Here Is an NDA…Just Sign It

“Here is an NDA. It is standard. Just sign it.”

That sentence may be delivered casually before a meeting, while a deal is moving quickly, during onboarding, in a data room, or moments before someone reveals an idea. The document may be only a few pages. The person presenting it may insist that “everyone signs the same form.” Nobody may expect a dispute.

But a non-disclosure agreement can decide:

• What information may be used;
• Who may receive it;
• Why it may be used;
• How long secrecy must continue;
• Whether conversations, notes, ideas, analyses, and memories are covered;
• Whether an employee may join a competitor;
• Whether a business may pursue an opportunity independently;
• Who owns inventions, designs, improvements, or feedback;
• Whether a party may contact customers, employees, investors, or suppliers;
• Whether misconduct may be reported;
• Whether a lawsuit must be filed in New York or handled privately in arbitration;
• Whether an injunction may stop a transaction, product launch, publication, or new job;
• Whether the accused party must pay damages or the other side’s attorneys’ fees; and
• Whether one poorly chosen sentence can become the center of expensive litigation.

An NDA is not merely a promise to avoid gossip. It is a contract allocating information risk. A well-designed NDA can create a safe channel for necessary disclosure. A careless NDA can expose one party’s most valuable information or restrict the other party far beyond what the conversation seemed to require.

This Codex explains, in plain English:

• What an NDA is;
• What it is supposed to do;
• What it does not do;
• Unilateral and mutual NDAs;
• Confidential information and trade secrets;
• Permitted use and permitted recipients;
• Exclusions from confidentiality;
• Oral disclosures, notes, summaries, and residual knowledge;
• Duration and survival;
• Return, deletion, and data-security obligations;
• Compelled disclosure and protected reporting;
• Employment, whistleblower, harassment, and labor-law concerns;
• Deal, investor, vendor, and technology NDAs;
• Intellectual-property and “feedback” traps;
• Remedies, injunctions, damages, arbitration, and fee shifting;
• Common myths and drafting failures;
• Influential and cautionary cases; and
• Practical checklists for disclosing and receiving parties.

This Codex addresses New York and related federal law as of August 2026. Enforceability depends on the exact words, the parties, the information, the commercial context, the governing law, and what the parties actually did. It provides general information and is not a substitute for review by CorwinLaw. Visit www.corwinlaw.net.

What Is a Non-Disclosure Agreement?

A non-disclosure agreement, commonly called an NDA or confidentiality agreement, is a contract governing the receipt, use, protection, and disclosure of specified information.

At its core, an NDA should answer five questions:

1. What information is protected?
2. Who may receive it?
3. For what purpose may it be used?
4. How must it be protected?
5. What happens when the relationship or permitted purpose ends?

An NDA may be a stand-alone agreement or a section within another document, such as:

• An employment agreement;
• An independent-contractor agreement;
• A consulting agreement;
• A letter of intent;
• A purchase agreement;
• A software license;
• A services agreement;
• A joint-development agreement;
• An invention-assignment agreement;
• A settlement agreement;
• A separation agreement;
• A franchise or dealership agreement;
• A financing agreement;
• A data-processing agreement;
• A vendor agreement; or
• A commercial lease.

The title is not decisive. A section called “Confidentiality,” “Proprietary Information,” “Restricted Information,” “Non-Use,” “Non-Disclosure,” or “Protection of Information” may operate as an NDA. Conversely, a document titled “NDA” may contain noncompetition, nonsolicitation, intellectual-property assignment, non-disparagement, arbitration, indemnification, and other provisions that go far beyond confidentiality.

What Is an NDA Supposed to Do?

Create a controlled environment for disclosure

Businesses often cannot evaluate a deal, hire an employee, obtain professional advice, test a product, or perform diligence without sharing sensitive information. An NDA can permit disclosure without surrendering control.

Define the permitted purpose

A strong NDA does more than prohibit disclosure. It limits use.

For example, information disclosed to evaluate a possible acquisition should not automatically be usable to:

• Compete with the target;
• Recruit its employees;
• Approach its customers;
• Copy its pricing strategy;
• Develop a substitute product;
• Trade securities;
• Circumvent the target in a supplier relationship; or
• Pursue the disclosed opportunity without the target.

The permitted-purpose clause is often the operational heart of the NDA.

Preserve trade-secret protection

Trade-secret protection depends in part on secrecy and reasonable protective measures. NDAs can support those measures by documenting that recipients were told information was confidential, agreed to restricted use, and accepted security and return obligations.

New York’s influential trade-secret decision, Ashland Management Inc. v. Janien, 82 N.Y.2d 395 (1993), identifies factors including how widely information is known, the precautions used to guard it, its value, development effort, and how easily others could acquire or duplicate it. The lesson is simple: secrecy must be real, not merely declared.

Establish practical handling rules

An NDA may require:

• Need-to-know access;
• Passwords and encryption;
• Secure transfer methods;
• No uploading to public artificial-intelligence systems;
• No copying to personal devices;
• No reverse engineering;
• Prompt incident notification;
• Return or destruction;
• Written deletion certification; and
• Continued protection after the relationship ends.

Supply contractual remedies

Even when information does not qualify as a trade secret, a carefully drafted NDA may create a contract claim for unauthorized use or disclosure. It may also support injunctive relief before harm becomes irreversible.

What an NDA Does Not Do

It does not make everything secret merely by saying so

A label is evidence of intent, but it is not magic. Information may already be public, commonly known, independently developed, lawfully obtained elsewhere, or too vague to identify. Trade-secret status requires more than a sentence declaring that all information is proprietary.

In Ashland Management, the employer argued that an investment model was a trade secret. The courts credited evidence that an analyst could reproduce it from public disclosures and denied the requested protection. A company cannot publicly reveal the recipe and then rely on an NDA label to restore secrecy.

