Recruit
An NDA (non-disclosure agreement) is a contract obligating one or both parties to keep specified information confidential and to use it only for an agreed purpose. The four common types are: one-way (unilateral), mutual (bilateral), employee NDA, and vendor or contractor NDA. Standard terms run two to five years for ordinary business use.
A non-disclosure agreement (NDA) is a short legal document that protects information you share with someone outside your company (or with a new employee) before, during, or after a working relationship. Used well, an NDA helps you have substantive conversations with candidates, contractors, vendors, partners, and acquirers without worrying that your trade secrets, financials, customer lists, or product roadmap will end up in a competitor’s hands. Used carelessly, NDAs become unenforceable, intimidate the wrong parties, or expose you to liability.
This article gives you a working US NDA template, walks through the elements that actually matter, covers the common variants (one-way, mutual, employee, vendor), and explains the international and post-employment considerations that can trip up a generic template.
What An NDA Actually Does
An NDA creates a contractual obligation for the receiving party to keep confidential information confidential and to use it only for the agreed purpose. The agreement does three things: it defines what counts as confidential information, it sets out what the receiving party can and cannot do with that information, and it specifies what happens if there is a breach (typically remedies, including injunctive relief and damages).
An NDA does not create the confidential information; you must already have something to protect. It does not replace patent or trademark protection (those are separate intellectual-property protections). It does not block public disclosures already in the public domain or independently developed by the other party. What it does is create a clear, written record that the receiving party knew the information was sensitive and agreed not to share or misuse it.
The Four Common Types of NDA
Most NDAs fall into one of four use cases.
- One-way (unilateral) NDA. One party discloses, the other receives. Used when only one side has confidential information at stake: pitching a vendor, sharing a product roadmap with a candidate during recruiting, providing financials to a potential acquirer.
- Mutual (bilateral) NDA. Both parties exchange confidential information and agree to keep each other’s secrets. Used when partnership discussions, M&A diligence, or technical integration require both sides to share sensitive material.
- Employee NDA. Employee agrees to keep company confidential information confidential during and after employment, and assigns ownership of work product to the company. This is usually a condition of employment and signed at offer acceptance or day one. Often part of a broader confidentiality and IP-assignment agreement.
- Vendor or contractor NDA. Service provider agrees to confidentiality regarding the customer information they process, the systems they touch, and the project scope. Often paired with a separate Master Services Agreement.
Standard Sections of a US NDA
Most NDAs cover these sections, in roughly this order. The document is short by design (usually two to four pages).
- Parties. Names, addresses, and entity types of the parties.
- Purpose. Why the parties are exchanging information. “To evaluate a potential business relationship” or “in connection with the consideration of a possible transaction” is a typical formulation.
- Definition of confidential information. What counts as confidential. Most NDAs use a broad definition (any information disclosed by one party to the other in connection with the purpose, whether oral, written, electronic, or otherwise) and then list common standard exclusions.
- Exclusions. Information that is or becomes publicly known through no fault of the receiving party, was already known to the receiving party at the time of disclosure, is independently developed by the receiving party without reference to the disclosing party’s information, or is rightfully obtained from a third party without confidentiality restriction.
- Use restrictions. The receiving party may use the information only for the stated purpose, may share it only with employees, advisors, or representatives who have a need to know and are bound by confidentiality, and must take reasonable steps to protect it.
- Term. How long the obligations last. Two to five years for ordinary business NDAs, indefinite for trade-secret protection.
- Return or destruction. What happens to the information when the relationship ends. Standard practice is for the receiving party to return or destroy the information within a defined period of the disclosing party’s request.
- Remedies. Injunctive relief, damages, attorneys’ fees in some templates.
- Governing law and jurisdiction. Which state or country’s law applies, and where disputes will be resolved.
- No license. Confirmation that the NDA does not transfer any ownership of the information.
- Entire agreement and signatures.
The Template (Mutual NDA, US)
Below is a working mutual NDA template. Use this as a starting point and have legal counsel review the final version before you sign the first one.
MUTUAL NON-DISCLOSURE AGREEMENT
This Mutual Non-Disclosure Agreement (“Agreement”) is entered into as of [Date] by and between [Company A], a [State] [Entity Type] with its principal place of business at [Address] (“Company A”), and [Company B], a [State] [Entity Type] with its principal place of business at [Address] (“Company B”). Each of Company A and Company B may be referred to as a “Party” and together as the “Parties.”
1. Purpose. The Parties wish to discuss [describe purpose, e.g., a potential business relationship related to X] (the “Purpose”) and may exchange certain confidential and proprietary information in connection with the Purpose.
2. Confidential Information. “Confidential Information” means any non-public information disclosed by one Party (the “Disclosing Party”) to the other Party (the “Receiving Party”) in connection with the Purpose, whether disclosed orally, in writing, electronically, or by any other means, including but not limited to business plans, financial information, customer lists, technical data, product designs, software, and trade secrets.
