Non-Disclosure Agreement Checklist For Startups And Small Businesses

Startups and small businesses often need to share sensitive information with employees, contractors, investors, or partners to grow and operate. A non-disclosure agreement (NDA) is a practical way to protect confidential business information, but using or signing an NDA without understanding its terms can expose your business to unnecessary risk. Common mistakes include relying on generic templates, overlooking state-specific requirements, or agreeing to terms that are too broad, too restrictive, or simply unenforceable. This guide explains what to check before you sign or send an NDA, how state law can affect your agreement, and practical steps for founders and operators to avoid common pitfalls.

What Is a Non-Disclosure Agreement?

A non-disclosure agreement is a contract between two or more parties that restricts the sharing or use of confidential information. NDAs are a standard tool for US startups and small businesses to protect trade secrets, business strategies, customer lists, proprietary technology, financial data, and other sensitive information. NDAs can be mutual (both sides share information) or one-way (only one side discloses information).

There is no federal law requiring NDAs, but the Defend Trade Secrets Act (DTSA) of 2016 provides a federal baseline for protecting trade secrets. The DTSA allows businesses to sue in federal court if their trade secrets are misused, but most NDA rules and enforcement are governed by state contract law. State laws can vary widely. For example, California law generally voids NDAs that act as non-competes or restrict post-employment activity beyond what is necessary to protect trade secrets, while Texas and New York have different standards for enforceability and duration.

NDAs are commonly used when:

• Pitching to investors or potential partners
• Hiring employees or independent contractors
• Discussing joint ventures, mergers, or acquisitions
• Sharing product roadmaps, source code, or technical information
• Allowing vendors or consultants access to business data

Understanding what your NDA covers, what it does not, and how it may be enforced in your state is critical for protecting your business and avoiding legal disputes.

Checklist: What To Review In an NDA

Before you sign or send an NDA, use this checklist to review key areas. Addressing these points helps reduce risk and ensures the NDA fits your business needs:

• Parties: Are all relevant parties named correctly? If you are signing as a company, is the company (not just an individual) listed as the party? For example, if you are a Delaware C-corp, ensure the company name and state of incorporation are accurate.
• Definition of Confidential Information: Is the definition clear and specific? Does it cover only what is necessary, or is it so broad that it could include public or trivial information? For example, "all information shared" may be too broad and unenforceable in some states.
• Obligations of Receiving Party: What must the receiving party do to protect the information? Are there requirements for how information must be stored, labeled, or handled? For example, must data be encrypted or physically secured?
• Permitted Disclosures: Are there clear exceptions, such as disclosures required by law, to employees who need to know, or to advisors (like accountants or lawyers) who are themselves bound by confidentiality?
• Exclusions: Does the NDA exclude information that is already public, independently developed, or lawfully obtained from another source? This avoids disputes about information that is not truly confidential.
• Term and Duration: How long does the NDA last? Is the duration reasonable under state law? For example, a five-year term may be enforceable in Texas but not in California for certain types of information.
• Jurisdiction and Governing Law: Which state law applies? Is it your home state, the other party's state, or another jurisdiction? This choice can affect enforceability and remedies.
• Remedies and Liability: What happens if there is a breach? Are there limits on damages, or are specific remedies like injunctions (court orders to stop disclosure) available? Does the NDA specify attorney fees or liquidated damages?
• Return or Destruction of Information: What must happen to confidential information at the end of the relationship? Is there a process for certifying destruction or return?
• Signatures: Are all parties signing, and are the signers authorized to bind their company? For example, a founder may need board approval to sign on behalf of a corporation.

Going through this checklist can help you spot red flags and avoid agreeing to terms that are not practical or enforceable for your business. If you are unsure about any terms, consider seeking legal advice before signing.

Common NDA Mistakes For Startups and Small Businesses

NDAs are often treated as boilerplate, but several common mistakes can create risk for startups and small businesses:

• Using generic templates: Many online templates are not tailored to your state or business needs. For example, a template with a five-year confidentiality period may not be enforceable in California for post-employment information.
• Overly broad definitions: Defining confidential information as "all information" can make the NDA hard to enforce and may deter partners from signing. Courts may strike down NDAs that are vague or overreaching.
• Missing exclusions: Failing to exclude public, independently developed, or previously known information can create confusion and disputes. For example, if an employee brings knowledge from a previous job, is that covered?
• No clear term: Not specifying how long confidentiality obligations last can lead to disagreements. Some states limit the enforceable period for NDAs, especially after employment ends.
• Ignoring state law: NDAs that violate state public policy (such as California's restrictions on post-employment confidentiality) may be void. For example, California courts will not enforce NDAs that act as non-competes.
• Not updating NDAs for remote work: If your team or contractors are in multiple states, the NDA should clarify which state law applies and how information is protected across jurisdictions. For example, a remote developer in Florida may be subject to different rules than a founder in New York.
• Not considering practical enforcement: If enforcing the NDA would be costly or difficult, consider whether other protections (like limiting access or using technical controls) are needed. For example, if your partner is overseas, will you be able to enforce the NDA in their country?
• Forgetting to sign or properly authorize: An unsigned NDA or one signed by someone without authority may not be enforceable. Always confirm who has authority to sign on behalf of your company.