It does not create a patent, copyright, or trademark

An NDA can preserve secrecy while intellectual-property rights are evaluated, but it does not itself:

• Issue a patent;
• Register a copyright;
• Create trademark priority;
• Establish inventorship;
• Transfer ownership of an invention; or
• Prove that one party originated an idea.

Those issues may require separate assignments, registrations, records, and agreements.

It does not automatically transfer ownership

A promise not to disclose is different from a transfer of ownership. If the parties intend to assign inventions, designs, source code, improvements, work product, domain names, social-media accounts, or feedback, the agreement should address ownership expressly.

It does not prohibit all competition

A genuine NDA limits misuse of protected information. A noncompetition covenant restricts work or business activity. The two are not interchangeable.

An overbroad confidentiality definition—such as “everything learned during employment, forever”—may operate like a hidden noncompete by making ordinary work experience unusable. New York courts examine practical effect, not just headings.

It does not erase general skill, knowledge, or experience

A former employee generally remains free to use general knowledge, skill, professional experience, and information that is public or readily ascertainable. An employer may protect genuine confidential information; it does not own a person’s mind or career.

It does not guarantee silence about unlawful conduct

Federal and New York laws protect specified reports, claims, and disclosures. An NDA cannot safely be treated as a command to conceal illegality, obstruct an investigation, prevent protected agency communications, or punish every report of misconduct.

It does not guarantee that a court record will remain sealed

Parties may agree to confidentiality, but courts control their own records. Litigation may expose the agreement, the dispute, and some of the underlying facts. Protective orders and sealing requests require judicial approval and are not automatic.

It does not prevent independent discovery

If another party lawfully develops the same solution without using protected information, the NDA should not convert independent work into infringement. That is why independently developed information is a standard and important exclusion.

It does not replace information security

An NDA cannot repair weak access controls, unrestricted downloads, shared passwords, unmanaged devices, or careless offboarding. A company that gives every worker unlimited access to its “crown jewels” and takes no technical precautions may later struggle to prove that it treated the information as secret.

Unilateral and Mutual NDAs

Unilateral NDA

A unilateral NDA protects information flowing primarily in one direction. The disclosing party provides information; the receiving party accepts restrictions.

Common examples include:

• A business presenting information to a potential investor;
• An employer sharing trade secrets with an employee;
• A seller opening a data room to a potential buyer;
• A software company demonstrating nonpublic technology; and
• An inventor discussing a concept with a manufacturer.

Mutual NDA

A mutual NDA protects both parties’ confidential information. This is common where both sides will exchange technical, financial, or strategic materials.

“Mutual” does not necessarily mean balanced. A form may impose the same words on both parties even though:

• One party will disclose far more information;
• One side has stronger security resources;
• One side needs broad adviser access;
• One party is a competitor;
• One side must retain regulated records; or
• Only one party faces meaningful injunction risk.

Symmetry in wording can conceal asymmetry in real-world consequences.

Multiparty NDA

Transactions may involve affiliates, lenders, sponsors, consultants, joint bidders, clean teams, or consortium members. The agreement must identify who is protected, who is bound, and whether one participant is responsible for another’s conduct.

The Definition of “Confidential Information”

The definition controls the NDA’s reach. If it is too narrow, valuable information may fall outside the agreement. If it is too broad, the recipient may be unable to determine what it can lawfully use.

Information commonly protected

Depending on context, confidential information may include:

• Trade secrets;
• Business plans;
• Financial statements and projections;
• Pricing, margins, discounts, and costs;
• Customer and supplier information;
• Sales pipelines;
• Product roadmaps;
• Research and development;
• Formulas, methods, algorithms, and source code;
• Designs, prototypes, specifications, and test data;
• Cybersecurity information;
• Nonpublic contracts;
• Employee information;
• Litigation and regulatory matters;
• Acquisition or financing discussions;
• The existence of negotiations;
• Proposed deal terms;
• Data-room contents;
• Credentials and access information;
• Notes and analyses derived from protected material; and
• Information received from third parties under a duty of confidence.

Written, oral, visual, electronic, and observed information

Information may be disclosed through:

• Documents;
• Email;
• Data rooms;
• Source-code repositories;
• Demonstrations;
• Site visits;
• Meetings;
• Telephone calls;
• Video conferences;
• Screen sharing;
• Samples and prototypes;
• System access;
• Observations of facilities or processes; and
• Answers to questions.

An NDA should state whether oral and visual disclosures are covered and whether they must be identified as confidential at disclosure or confirmed in writing afterward.

The marking problem

A recipient may prefer protection only for material marked “Confidential.” That creates certainty, but it can punish an accidental failure to mark a sensitive file.

A discloser may prefer protection for all information that a reasonable person would understand to be confidential. That protects obvious secrets, but may create uncertainty.

A practical approach may combine:

• Protection for marked material;
• Protection for information identified as confidential when disclosed;
• Protection for information whose confidential nature is reasonably apparent; and
• A written-confirmation procedure for significant oral disclosures.

Derived information

A recipient’s notes, models, summaries, compilations, and analyses may reveal the underlying information. If only the original document is protected, deleting it may not eliminate the risk.

The agreement should address whether “confidential information” includes materials that contain, reflect, summarize, or are derived from protected information.

The “anything we say is confidential” problem

A definition based solely on one party’s later subjective assertion can be dangerous. It may allow the discloser to retroactively declare ordinary facts confidential or make compliance impossible.

In Denson v. Donald J. Trump for President, Inc., 530 F. Supp. 3d 412 (S.D.N.Y. 2021), the agreement swept in broad categories and information that Mr. Trump “insists remain private or confidential,” applied indefinitely, and reached numerous people and entities. The court found the non-disclosure and non-disparagement provisions vague, overbroad, and unenforceable as to the plaintiff.

