count on a contractual waiver to bind the court.
• Statutes limit NDAs that touch employment. Under the federal Speak Out Act, a nondisclosure or nondisparagement clause agreed to before a sexual assault or sexual harassment dispute arises is not judicially enforceable where the conduct is alleged to violate federal, tribal or state law (42 U.S.C. 19403(a)). States add their own rules. Washington, for example, voids an employer-employee provision barring disclosure of conduct the employee reasonably believed to be illegal discrimination, harassment, retaliation, a wage and hour violation or sexual assault (RCW 49.44.211(1)). Confirm against the controlling state before relying on broad employee-facing language.

This is general information, not legal advice for a specific deal. Enforceability turns on the governing law and the facts, so confirm against the controlling state's law. For state-by-state specifics, see our NDA enforceability by state guide and the trade secrets enforceability by state guide.

Review checklist: red flags to catch

• The term sunsets everything, including trade secrets, on a fixed date.
• A residuals clause that lets the recipient use what its people remember, with no carve-out for trade secrets or your IP.
• The definition requires marking but there is no cure window for oral or visual disclosures.
• The Purpose is vague ("evaluating a potential relationship"), giving the recipient broad license to use the information.
• No obligation to return or destroy information on termination.
• The clause is one-way against you when the deal involves mutual disclosure.
• No injunctive-relief acknowledgment (useful evidence of harm, though a court is not bound by it).
• The recipient can share with affiliates and contractors but is not made liable for their breaches.
• An employee or contractor agreement with no whistleblower-immunity notice (18 U.S.C. 1833(b)), which can cost you exemplary damages and attorney fees in a trade-secret suit against that person.

How it interacts with other clauses

The confidentiality clause does not stand alone. Read it together with:

• Survival: the survival clause is what keeps the confidentiality duty alive after termination; confirm the trade-secret carve-out is not capped by a general survival period.
• Intellectual property: confidentiality protects secrecy but assigns no ownership. Sharing information is not transferring rights in it.
• Data protection: if the confidential information includes personal data, a separate data protection clause or DPA governs how it is processed and secured.
• Non-solicitation: the two often travel together to protect against a counterparty poaching staff who learned your confidential information.

For the broader workflow, see the in-house contract review playbook and our NDA playbook and template.

FAQ

What is a confidentiality clause? It is a contract provision that protects sensitive information. It defines what counts as Confidential Information, lists exclusions that fall outside that definition, limits how the recipient may use and disclose it, and sets how long the duty to protect lasts.

How long should a confidentiality obligation last? Use a split term. For ordinary confidential information, two to five years after disclosure is a common negotiated range (market practice, not a legal rule). For trade secrets, the duty should last as long as the information stays a trade secret, which can be indefinite. A flat term that sunsets everything gives the recipient an argument that the secret lost its protection (Structured Capital Solutions v. Commerzbank, 177 F. Supp. 3d 816 (S.D.N.Y. 2016)).

What are the standard exclusions in a confidentiality clause? Four: information that is or becomes public through no fault of the recipient, was already rightfully known to the recipient, is independently developed without using the confidential information, or is rightfully received from a third party. These keep the recipient from being liable for information it was free to use. Disclosure required by law is usually handled separately, as a permitted disclosure with notice and cooperation, rather than as an exclusion from the definition.

What is a residuals clause and why is it dangerous? A residuals clause lets the recipient use ideas, know-how, and information retained in the unaided memory of its people, without reference to your documents. Drafted broadly it can let the other side use what your information taught them while claiming no breach. If you are the discloser, strike it or carve out trade secrets and any license to your IP.

Is an NDA the same as a confidentiality clause? An NDA is a standalone agreement built around a confidentiality clause. A confidentiality clause is the same protection embedded inside a larger contract such as a services or supply agreement. The mechanics are identical; the packaging differs.

Does a confidentiality clause transfer ownership of information? No. Confidentiality controls secrecy and use; it does not assign intellectual property. If you want the recipient to own or license anything, that has to come from a separate IP or license clause. Many disputes arise from assuming an NDA did work it never did.

Can you be forced to disclose confidential information despite the clause? Yes. A subpoena, court order, or legal requirement overrides the clause. The standard approach is not to promise refusal but to require the recipient to give prompt notice (where legally allowed) and cooperate in seeking a protective order.

Arshita Anand

Co-Founder & CEO · Attorney

Arshita leads product and strategy at Vaquill AI, the US primary law data API. As an attorney, she decides which law we carry, how each section is sourced and cited, and what legal AI and compliance teams need from the data.