3. Exclusions. Confidential Information does not include information that (a) is or becomes publicly available through no fault of the Receiving Party, (b) was known to the Receiving Party prior to disclosure as evidenced by written records, (c) is independently developed by the Receiving Party without reference to the Disclosing Party’s Confidential Information, or (d) is rightfully obtained from a third party without restriction on disclosure.
4. Use and Protection. The Receiving Party shall use the Confidential Information solely for the Purpose, shall protect the Confidential Information using at least the same degree of care it uses to protect its own confidential information of similar nature (and in no event less than reasonable care), and shall disclose the Confidential Information only to its employees, contractors, and advisors who have a need to know and who are bound by written or professional obligations of confidentiality at least as protective as this Agreement.
5. Term. This Agreement will remain in effect for [three] years from the date of disclosure of each item of Confidential Information. Notwithstanding the foregoing, obligations relating to trade secrets will continue for as long as the information qualifies as a trade secret under applicable law.
6. Return or Destruction. Upon written request of the Disclosing Party, the Receiving Party shall promptly return or destroy all Confidential Information in its possession, including all copies and extracts, and shall confirm such return or destruction in writing.
7. No License. Nothing in this Agreement grants the Receiving Party any license, ownership interest, or other right in the Confidential Information, except the limited right to use it for the Purpose as set out herein.
8. Remedies. The Parties acknowledge that any breach of this Agreement may cause irreparable harm for which monetary damages would be inadequate, and that the non-breaching Party shall be entitled to seek injunctive relief in addition to any other remedies available at law or in equity.
9. Governing Law. This Agreement is governed by the laws of the State of [State], without regard to its conflict-of-laws principles. The Parties consent to the exclusive jurisdiction of the state and federal courts located in [County, State] for any disputes arising out of this Agreement.
10. Entire Agreement. This Agreement constitutes the entire agreement between the Parties regarding the subject matter and supersedes all prior or contemporaneous agreements, written or oral, on the same subject.
IN WITNESS WHEREOF, the Parties have executed this Agreement as of the date first written above.
[Company A] [Company B]
By: ____________________ By: ____________________
Name: Name:
Title: Title:
Date: Date:
NDA Variants By Use Case
The table below summarizes how the elements above tend to vary by NDA type.
| Type | Common term | Special clauses | Typical use case |
|---|---|---|---|
| One-way NDA | 2 to 5 years | Receiving party representations | Vendor pitch, candidate intro |
| Mutual NDA | 2 to 5 years | Symmetric obligations | Partnership talks, M&A diligence |
| Employee NDA | During and after employment | IP assignment, non-solicitation | Onboarding, signed at offer |
| Vendor / contractor NDA | Term of MSA + 2 to 3 years | Data security, audit rights | SaaS, agency, dev contractor |
What Changes For International NDAs
NDAs work in most jurisdictions, but several elements need attention. Governing law and jurisdiction need to be enforceable in the country where the receiving party operates; some courts will not enforce a foreign-court selection clause against a local party. Trade-secret definitions are codified differently across countries (US Defend Trade Secrets Act, EU Trade Secrets Directive 2016/943, individual country laws). Restrictive clauses (non-solicitation, non-compete) are often unenforceable or limited under local employment law, particularly in California, the EU, and the UK. Data-protection rules (GDPR in the EU, the CCPA and CPRA in California, LGPD in Brazil) add specific requirements for handling personal data shared under the NDA.
Translate the agreement if the receiving party signs in a non-English-speaking country, and ensure both signatures comply with local electronic-signature law (eIDAS in the EU, the ESIGN Act in the US).
The Most Common NDA Mistakes
The patterns are predictable. Definition of confidential information is too broad, making the agreement look unreasonable to a court. Term is indefinite, which courts may refuse to enforce. Restrictive covenants (non-compete, non-solicitation) are sneaked in alongside confidentiality without separate consideration. Governing law and jurisdiction default to a state with no connection to the parties. The NDA is signed before the actual business conversation, then nobody knows what was disclosed when. The NDA is sent by the receiving party (the prospective vendor or candidate), not the disclosing party, and it favors the receiving side. The agreement is one-way when it should be mutual, or vice versa.
A clean template, used consistently, fixes most of these. For high-stakes disclosures (M&A, joint-development partnerships, code review with potential acquirers), engage counsel for a custom version rather than relying on the standard template.
NDAs in Employment Context
Employee NDAs are usually part of a broader Confidentiality, Invention Assignment, and Non-Solicitation Agreement signed at offer acceptance. The confidentiality piece protects company information after the employee leaves; the IP-assignment piece confirms the company owns work product the employee creates on the job; the non-solicitation piece (where enforceable) limits the employee from poaching customers or coworkers for a defined period after termination.