The case is a warning to drafters: overreach can destroy the protection that careful tailoring might have preserved.

Standard Exclusions—and Why They Matter

A commercially reasonable NDA ordinarily excludes information that the recipient can demonstrate:

• Was publicly available when disclosed;
• Became public without the recipient’s breach;
• Was already lawfully known to the recipient without confidentiality restrictions;
• Was received lawfully from another source without a duty of confidentiality;
• Was independently developed without using the protected information; or
• Was approved for release in writing by the discloser.

Burden of proof

The words “recipient can demonstrate” matter. A recipient may need records proving prior knowledge or independent development. Contemporaneous laboratory notebooks, source-control history, dated proposals, emails, and development records can be decisive.

Public combinations

Individual elements may be public while the particular selection, arrangement, timing, or combination remains secret. A customer list assembled through extensive work, a model combining public inputs in a secret way, or a roadmap integrating otherwise public technologies may still have value as a compilation.

Partial public disclosure

Disclosure of part of a concept does not necessarily make every nonpublic detail free for use. The parties should avoid all-or-nothing assumptions.

Permitted Use: The Clause People Miss

A non-use restriction may be more important than a non-disclosure restriction.

Consider a manufacturer that receives a startup’s prototype under an NDA. The manufacturer never tells anyone else about it. Instead, it quietly develops a competing version. There may have been no external “disclosure,” but the startup’s central concern—competitive use—has occurred.

The permitted purpose should be specific enough to enforce and broad enough to allow the intended work. Examples include:

• Evaluating a potential acquisition;
• Performing due diligence;
• Considering a financing;
• Evaluating a vendor relationship;
• Providing services under a stated agreement;
• Developing a defined joint project;
• Assessing employment; or
• Resolving a specified dispute.

Purpose creep

Information disclosed to evaluate one project should not silently become available for:

• Product development;
• Competitive benchmarking;
• Training artificial-intelligence models;
• Advertising;
• Soliciting personnel;
• Investing in a competitor;
• Filing intellectual-property applications; or
• Pursuing the same opportunity without the discloser.

No license

Many NDAs state that disclosure grants no license or ownership right. That is important, but it should align with the permitted-purpose clause. A recipient may need a narrow implied or express right to copy, test, or analyze material to conduct the evaluation.

Who May Receive the Information?

Recipients often need to share information with “representatives,” which may include:

• Employees;
• Officers and directors;
• CorwinLaw;
• Accountants;
• Tax advisers;
• Consultants;
• Insurers;
• Lenders;
• Financing sources;
• Equity investors;
• Affiliates;
• Contractors; and
• Technical specialists.

The definition should fit the transaction.

Need-to-know limitation

Access should ordinarily be limited to representatives who:

• Need the information for the permitted purpose;
• Are informed of its confidential nature; and
• Are bound by confidentiality duties at least as protective as required.

Responsibility for representatives

A form may make the recipient strictly liable for every representative’s breach. That can be difficult where the representative is an independent law firm, lender, regulated professional, or prospective financing source.

Alternatives include responsibility for representatives whom the recipient directs or controls, an obligation to enforce confidentiality duties, or direct joinders for especially sensitive recipients.

Affiliates

“Affiliate” can include a broad family of entities, including competitors within a private-equity portfolio. Before permitting affiliate disclosure, determine who actually receives access and whether information barriers are needed.

Clean teams

When parties compete, highly sensitive pricing, customer, wage, or strategic information may create antitrust and commercial risk. A clean team restricts access to specified outside advisers or screened personnel and may permit only aggregated or redacted outputs to reach business decisionmakers.

The Recipient’s Standard of Care

An NDA may require the recipient to use:

• The same care used for its own comparable information;
• No less than reasonable care;
• Commercially reasonable safeguards;
• Industry-standard safeguards; or
• Detailed technical controls.

“Same care” alone may be weak if the recipient protects its own information poorly. “Highest degree of care” may be unrealistic and difficult to insure. A combined standard, at least reasonable care and no less than the care used for comparable information, is common.

Security obligations may become operational promises

Terms involving encryption, multifactor authentication, segregation, audit logs, data localization, breach notice, background checks, or subcontractor controls should be reviewed by information-security personnel. Legal teams should not promise technical practices the organization does not actually perform.

Artificial intelligence and external platforms

Modern NDAs should consider whether confidential material may be:

• Entered into public or consumer AI systems;
• Used to train or improve models;
• Retained by a model provider;
• Sent to transcription services;
• Shared through meeting assistants;
• Uploaded to code-assistance tools; or
• Processed by unapproved cloud vendors.

A blanket prohibition may be appropriate for highly sensitive material. In other relationships, controlled use of approved enterprise systems with contractual privacy and security protections may be necessary.

Duration: How Long Is “Confidential”?

An NDA has at least two timing questions:

1. How long may disclosures occur?
2. How long must each disclosure remain protected?

These periods need not be identical.

Defined term

Ordinary business information may justify protection for a specified period, such as a number of years after disclosure or termination. The appropriate period depends on how quickly the information loses competitive value.

Trade secrets

Trade-secret obligations are often stated to continue for so long as the information remains a trade secret. That ties the obligation to the information’s legal and commercial status rather than an arbitrary date.

Perpetual confidentiality

Perpetual protection may be defensible for qualifying trade secrets or narrowly defined information that remains secret. It can be unreasonable or impractical for every fact, email, observation, or conversation.

An indefinite obligation covering vast, undefined categories contributed to the failure of the clauses in Denson.

Stale information

A five-year-old pricing model, launch plan, or acquisition target may no longer be sensitive. By contrast, a formula, private key, source code, or manufacturing process may retain value much longer. One duration does not fit every category.

