What To Include In A Confidentiality Clause

A good confidentiality clause should say what counts as confidential information, who can use it, why they can use it, how they must protect it, how long the obligation lasts, and what happens if things go wrong.

That sounds simple, but the details matter. A clause that works for a one-off quote may not be enough when you're sharing customer lists, pricing models, product designs, software code, recipes, marketing plans or trade secrets.

If you're reviewing a service agreement, supplier agreement or collaboration agreement, your confidentiality clause is there to protect the commercial value of what you're sharing. The better it fits your business, the easier it's to set expectations early and avoid disputes later.

What Should A Confidentiality Clause Include?

A confidentiality clause should include the information covered, the permitted purpose, who can access it, security standards, exclusions, time limits, return or destruction obligations, and remedies for breach.

At a practical level, you want the clause to answer these questions:

• What information is confidential? For example, pricing, business plans, customer data, source code, formulas, designs, processes, financial information and internal documents.
• Who is bound? The contracting party, plus its employees, contractors, advisors, affiliates or subcontractors if they may see your information.
• What can they use it for? The purpose should be specific, such as providing services under the agreement or assessing a potential collaboration.
• What can they not do? They shouldn't copy, publish, reverse engineer, sell, misuse or share the information outside the permitted purpose.
• How should they protect it? The clause should set a sensible standard of care and any specific security requirements.
• How long does the duty last? Some information may only need protection for a few years, while trade secrets may need protection for as long as they remain trade secrets.
• What happens at the end? The receiving party should return or delete confidential information, subject to limited exceptions like legal recordkeeping or backup systems.

For example, say Maya runs a specialty food business and shares a new sauce formula with a contract manufacturer under a product supply agreement. A vague promise to keep things confidential may not be enough. Maya's contract should say the manufacturer can only use the formula to make products for her business, must restrict access to staff who need it, must not make a competing product using the formula, and must return or destroy production notes when the relationship ends.

What Counts As Confidential Information?

Confidential information is usually anything non-public that has business value because it isn't generally known, but your contract should define it clearly.

A well-drafted definition can cover information shared in different ways, including:

• written documents and emails
• verbal discussions and meeting notes
• software, code, databases and technical materials
• business plans, forecasts and financial data
• customer, supplier and prospect lists
• pricing, margins and discount structures
• marketing plans and launch strategies
• product samples, prototypes, formulas and designs
• trade secrets and know-how

You don't need to list every possible document, but you do need enough detail that both sides understand what is covered.

Many contracts also say information is confidential whether or not it's marked confidential. That can be useful, especially when information is shared verbally or through a shared workspace. If the other side pushes back, a middle ground is to require verbal information to be confirmed in writing within a set period, such as within 30 days.

The clause should also include sensible exclusions. Usually, confidentiality doesn't apply to information that:

• is already public through no fault of the receiving party
• was already known by the receiving party before disclosure
• is received lawfully from someone else who is allowed to share it
• is independently developed without using the confidential information
• must be disclosed by law, court order or a government authority

These carve-outs help keep the clause fair and more workable. If a clause tries to cover everything forever, including information that's already public, it can become harder to enforce and harder to manage in practice.

How Should The Receiving Party Be Allowed To Use It?

The receiving party should only be allowed to use confidential information for the purpose set out in the contract.

This is one of the most important parts of the clause. A confidentiality obligation isn't just about keeping information secret. It's also about stopping the other side from using your information for their own benefit.

For example, if you send a supplier your sales data so they can forecast stock levels, they shouldn't be able to use that data to approach your customers, adjust pricing for your competitors, or build a competing product strategy.

Your permitted use wording might be tied to:

• performing services under the agreement
• evaluating a proposed transaction or collaboration
• manufacturing your products
• integrating software or systems
• providing support, maintenance or implementation services

You should also think carefully about who can see the information. If the other party uses employees, independent contractors, consultants, accountants, attorneys, cloud providers or subcontractors, the contract should say access is limited to people who need to know the information for the permitted purpose.

It should also say the receiving party is responsible if those people misuse the information. Without that wording, you may face a messy argument about who caused the breach and whether the main contracting party is accountable.