If you hire through an EOR in another country, the EOR’s local employment contract typically includes country-appropriate confidentiality and IP-assignment language. An EOR engagement still protects your business confidentiality through the local-law-compliant employment paperwork the EOR uses, though you should confirm the IP-assignment scope is sufficient for your needs (some countries restrict broad assignments without specific compensation).
The Bottom Line
An NDA is a short, structurally simple document, but the elements have to be there: parties, purpose, definition of confidential information, exclusions, use restrictions, term, return or destruction, remedies, governing law, signatures. Choose the right type for the use case (one-way for asymmetric disclosures, mutual for partnership talks, employee NDA for onboarding, vendor NDA for service providers). Adapt for international parties on governing law, restrictive covenants, and data-protection requirements. Use the template consistently, route higher-stakes versions through counsel, and the document does its job: a clear written record that the other side knew the information was sensitive and agreed to keep it safe.
Frequently Asked Questions
A one-way (unilateral) NDA has only one party disclosing confidential information; the other party agrees to keep it confidential. Use it when only one side has secrets at stake: pitching a vendor, sharing financials with a potential acquirer, briefing a candidate on the product roadmap. A mutual (bilateral) NDA covers both parties exchanging confidential information and binds both to confidentiality. Use it when the discussion is genuinely two-way: partnership talks, M&A diligence, technical integration. Default to mutual when in doubt; the symmetry usually feels fairer to both sides and avoids debates about who is the real discloser.
Most ordinary business NDAs run two to five years from the date of disclosure. Three years is the common middle ground. Trade-secret protection should continue as long as the information qualifies as a trade secret under applicable law; many templates carve that out as an indefinite obligation alongside the term-limited confidentiality clause. Indefinite all-purpose NDAs are sometimes refused enforcement by courts as unreasonable. Match the term to the sensitivity of the information: short for ephemeral pitch material, medium for typical business data, indefinite (with the trade-secret carveout) for genuine trade secrets.
Standard exclusions cover information that is or becomes publicly available through no fault of the receiving party, was already known to the receiving party at the time of disclosure (with documentary evidence), is independently developed by the receiving party without reference to the disclosing party's information, or is rightfully obtained from a third party without restriction. These exclusions are nearly universal because without them, the NDA would block knowledge that is already public or that the receiving party legitimately has. Without standard exclusions, courts may decline to enforce the agreement as unreasonably broad.
Generally yes, but several elements need attention for cross-border enforcement. Governing law and jurisdiction need to be reasonable and connected to the parties; many courts will not enforce a foreign-court selection clause against a local party. Trade-secret definitions are codified differently in the US Defend Trade Secrets Act, the EU Trade Secrets Directive, and individual country laws. Translate the agreement if the receiving party signs in a non-English-speaking country. Comply with local electronic-signature law (eIDAS in the EU, ESIGN Act in the US). Restrictive covenants alongside the NDA may be unenforceable or limited under local employment law.
Technically yes, but it is usually a mistake. Non-compete and non-solicitation clauses are restrictive covenants that need separate analysis under state and federal law. The FTC has moved aggressively against non-competes nationally. California voids most non-competes outright. Many states limit non-solicitation to specific time periods and customer relationships. Bundling these clauses into a generic NDA can render the entire agreement unenforceable in restrictive states. Best practice is to keep the NDA strictly about confidentiality, and use a separate Non-Competition or Non-Solicitation Agreement (with adequate consideration) when those obligations are needed.
Send your own when you can. The receiving party's NDA tends to favor their position: narrow definitions of confidential information, short terms, broad exclusions, governing law in their state, limited remedies. If you have to use their template, mark it up and negotiate the key elements (definition, term, exclusions, remedies, jurisdiction). For high-stakes situations (M&A, joint-development, code review with potential acquirers), do not rely on either side's standard template; engage counsel to draft or review a custom agreement that reflects the specific risks of the deal. The few hours of legal time pay off the moment a dispute arises.
The non-breaching party can sue for monetary damages (lost profits, disgorgement of benefits gained from the misuse, sometimes punitive damages in cases of willful misconduct) and for injunctive relief (a court order stopping the further use or disclosure of the information). Most NDAs explicitly acknowledge that monetary damages may be inadequate and that injunctive relief is available; that helps secure a court order quickly. In US trade-secret cases, the federal Defend Trade Secrets Act allows civil action including ex parte seizure orders in extraordinary circumstances. State trade-secret laws provide parallel remedies. Attorneys' fees provisions are increasingly common.
An NDA prevents the receiving party from disclosing or misusing your confidential information. An IP-assignment agreement transfers ownership of intellectual property created by an employee or contractor to the company. The two often appear together in employment paperwork, where a single Confidentiality, Invention Assignment, and Non-Solicitation Agreement covers all three obligations. The NDA piece protects what you tell the worker; the IP-assignment piece confirms the company owns code, designs, and inventions the worker creates on the job. Without IP assignment, the default rule (in most jurisdictions) is that the creator owns the IP, which is rarely what either side intended.