Return, Destruction, and Retention

When the purpose ends, the discloser may require the recipient to return or destroy confidential information.

The impossibility of perfect deletion

Information may exist in:

• Email archives;
• Disaster-recovery backups;
• Immutable logs;
• Litigation holds;
• Mobile devices;
• Cloud platforms;
• Collaborative workspaces;
• Adviser files;
• Regulatory archives; and
• Automated security systems.

A promise to delete “every copy everywhere immediately” may be impossible. The clause should address routine backups, legal retention, professional obligations, and inaccessible archival copies.

Retained copies

A recipient may need to keep:

• One archival copy for legal compliance;
• Records required by law or regulation;
• Files subject to litigation hold;
• Evidence of what was reviewed in a transaction; or
• Records required by insurer or professional rules.

Retained information should remain protected and inaccessible for ordinary business use.

Certification

A senior officer may be asked to certify destruction. Before agreeing, determine whether the signer can verify deletion across all systems and representatives.

Compelled Disclosure

An NDA should permit disclosures required by:

• Subpoena;
• Court order;
• Statute or regulation;
• Regulatory request;
• Stock-exchange rule; or
• Government investigation.

Typical procedures include:

• Prompt notice to the discloser, if legally permitted;
• Reasonable cooperation in seeking protection;
• Disclosure of only the legally required portion; and
• Efforts to obtain confidential treatment.

The clause should not require a recipient to violate law, disobey a regulator, ignore a deadline, or give notice where notice is prohibited.

Protected Reporting, Whistleblowers, and Government Communications

An NDA should not be drafted or administered as a gag order against protected activity.

Defend Trade Secrets Act immunity

The federal Defend Trade Secrets Act of 2016 provides immunity under federal and state trade-secret law for specified confidential disclosures to government officials or an attorney made solely to report or investigate a suspected legal violation, and for trade-secret material filed under seal in specified proceedings. It also requires employers to provide notice of that immunity in agreements governing employee use of trade secrets or confidential information. The statutory definition of employee includes contractors and consultants for this purpose. Failure to provide notice can prevent the employer from recovering exemplary damages or attorneys’ fees under the DTSA against that individual.

New York whistleblower law

New York Labor Law § 740 prohibits specified retaliatory action when an employee discloses or threatens to disclose certain employer activity, policy, or practice the employee reasonably believes violates law, rule, or regulation or presents specified dangers. The statute contains detailed requirements and exceptions. An NDA should not purport to waive rights the law protects.

Agency communications

Depending on the relationship and subject, federal securities, labor, discrimination, safety, and other laws may protect communications with government agencies. An NDA should preserve lawful reporting and participation rights while still requiring lawful handling of privileged, personal, or unrelated confidential information.

Reporting is not a license to steal

Protected-reporting provisions do not authorize indiscriminate downloading, public release, or retention of unrelated files. The DTSA itself distinguishes protected confidential reporting from unauthorized acquisition. Purpose, method, scope, and recipient matter.

Sexual Harassment, Sexual Assault, Discrimination, and Retaliation

Confidentiality in employment disputes has changed materially.

Federal Speak Out Act

The federal Speak Out Act limits judicial enforcement of predispute non-disclosure and non-disparagement clauses concerning disputes involving alleged sexual assault or sexual harassment. It applies to claims filed on or after enactment and preserves more protective state law. It does not prohibit protection of trade secrets or proprietary information.

The word predispute is critical. A clause signed before a dispute arises is treated differently from confidentiality negotiated after a dispute as part of a settlement.

New York General Obligations Law § 5-336

New York General Obligations Law § 5-336 regulates confidentiality of the underlying facts and circumstances of specified discrimination, harassment, or retaliation claims. The statute has changed over time and contains requirements affecting preference, notice, review, revocation, and enforceability. Current statutory language should be checked when preparing a settlement or release.

The practical drafting lesson

Do not combine legitimate trade-secret protection with sweeping language that appears to prohibit:

• Reporting harassment or discrimination;
• Filing a charge;
• Cooperating with an agency;
• Testifying truthfully;
• Responding to legal process;
• Discussing facts the law makes nonwaivable; or
• Consulting CorwinLaw.

A clause can protect proprietary information without concealing alleged unlawful conduct.

Non-Disclosure Is Not Non-Disparagement

A non-disclosure clause limits disclosure of specified information. A non-disparagement clause restricts negative statements.

The difference is substantial:

• A truthful statement may be disparaging but not confidential.
• Confidential information may be neutral and not disparaging.
• Opinion may fall within non-disparagement but not defamation.
• A public fact may be disparaging but cannot sensibly be treated as secret.

Combining the two concepts can create a broad speech restriction.

In Denson, an arbitrator initially awarded approximately $49,507.64 against a former campaign worker under non-disclosure and non-disparagement provisions. The First Department later vacated the arbitration award, and the federal court ultimately declared the provisions invalid and unenforceable as to her because of their extraordinary breadth and indefiniteness. The case demonstrates both sides of the risk: an overbroad clause may ultimately fail, yet the signer may endure years of arbitration, enforcement efforts, frozen funds, and litigation before obtaining relief.

Employment NDAs

Employment confidentiality agreements are common and often appropriate. Employees may access customer data, source code, formulas, pricing, strategy, and personnel information. But an employment NDA must account for mobility, bargaining power, protected rights, and the difference between trade secrets and ordinary experience.

What employers should protect

• Specifically identified trade secrets;
• Nonpublic technical information;
• Genuine customer or supplier information;
• Nonpublic pricing and margin information;
• Security credentials and architecture;
• Product plans and research;
• Third-party information the employer must protect; and
• Other defined information with real commercial sensitivity.

