NDAs are signed faster than any other commercial document — usually unread, because “it’s just an NDA”. They are also the document where the gap between what people think they have agreed and what the words actually do is widest. If the draft is already open in Word, you can run that check without leaving the document, using the Word and Excel plugin.
Four defects come up again and again. A fifth — the theatrical remedies clause — is worth a section of its own, because it is the one people are proudest of.
1. Confidentiality that never ends
“In perpetuity” reads like strength and often works like weakness.
Start with what actually protects genuinely secret material, because it is not the word “perpetual”. Under regulation 2 of the Trade Secrets (Enforcement, etc.) Regulations 2018, a “trade secret” means information which is “secret in the sense that it is not, as a body or in the precise configuration and assembly of its components, generally known among, or readily accessible to, persons within the circles that normally deal with the kind of information in question”; which “has commercial value because it is secret”; and which “has been subject to reasonable steps under the circumstances, by the person lawfully in control of the information, to keep it secret”.
Read that third limb again, because it is the one that decides cases. Protection depends on how you actually handled the information — access controls, marking, need-to-know discipline — not on how sweeping your contract was. The United States runs the same logic through the Defend Trade Secrets Act, 18 U.S.C. § 1836.
Which reframes the perpetual clause entirely. For ordinary commercial information, a defined period is normal and workable; two to five years is the common band, and the right number depends on how long the information stays valuable. For genuinely secret material, the statutory regime does the heavy lifting and it rewards handling rather than drafting. An everything-forever clause covering the recipient’s whole knowledge of your business achieves neither: it is unenforceable in the parts that matter and unmanageable in the rest, and it invites a court to trim the lot.
2. No carve-outs
Every competent NDA excludes four categories from the definition of confidential information: what is already public through no fault of the recipient; what the recipient already knew; what it independently developed without using your material; and what it lawfully received from a third party without restriction. A fifth carve-out deals with compelled disclosure — to a court, a regulator or under statute — usually with an obligation to notify you first where lawful.
If those are missing, you are asking the recipient to keep secret things that are not secret, which is both unworkable and a reliable indicator about the quality of the drafting everywhere else in the document.
The subtler version of this defect is a carve-out set that exists but is drafted to be unusable — an independent-development exclusion available only on proof by contemporaneous written records, say, in a business that does not keep records that way. Read the proviso, not just the heading.
3. One-way obligations in a two-way conversation
If both sides will share information, a mutual NDA is the honest structure. A one-way agreement in a two-way negotiation means your disclosures travel entirely unprotected while theirs are locked down.
Do not trust the title. “Mutual Non-Disclosure Agreement” at the top of a document that defines “Discloser” as one named party and “Recipient” as the other is a one-way NDA with a friendly name. Check the definitions and then check the operative clause, because the two are sometimes inconsistent — which is itself a problem, since an ambiguity here is expensive to resolve later.
The same applies to the schedule of permitted recipients. If your side may share only with employees and theirs may share with “affiliates, advisers and prospective investors”, the agreement is not mutual whatever the definitions say.
4. The residuals clause
A residuals clause permits the recipient to use anything its personnel “retain in unaided memory” after the engagement.
Read from the disclosing side, this can hollow out the entire agreement. Skilled people remember a great deal, and the clause does not ask whether the memory was of something confidential — only whether a note was taken. In practice it converts a confidentiality obligation into a documents-only obligation.
Read from the receiving side, it addresses a genuine problem: an engineer who has seen your architecture cannot be lobotomised, and a recipient with a large technical team needs protection against a claim built on ordinary professional knowledge. That is why the clause exists and why it is common in technology deals.
So the question is not whether to accept it in the abstract. If you are disclosing your crown jewels, strike it, or narrow it: exclude anything specifically identified as a trade secret, exclude the material you actually care about by name, and make it personal to individuals rather than to the recipient organisation.
5. The remedies theatre
“The Recipient acknowledges that damages would be an inadequate remedy and agrees that the Discloser shall be entitled to injunctive relief, specific performance, and unlimited damages including punitive damages, without proof of loss.”
Clauses like this impress the person who drafted them and very little else. A court decides for itself whether damages are an adequate remedy; an acknowledgement is evidence of the parties’ view, not a substitute for the court’s.
The liquidated sum that sometimes accompanies it is the part with real legal risk. In Cavendish Square Holding BV v Makdessi and ParkingEye Ltd v Beavis [2015] UKSC 67 the Supreme Court restated the penalty rule: “the true test is whether the impugned provision is a secondary obligation which imposes a detriment on the contract-breaker out of all proportion to any legitimate interest of the innocent party in the enforcement of the primary obligation.” And, decisively for the punitive drafting: “The innocent party can have no proper interest in simply punishing the defaulter. His interest is in performance or in some appropriate alternative to performance.”
So a fixed sum tied to a legitimate interest in protecting genuinely confidential information may well stand. A number chosen to frighten, out of all proportion to any interest in enforcement, is at risk of being unenforceable — which means the drafter has traded a real remedy for a theatrical one.
The one people forget: your NDA is not a data protection agreement
If the information being shared includes personal data — a customer list, employee records, anything about identifiable people — a confidentiality clause does not discharge your data protection obligations, and signing one may lull both sides into thinking it has.
Article 28 of the UK GDPR requires that “processing by a processor shall be governed by a contract or other legal act … that is binding on the processor with regard to the controller”, and that the contract sets out “the subject-matter and duration of the processing, the nature and purpose of the processing”, among other prescribed terms, in writing. A standard NDA contains none of that. It says keep it secret; it does not say what may be done with it, for how long, on whose instructions, or what happens at the end.
There is a criminal dimension too, which is worth knowing before someone forwards a spreadsheet. Section 170 of the Data Protection Act 2018 makes it “an offence for a person knowingly or recklessly … to obtain or disclose personal data without the consent of the controller”. Confidentiality drafting does not touch that.
So if personal data is in scope, the NDA is the wrong instrument on its own, and the question to raise before signature is which party is the controller.
The clause nobody reads: how long you have to sue
One practical point that no NDA states and every disclosing party should know. Under section 5 of the Limitation Act 1980, an action founded on simple contract “shall not be brought after the expiration of six years from the date on which the cause of action accrued”.
Set that against a perpetual confidentiality obligation and the tension is obvious: the duty may be expressed to last forever, but the clock on any particular breach starts when it happens. That is an argument for monitoring and for acting promptly, not for longer drafting.
What to do with the one in front of you
Four checks, in this order, and none takes long. Find the definition of confidential information and read the carve-outs, including their provisos. Find the term, and ask whether it matches how long the information actually stays valuable. Establish whether the obligations really run both ways, by reading the definitions rather than the title. Then search the document for “residual” and for any fixed sum.
And separately from the drafting: if there is material you would genuinely litigate over, the statutory definition tells you where the real work is. Reasonable steps to keep it secret are what convert a document into protection.
The NDA is usually the opening move; the substantive engagement follows, and five clauses quietly ruin freelance and agency contracts once it does.
Check your document before you sign it. Legal Case Analyst reads contracts, leases, judgments and legislation under the law of your specific jurisdiction and returns severity-ranked issues with verifiable citations — on screen in minutes, with Word and PDF to download. £12 for the first 100 reports, standard price £24.
This article is general information, not legal advice. No solicitor/attorney–client relationship is created by reading it. For advice on your situation, consult a licensed practitioner in your jurisdiction.