How Long Should Confidentiality Obligations Last?

The right time period depends on the type of information, but many commercial contracts use 2 to 5 years for ordinary confidential information and longer protection for trade secrets.

Not all confidential information has the same shelf life. A marketing plan for next quarter may lose value quickly. A customer list, source code, manufacturing process or formula may stay valuable for years.

A practical approach is to split the obligation into two categories:

• General confidential information: protected for a fixed period, often 2, 3 or 5 years after disclosure or after the contract ends.
• Trade secrets: protected for as long as the information remains a trade secret under applicable law.

That second category matters because US trade secret law focuses on whether the information has independent economic value from not being generally known and whether you take reasonable steps to keep it secret. A fixed 2-year limit may accidentally weaken protection for information that should remain secret much longer.

State law can affect how courts view confidentiality clauses, especially if the clause is unusually broad or operates like a restriction on someone's work after the relationship ends. If your clause is tied to employees, contractors, sensitive technical information or long-term restrictions, it's worth getting tailored advice for your state and industry.

How Do Trade Secrets Change The Clause?

Trade secrets need stronger and more careful protection because federal law gives you extra rights only if the information is genuinely treated as secret.

The Defend Trade Secrets Act is the main federal law that lets businesses bring civil claims for trade secret misappropriation. A trade secret can include business, technical, financial or economic information if it has value because it's secret and you have taken reasonable measures to keep it secret.

Reasonable measures often include more than just having a confidentiality clause. Depending on your business, they may include:

• limiting access to people who genuinely need it
• using password protection and access controls
• marking sensitive documents as confidential
• using secure file sharing instead of open links
• training staff on confidentiality expectations
• having contractors and suppliers sign written confidentiality terms, such as a confidentiality and invention assignment agreement
• keeping records of who received sensitive information

If you ever need to rely on trade secret protection, these practical steps can matter. A court will look at what you actually did to protect the information, not just what your contract says.

The Defend Trade Secrets Act also has a specific notice rule for agreements with employees and independent contractors. If you want to preserve the ability to claim exemplary damages and attorney fees under the federal trade secret law, your agreement should include notice of certain whistleblower immunity protections, or cross-reference a policy that provides that notice.

The Act also has a 3-year limitations period for a civil trade secret claim, generally running from when the misappropriation is discovered or should have been discovered with reasonable diligence. That doesn't mean you should wait. If trade secrets are at risk, acting quickly can help limit damage and preserve evidence.

What Security And Return Obligations Should You Include?

Your clause should require the receiving party to protect confidential information at least as carefully as it protects its own similar information, and preferably with clear minimum standards.

A common standard says the receiving party must use a reasonable degree of care, and no less than the care it uses for its own confidential information. For higher-risk information, you may want more detail.

Security Measures

Depending on what you're sharing, your contract may need to cover:

• restricted access on a need-to-know basis
• secure storage and transmission
• passwords, multi-factor authentication or encryption
• limits on downloading, copying or printing
• secure disposal of documents and files
• prompt notice if information is lost, accessed without permission or disclosed by mistake
• requirements that subcontractors follow the same confidentiality obligations

If confidential information includes personal information, privacy and data security rules may also apply. Federal law, including the Federal Trade Commission Act, can be relevant where privacy promises or data security practices are unfair or deceptive. State privacy and data breach notification laws may also apply, so the confidentiality clause may need to work alongside a data processing or information security addendum.

Return And Deletion

Your contract should say what happens when the project ends or when you ask for the information back. Usually, the receiving party should promptly return or destroy confidential information and certify destruction if requested.

There are often sensible exceptions. For example, a party may need to keep one archival copy for legal compliance, insurance, dispute management or automatic system backups. If you allow that, the contract should say the retained copy remains confidential and can't be used for any other purpose.

What Remedies And Carve-Outs Should You Include?

Your clause should include practical remedies for breach and clear carve-outs for legally required disclosure.

If confidential information is misused, money may not fully fix the problem. Once a customer list, source code file or unreleased product plan is out in the market, the damage can spread quickly.