What employers should not try to own

• General skill and experience;
• Public information;
• An employee’s unaided memory of ordinary professional knowledge;
• Lawfully developed work outside the agreement’s scope;
• Protected reports and communications;
• Personal information unrelated to the employer’s legitimate interests; or
• Every idea the employee may have for the rest of the employee’s career.

An NDA can become a hidden noncompete

If “confidential information” means every fact learned at work, and the employee may never use any such information, the clause may effectively prevent the employee from working in the industry.

In EarthWeb, Inc. v. Schlack, 71 F. Supp. 2d 299 (S.D.N.Y. 1999), the court refused to transform a confidentiality provision into a broader noncompete under the “inevitable disclosure” theory. It warned that such a move could create a powerful post-employment weapon never openly negotiated. The court stressed that inevitable-disclosure relief without evidence of actual misappropriation should be rare.

But a properly supported restriction can stop a new job

In Estee Lauder Companies Inc. v. Batra, 430 F. Supp. 2d 158 (S.D.N.Y. 2006), a senior executive had extensive knowledge of confidential product launches, strategy, and development plans and moved to a direct competitor. The court issued a preliminary injunction, narrowing the restriction to five months. The employer continued paying his $375,000 annual salary during the restricted period.

For the signer, the real-life result was dramatic: the contract and confidential-information risk temporarily prevented him from taking the new competitive role. For the employer, the case shows the value of tailored terms, actual evidence, and continued compensation. For both sides, it shows that an NDA package can affect a career before a final trial ever occurs.

Offboarding matters

Employers should:

• Disable access promptly;
• Preserve logs;
• Recover devices;
• Review unusual downloads;
• Remind the employee of continuing obligations;
• Identify specific categories that remain confidential;
• Obtain return and deletion certifications where appropriate;
• Avoid threatening lawful competition; and
• Communicate with the new employer carefully and accurately.

Employees should not email files to themselves, copy repositories, retain customer lists, wipe devices, or assume that “I created it” means “I own it.”

Transaction and Due-Diligence NDAs

A transaction NDA may be signed before a letter of intent or data-room access. It often protects far more than documents: the existence of negotiations, identities of the parties, proposed price, financing, and contact with stakeholders.

Special transaction provisions

A transaction NDA may include:

• No contact with employees, customers, suppliers, or landlords;
• No solicitation or hiring;
• No circumvention;
• Standstill restrictions;
• Securities-law warnings;
• Clean-team procedures;
• No representation as to accuracy;
• No obligation to update information;
• No obligation to proceed;
• Waiver of claims based on preliminary information;
• Return and destruction;
• Residuals restrictions;
• Privilege protections; and
• Remedies for leaks that disrupt the deal.

These are not all “standard confidentiality.” Each allocates a separate risk.

The accuracy disclaimer

A seller may disclose preliminary information while stating that only representations in a definitive agreement may be relied upon. A buyer should not assume that signing an NDA makes every data-room statement warranted or complete.

Privileged information

Accidental disclosure of attorney-client or work-product material can create waiver arguments. The NDA and data-room protocol should address clawback, nonwaiver, and prompt return, but counsel should still screen documents before production.

Competitor bidders

A direct competitor reviewing a target may obtain highly sensitive pricing, customer, wage, and strategy information even if the deal never closes. Staged disclosure, redactions, clean teams, and delayed access can be more important than the NDA itself.

Ideas, Pitches, Inventors, and Investors

A frequent assumption is: “If I have an NDA, they cannot take my idea.” That statement is incomplete.

Ideas may be difficult to define

An idea may be general, already known, independently developed, or disclosed without enough specificity to identify what was protected. The NDA should describe the subject matter or establish a disclosure record without revealing the secret in the agreement itself.

Many investors resist NDAs

Institutional investors may review overlapping businesses and avoid NDAs at the preliminary pitch stage. That does not mean an inventor should disclose everything. Staged disclosure can protect the core secret until there is sufficient interest and a suitable agreement.

Submission releases

Entertainment, advertising, and product-submission forms may state that:

• No confidential relationship exists;
• Similar ideas may already be under development;
• The recipient may use unprotectable elements;
• Compensation is owed only under a later written agreement; or
• Claims must be arbitrated.

Calling the document an “NDA” does not override such language.

Keep a disclosure record

Record:

• What was disclosed;
• When;
• By whom;
• To whom;
• Under which agreement;
• In what format;
• With what confidentiality marking; and
• What was withheld.

Litigation years later often turns on chronology and specificity.

Technology, Software, and Product-Development NDAs

Technology NDAs require special care because evaluation itself may involve copying, testing, benchmarking, reverse engineering, or generating derivative observations.

Reverse engineering

An NDA may prohibit decompiling, disassembling, analyzing, or reverse engineering a sample or software. The clause should fit applicable law, the product, and the intended evaluation.

Residual knowledge

A residuals clause permits use of information retained in unaided memory, sometimes excluding deliberate memorization. This may be useful to large technology companies that receive many disclosures, but dangerous to a discloser whose most valuable information is conceptual and memorable.

A broad residuals clause can consume the NDA: if remembered information may be used freely, the non-use promise may protect only documents, not knowledge.

Feedback

A clause allowing unrestricted use of “feedback” can transfer valuable suggestions, improvements, bug reports, or design concepts without compensation. Define feedback and distinguish it from the discloser’s confidential information and intellectual property.

Joint development

An NDA alone is not a joint-development agreement. It usually does not adequately resolve:

• Background technology;
• Ownership of new developments;
• Jointly created inventions;
• Patent prosecution;
• Licensing rights;
• Commercialization;
• Open-source use;
• Data ownership;
• Model training; or
• Exit rights.

Confidentiality and Intellectual-Property Ownership

One of the most damaging mistakes is signing an “NDA” that also assigns intellectual property.

