The NDA Review Checklist: 12 Things to Check Before You Sign

Why NDAs deserve careful review

Non-disclosure agreements are often treated as formalities — "standard" documents that get signed without careful reading. But NDAs define what information is protected, for how long, and what happens when things go wrong. A poorly drafted NDA can expose confidential business information with no recourse.

The 12-point NDA checklist

1. Definition of Confidential Information — Is it broad enough to cover your actual confidential information? Watch for carve-outs that weaken protection.
2. Mutual vs one-way — Is the NDA mutual (both parties protected) or one-way? One-way NDAs heavily favoured by vendors are a red flag.
3. Permitted disclosures — What disclosures are allowed without consent? "Need to know" exceptions, legal compulsion, and prior knowledge carve-outs should be specific.
4. Term length — How long does confidentiality last? 2–3 years is standard for most commercial NDAs. Perpetual obligations are rare but exist for trade secrets.
5. Exclusions — Are there clear exclusions for information that becomes public, is independently developed, or was already known? These are standard and acceptable.
6. Standard of care — "Same degree of care as its own confidential information" is the standard formulation. "Reasonable care" alone is weaker.
7. Return or destruction of information — What happens to shared information on termination? Is there a certified destruction requirement?
8. Remedies — Are injunctive relief provisions included? Monetary damages alone are often inadequate for confidentiality breaches.
9. Residuals clause — Some NDAs include a residuals clause allowing use of information retained in unaided memory. This is a significant weakening of protection — flag it.
10. Governing law — Which jurisdiction governs? This affects enforceability and litigation cost if you need to act on a breach.
11. Assignment — Can the NDA be assigned to acquirers? This matters if the vendor is acquired by a competitor.
12. Entire agreement — Does the NDA include an integration clause? This prevents prior oral or written agreements from being used to modify obligations.

Red flags that should stop a deal

• No liability for breach (confidentiality with no remedy is worthless)
• Very short term (6 months or less) for a multi-year engagement
• Broad residuals clause with no definition of "unaided memory"
• Asymmetric obligations — vendor has weak obligations, your company has strict ones