For that reason, confidentiality clauses often say the disclosing party may seek injunctive relief, which is a court order to stop the misuse or disclosure. The contract may also allow claims for damages, indemnity for certain losses, and recovery of costs where allowed by law and the contract.

You should also include a process for mandatory disclosures. For example, if the receiving party is required to disclose information because of a subpoena, court order or government request, the clause can require them to:

• notify you promptly, unless legally prohibited
• only disclose the portion legally required
• cooperate with reasonable efforts to seek confidential treatment
• continue protecting the rest of the information

Two more clauses are often useful. First, a no license clause can say sharing confidential information doesn't give the receiving party ownership rights or permission to use your intellectual property beyond the contract purpose. Second, an ownership clause can confirm that your confidential information remains yours.

Copyright may also be relevant where the confidential material includes documents, designs, software code, training materials, photos or other original works. The US Copyright Act protects copyright ownership separately from confidentiality. In plain terms, keeping something secret and owning the copyright are different rights, so your contract should deal with both where needed.

Common Mistakes To Avoid

The biggest mistake is using a confidentiality clause that's too vague for the information you're actually sharing.

Watch out for these common issues:

• No clear purpose: If the contract doesn't limit how the information can be used, the other party may argue they had broad permission.
• Only written information is protected: Important information is often shared in calls, demos, meetings and shared dashboards.
• No obligations for subcontractors: If your supplier outsources part of the work, your information may be passed on without enough control.
• A fixed time limit for trade secrets: This can weaken long-term protection for formulas, code, processes and other high-value information.
• No return or deletion wording: The other party may keep files long after the project ends.
• No privacy or data security alignment: Customer or employee data may need more than a basic confidentiality promise.
• Overly broad employee restrictions: Employee confidentiality terms shouldn't block lawful reporting, protected workplace activity or rights that can't be waived under federal or state law.

Templates can be a useful starting point, but they often miss the commercial details that make the clause work for your business. A clause for a design agency, software vendor, manufacturer and joint venture partner shouldn't all look the same.

Frequently Asked Questions

Does A Confidentiality Clause Need To Be Mutual?

No, it doesn't always need to be mutual. If only one side is sharing sensitive information, a one-way clause may be enough. If both sides will share confidential information, a mutual clause is usually cleaner and fairer.

Can I Use A Standalone NDA Instead Of A Contract Clause?

Yes, you can use a standalone nondisclosure agreement, especially before a main contract is signed. Once the commercial deal is agreed, it's often best to include confidentiality terms in the main agreement too, so the obligations fit the actual services, payment terms, data flows and intellectual property arrangements.

Are Confidentiality Clauses Enforceable Against Employees And Contractors?

Yes, they can be enforceable if they're clear, reasonable and properly drafted. For employees and contractors, the clause should protect legitimate business information without trying to stop lawful whistleblowing, government reporting or protected workplace rights under federal law.

Should I Mark Every Confidential Document?

It's a good habit, but your contract shouldn't rely only on labels. Many important disclosures happen verbally or through systems, so the clause should protect information that's confidential by its nature, even if someone forgets to mark it.

Key Takeaways

• A confidentiality clause should define the information covered, the permitted purpose, who can access it, security requirements, time limits and remedies.
• Trade secrets need special care. Under the Defend Trade Secrets Act, you need reasonable measures to keep the information secret.
• Ordinary confidential information often has a fixed protection period, while trade secrets should usually stay protected for as long as they remain trade secrets.
• If you're sharing customer or employee data, privacy and data security obligations may need to sit alongside the confidentiality clause.
• Employee and contractor confidentiality terms should be tailored so they protect your business without blocking legal rights that can't be restricted.
• The best confidentiality clauses match the actual commercial risk, rather than using a generic one-size-fits-all promise.

If you'd like help with drafting or reviewing confidentiality clauses, supplier agreements, service contracts or trade secret protections for your business, you can reach our team at (888) 449-8437 or team@sprintlaw.com. Where legal services are required, they're provided by licensed US lawyers at ElevateNext US, LLC, a trusted US law firm, through the Sprintlaw platform.