Read for words such as:

• Assign;
• Transfer;
• Work made for hire;
• Invention;
• Improvement;
• Derivative;
• Feedback;
• Perpetual;
• Irrevocable;
• Worldwide;
• Exclusive;
• Name and likeness;
• Handle;
• Domain; and
• Social-media account.

A devastating example: signing away a name and brand identity

In JLM Couture, Inc. v. Gutman, 24 F.4th 785 (2d Cir. 2022), bridal designer Hayley Paige Gutman had signed an employment agreement granting extensive rights in her name, trademarks, and designs. After the relationship collapsed, an injunction barred her from competing during the remaining contractual term and from using her own name and derivatives in trade or commerce without consent. The dispute also engulfed valuable social-media accounts with more than a million followers.

The Second Circuit enforced significant contract provisions but vacated the transfer of exclusive control over disputed social-media accounts because ownership had not been adequately determined. The case is not merely about an NDA, but that is precisely the lesson: documents presented as employment, confidentiality, or intellectual-property forms may contain provisions that reshape a person’s identity, career, and digital assets.

A signer should never assume “confidentiality paperwork” affects only secrets.

Trade Secrets: The Legal Protection Behind Many NDAs

New York common law

New York protects trade secrets primarily through common law. Under Ashland Management, courts consider secrecy, access, protective measures, value, development effort, and ease of lawful duplication.

A claimant generally must show:

• Possession of a qualifying trade secret; and
• Use or disclosure in breach of an agreement, confidence, or duty, or acquisition through improper means.

Federal Defend Trade Secrets Act

The DTSA supplies a federal civil action for misappropriation of trade secrets related to products or services used or intended for use in interstate or foreign commerce.

Potential remedies include:

• Injunctions;
• Affirmative protective measures;
• Actual-loss damages;
• Unjust-enrichment damages not included in actual loss;
• A reasonable royalty;
• Up to double damages for willful and malicious misappropriation; and
• Attorneys’ fees in specified circumstances.

The DTSA’s extraordinary ex parte seizure remedy exists only under demanding statutory conditions. It is not a routine shortcut.

The information must remain secret

A trade secret once publicly disclosed may lose the source of its value. Businesses should use:

• Role-based access;
• Confidentiality legends;
• Secure repositories;
• Vendor controls;
• Visitor restrictions;
• Device management;
• Download monitoring;
• Training;
• Incident response; and
• Exit procedures.

The NDA is one layer, not the entire system.

Remedies: What Can Happen After a Breach?

Injunction

A discloser may ask a court to stop:

• Publication;
• Use of a trade secret;
• Product launch;
• Competitive employment;
• Customer solicitation;
• Disclosure to a buyer or competitor;
• Access to systems;
• Destruction of evidence; or
• Continued possession of files.

The practical stakes are immediate. A preliminary injunction can determine the commercial outcome long before trial.

A clause stating that breach “shall cause irreparable harm” may support an application, but it does not eliminate the court’s independent analysis.

Damages

Potential measures include:

• Lost profits;
• Lost business value;
• Reasonable royalty;
• Cost of remediation;
• Investigation expenses where recoverable;
• Contract damages;
• Liquidated damages if enforceable;
• Unjust enrichment under applicable law; and
• Statutory trade-secret damages.

Under New York common law, damages theories have limits. In E.J. Brooks Co. v. Cambridge Security Seals, 31 N.Y.3d 441 (2018), the Court of Appeals rejected defendant “avoided development costs” as a stand-alone compensatory measure under the New York claims before it because compensatory damages must correspond to the plaintiff’s loss. The underlying jury had found liability after former employees allegedly brought a confidential manufacturing process to a rival; the dispute shows how damages methodology can change millions of dollars in claimed exposure.

Prejudgment interest

New York contract damages may carry prejudgment interest under CPLR 5001, potentially increasing exposure significantly in a long-running case.

Liquidated damages

A fixed amount per breach can create enormous leverage. Courts distinguish a reasonable estimate of difficult-to-calculate loss from an unenforceable penalty. Questions include:

• Was actual loss difficult to estimate when the contract was signed?
• Is the amount proportionate to anticipated harm?
• Does each email, recipient, day, or statement count separately?
• Is there a cap?
• Can liquidated damages be combined with actual damages and an injunction?

Attorneys’ fees

New York generally follows the American Rule: each party pays its own attorneys’ fees unless a statute, court rule, or enforceable agreement shifts them. A one-way fee clause can make defending even a weak NDA claim financially dangerous.

Indemnification

An NDA may require the recipient to defend and indemnify the discloser, affiliates, officers, employees, and representatives. That is broader than ordinary contract damages and should not be overlooked.

Arbitration

Arbitration can affect:

• Public access;
• Discovery;
• Appeal rights;
• Speed;
• Emergency relief;
• Arbitrator selection;
• Fees; and
• Where the dispute is heard.

The Denson litigation is a stark illustration: an arbitration award of nearly $50,000 was issued and confirmed before the First Department vacated it. “Private dispute resolution” does not mean low cost or low consequence.

Destruction of evidence

Once a dispute is reasonably anticipated, deleting messages, wiping devices, destroying notes, or altering repositories may create spoliation issues. A return-or-destroy obligation must yield to a lawful litigation hold.

Common NDA Myths

Myth 1: “It is standard.”

There is no universal NDA. A venture-capital pitch, employee onboarding, pharmaceutical collaboration, acquisition, settlement, and software evaluation present different risks.

Myth 2: “It only says I cannot tell anyone.”

It may also prohibit use, competition, hiring, customer contact, reverse engineering, publication, investment, or ownership claims.

Myth 3: “A mutual NDA is automatically fair.”

Identical obligations can burden parties differently. One side may disclose little while gaining access to the other’s core technology.

Myth 4: “If it is public, the NDA no longer matters.”

Some information may remain nonpublic; a compilation may remain secret; and the recipient may have contractual duties concerning use, confirmation, or derived material.

Myth 5: “If I remember it, I may use it.”

Memory does not automatically defeat confidentiality. The answer depends on the clause, information, and law. A residuals provision must be read carefully.

Myth 6: “If I created it, I own it.”

Employment, consulting, work-made-for-hire, and assignment provisions may allocate ownership elsewhere.

Myth 7: “If they breach first, I am free to disclose everything.”

Confidentiality may survive termination and may be independent of other obligations. Self-help disclosure can create separate liability.

Myth 8: “The NDA means their information is accurate.”

Many NDAs expressly disclaim accuracy and reliance. Definitive agreements may be the only source of enforceable representations.

Myth 9: “The court will fix anything unreasonable.”

New York courts may partially enforce some provisions, but they do not have to rewrite an overreaching contract. Denson refused wholesale judicial redrafting; EarthWeb declined to expand a confidentiality clause into a noncompete.

Myth 10: “No damages occurred, so the breach does not matter.”

The other side may seek an injunction, contractual fees, investigation costs, nominal damages, liquidated damages, or statutory trade-secret remedies.

Myth 11: “I can disclose misconduct because every NDA is void.”

NDAs are not generally void. Protected reporting rules are specific. A signer should report lawfully and avoid unnecessary public disclosure or removal of unrelated files.

Myth 12: “The company cannot enforce it because I signed quickly.”

Failure to read ordinarily does not excuse signing. Fraud, duress, unconscionability, indefiniteness, illegality, and public policy are fact-specific defenses—not a dependable review strategy.

Drafting Pitfalls That Create Litigation

Defining everything as confidential

Overbreadth creates uncertainty and can undermine enforcement. Protect what matters and explain why.

No permitted-purpose clause

A prohibition on disclosure without a use restriction may leave the central competitive risk unaddressed.

No exclusions

Without exclusions, the recipient may appear bound concerning its own prior knowledge, public facts, and independent work.

Inconsistent documents

The NDA, letter of intent, employment agreement, handbook, data-room terms, services agreement, and settlement may define confidentiality differently.

Hidden restrictive covenants

A confidentiality form should not quietly add a noncompete, nonsolicitation, no-hire, standstill, non-circumvention, or non-disparagement obligation without deliberate review.

Undefined affiliates and representatives

A global corporate family may include direct competitors or entities the signer never considered.

Impossible deletion

Absolute deletion promises may conflict with backups, regulation, legal holds, and professional recordkeeping.

No whistleblower or legal-process carveout

A clause that appears to block lawful government communications invites statutory and public-policy problems.

Missing DTSA notice

Employers using agreements governing confidential information with employees, contractors, or consultants should address the federal immunity notice requirement.

Perpetual protection for ordinary information

Trade secrets and everyday business information should not always receive identical duration.

Unrestricted residuals

A residuals clause may allow the recipient to use the very concepts the discloser intended to protect.

Overbroad feedback license

“Feedback” should not become a free assignment of inventions and improvements.

Automatic injunction language

A contractual acknowledgement can help, but it should not imply that every minor breach causes irreparable harm.

Stacked remedies

Liquidated damages, actual damages, disgorgement, indemnity, attorneys’ fees, and injunctions may create duplicative or punitive exposure.

One-sided venue

A New York forum may be convenient for one party and costly for another. Remote parties should assess personal jurisdiction, travel, counsel, and emergency-relief provisions.

Confidentiality with no security plan

The agreement promises protection; the organization must operationalize it.

Before You Disclose: A Practical Checklist

Identify the information

• What exactly will be disclosed?
• Is it already public?
• Is it a trade secret, ordinary confidential information, personal data, privileged material, or third-party information?
• Do you have the right to disclose it?
• Can sensitive details be withheld or redacted?

Identify the purpose

• What decision or work requires disclosure?
• Is the recipient allowed only to evaluate, or also to test and develop?
• When does the purpose end?

Identify the recipient

• Is the recipient a competitor?
• Which employees will receive access?
• Will affiliates, investors, lenders, or contractors receive it?
• Are any recipients overseas?
• Are clean-team controls needed?

Protect before disclosure

• Sign the NDA before disclosure;
• Mark materials appropriately;
• Use secure transfer;
• Stage access;
• Keep a disclosure log;
• Restrict downloads;
• Disable unnecessary printing;
• Watermark critical files;
• Review privileged information; and
• Avoid sending the crown jewels at the first meeting.

Coordinate contracts

• Does a later agreement supersede the NDA?
• Will confidentiality survive if the deal fails?
• Are intellectual-property rights addressed elsewhere?
• Does the NDA conflict with a standstill or exclusivity provision?

Before You Sign as Recipient: A Practical Checklist

Scope

• Can you identify what is confidential?
• Are oral disclosures covered?
• Are notes and derived analyses covered?
• Does the definition include information not provided by the discloser?

Exclusions

• Public information;
• Prior knowledge;
• Third-party receipt;
• Independent development;
• Authorized release; and
• Burden and method of proof.

Use

• Is the permitted purpose broad enough to do the intended work?
• May you copy, test, benchmark, or analyze?
• Is reverse engineering prohibited?
• Is AI use prohibited or controlled?

Recipients

• May you share with CorwinLaw, accountants, insurers, lenders, and necessary consultants?
• Must each person sign a separate NDA?
• Are you strictly liable for independent representatives?

Duration

• How long does the agreement last?
• How long does each duty survive?
• Are trade secrets treated differently?

Return and retention

• Can you comply across backups and archives?
• May you retain required legal or regulatory copies?
• Who must certify deletion?

Protected rights

• Are legally compelled disclosure and protected reporting addressed?
• Is DTSA immunity notice included where required?
• Does the clause improperly restrict agency communications, testimony, or claims?

Hidden provisions

• Noncompete;
• Nonsolicitation;
• No-hire;
• Non-circumvention;
• Standstill;
• Non-disparagement;
• Intellectual-property assignment;
• Feedback license;
• Name or likeness rights;
• Arbitration;
• Indemnification;
• Attorneys’ fees;
• Liquidated damages;
• Personal guaranty; and
• One-sided forum selection.

Practical ability to perform

• Do your systems satisfy the promised security standard?
• Can your business segregate the information?
• Are internal teams trained?
• Do vendors and AI tools comply?

When a Breach Is Suspected

For the disclosing party

1. Preserve evidence immediately.
2. Identify the agreement and exact information.
3. Confirm that the information was actually disclosed under the agreement.
4. Determine whether it remains confidential or qualifies as a trade secret.
5. Review access, download, email, device, and repository logs.
6. Assess whether use or disclosure is ongoing or threatened.
7. Send a carefully drafted preservation or demand letter if appropriate.
8. Consider emergency injunctive relief.
9. Avoid public accusations unsupported by evidence.
10. Coordinate legal, cybersecurity, human-resources, communications, and business teams.

For the accused recipient

1. Do not delete or alter anything.
2. Suspend disputed use without admitting liability where appropriate.
3. Preserve devices, messages, access logs, and development history.
4. Segregate the challenged material.
5. Identify prior knowledge and independent-development evidence.
6. Notify insurers if coverage may exist.
7. Review obligations to customers, employers, and regulators.
8. Avoid contacting witnesses or the discloser impulsively.
9. Have CorwinLaw assess injunction risk and response strategy.
10. Comply with lawful holds and court orders.

Influential and Cautionary Cases

Ashland Management Inc. v. Janien—Secrecy must be real

The New York Court of Appeals applied the classic trade-secret factors and upheld the finding that the claimed model was reproducible from public information. It also affirmed a $625,000 lost-profits award to the former employee on his contract counterclaim after the employer rejected a proposed NDA and terminated him.

Why it matters: An aggressive claim of secrecy can backfire when the information is not truly secret and the claimant has its own contractual exposure.

EarthWeb, Inc. v. Schlack—An NDA should not become an unnegotiated noncompete

The court denied an injunction and refused to broaden a confidentiality clause through inevitable disclosure. The fast-moving nature of the internet industry and lack of actual misappropriation mattered.

Why it matters: Courts scrutinize attempts to use confidentiality as a career restraint.

Estee Lauder Companies Inc. v. Batra—Confidential knowledge can stop competitive employment

A senior executive with current product and strategic information was enjoined for five months from joining a direct competitor, with salary continuation.

Why it matters: A tailored agreement plus strong evidence can produce immediate, career-altering relief.

Denson v. Donald J. Trump for President, Inc.—Overbreadth can create years of costly litigation and still fail

Sweeping, indefinite non-disclosure and non-disparagement clauses produced arbitration and enforcement proceedings, including an award of nearly $50,000, before being invalidated as to the signer.

Why it matters: The signer can suffer heavily even when the clause ultimately proves unenforceable; the drafter can lose protection through excess.

E.J. Brooks Co. v. Cambridge Security Seals—Liability does not end the damages fight

Former employees allegedly carried a confidential manufacturing process to a competitor. The New York Court of Appeals later rejected the particular avoided-cost damages theory under New York law.

Why it matters: Proving misappropriation and proving recoverable damages are separate battles.

JLM Couture, Inc. v. Gutman—The “NDA package” may reach identity, career, and digital property

A designer’s agreement restricted competition and use of her own name in commerce and sparked a major dispute over social-media accounts.

Why it matters: Read every clause. Confidentiality documents often sit beside provisions with far greater personal and commercial consequences.

The Most Important Question: What Is the Real Risk?

Before drafting or signing, ask:

What specific harm are we trying to prevent?

Possible answers include:

• A competitor receiving pricing;
• A buyer contacting customers prematurely;
• Source code entering a public model;
• A former employee taking a product roadmap;
• An investor using an idea outside the evaluation;
• A vendor exposing personal data;
• A settlement announcement harming reputation;
• A manufacturer reverse engineering a prototype; or
• A deal leak destabilizing employees and customers.

The NDA should be designed around that risk. If the real concern is competition, intellectual-property ownership, cybersecurity, non-solicitation, publicity, or data privacy, confidentiality language alone may be insufficient—or may become dangerously overbroad when forced to do another agreement’s job.

Final Perspective

An NDA can be short and still be consequential.

The right question is not:

“Is this a standard NDA?”

The better questions are:

• What information is protected?
• What may I do with it?
• Who else may receive it?
• How long am I bound?
• What rights am I giving up besides disclosure?
• What happens if a dispute arises?
• Can I actually comply?
• Does the agreement preserve lawful reporting and legal process?
• Does it assign intellectual property, my name, my work, or my future opportunities?
• Would I still sign if the relationship ended badly tomorrow?

“Just sign it” is not legal analysis.

A good NDA is neither a ceremonial form nor an instrument of intimidation. It is a carefully tailored agreement that allows useful information to move while preserving legitimate rights on both sides. CorwinLaw can assist businesses, employees, founders, investors, purchasers, sellers, and professionals in drafting, reviewing, negotiating, and enforcing NDAs under New York and related federal law.

Visit www.corwinlaw.net.

Important Notice

This Codex provides general educational information and does not constitute legal advice. It does not create an attorney-client relationship. Laws and interpretations change, and the enforceability of any NDA depends on its exact language and facts. Consult CorwinLaw concerning a specific agreement or dispute.

The CorwinLaw Codex

Explore additional legal guides, practical resources, and practice-area reference materials at:

https://www.corwinlaw.net