For example, a startup founder in Texas may use a California NDA template that includes non-compete language, only to find it unenforceable in Texas courts. Or a small business may sign an NDA with an investor that requires all disputes to be resolved in New York, creating unexpected legal costs. Reviewing your NDA with a contracts lawyer can help avoid these issues.

Another common scenario is a founder sharing a product roadmap with a potential investor. If the NDA does not clearly define what is confidential or does not address what happens if the investor passes on the deal but later invests in a competitor, the founder may have little recourse. Similarly, if a business hires a contractor in a state with strict limits on post-employment confidentiality, an NDA that tries to restrict all future use of knowledge may be struck down.

State Law Differences and Industry Considerations

While the federal Defend Trade Secrets Act provides a baseline for protecting trade secrets, most NDA terms are governed by state contract law. Key state law differences include:

• Duration: Some states, like California, limit how long post-employment confidentiality can last, often restricting it to the period during which information remains a trade secret. Others, like Florida, may allow longer periods if reasonable and necessary to protect legitimate business interests.
• Scope: States may differ on what counts as protectable confidential information. For example, customer lists may be protected in some states but not others, depending on how they are compiled and used.
• Enforceability: Some states are more likely to enforce NDAs, while others may strike down overly broad or vague terms. For instance, New York courts often require NDAs to be reasonable in scope and duration, while California courts are more restrictive.
• Remedies: The availability of injunctions or damages can vary by state, as can the ability to recover attorney fees. Some states allow for liquidated damages (a set amount for breach), but only if the amount is reasonable and not a penalty.
• Public policy exceptions: Many states will not enforce NDAs that prevent whistleblowing or reporting illegal activity, and some states have specific laws protecting employee mobility.

Industry rules can also affect NDA terms. For example, NDAs in healthcare or finance may need to comply with HIPAA or GLBA requirements for handling protected health or financial information. Technology companies often need to address source code, algorithms, or patentable inventions in more detail. In the life sciences sector, NDAs may need to address data sharing with research partners and compliance with FDA regulations.

When working with parties in different states, consider which state law will apply and whether the NDA is enforceable in each relevant jurisdiction. For example, if your company is based in Delaware but your contractor is in Illinois, you may need to specify which state's law governs the NDA and whether both states would enforce the agreement. If your business operates in a regulated industry, check if additional confidentiality or data protection rules apply. For business sales or mergers, ensure your NDA addresses the specific needs of the transaction, such as protecting due diligence materials or customer data.

Practical example: A SaaS startup in California hires a remote developer in Texas. The NDA should specify which state's law applies, clarify how code and business data are protected, and ensure that the agreement does not include unenforceable non-compete language. If the developer later joins a competitor, the enforceability of the NDA may depend on whether the information is still a trade secret and whether the NDA's restrictions are reasonable under Texas and California law.

When To Review or Update Your NDA

NDAs should not be one-size-fits-all. Review or update your NDA in these situations:

• You are hiring employees or contractors in a new state, which may have different rules about confidentiality and enforceability.
• Your business is entering a new industry or regulated sector, such as healthcare, finance, or education, which may require industry-specific confidentiality terms.
• You are sharing information with a new type of partner, such as an investor, joint venture, or acquirer, which may require different exclusions, remedies, or disclosure permissions.
• State laws change, such as new limits on confidentiality, data protection, or employee mobility.
• You are moving from in-person to remote or cross-border work, which may affect which state or country's law applies and how information is protected.
• Your business model, technology, or team changes, requiring updates to what is considered confidential or how information is handled.

For example, if your startup expands from California to Texas, you may need to adjust NDA terms to reflect Texas law, especially regarding duration and scope. Or if you begin working with healthcare data, your NDA may need to reference HIPAA compliance and specific data handling requirements. If you start sharing source code with a partner in another country, you may need to address cross-border enforcement and data export restrictions.

It is also a good idea to review NDAs annually, especially if your business is growing, entering new markets, or adopting new technology. This helps ensure your agreements remain practical and enforceable. For example, a SaaS company that starts using AI tools may need to update NDAs to cover new types of data or algorithms. If you raise a new funding round, you may need to update NDAs for investor due diligence.

Checklist for reviewing or updating your NDA:

• Confirm all parties and signers are correct and authorized
• Update the definition of confidential information to match current business needs
• Check that exclusions and permitted disclosures are clear and up to date
• Review the term and duration for reasonableness under current state law
• Ensure the governing law and jurisdiction are still appropriate
• Update remedies, damages, and enforcement provisions as needed
• Address any new industry or regulatory requirements

Regularly updating your NDA helps avoid disputes, ensures compliance with changing laws, and protects your business as it evolves.

FAQs

Is an NDA enforceable in every US state?

NDAs are generally enforceable in most US states, but the specific terms that are enforceable can vary. Some states, like California, have strict limits on confidentiality and non-compete clauses, especially after employment ends. Other states may allow broader protections. Always check which state law applies and whether your NDA terms are reasonable and consistent with local rules. For example, a five-year post-employment NDA may be enforceable in Florida but not in California.

How long should an NDA last?

The duration of an NDA depends on the type of information and state law. Many NDAs last for two to five years, but some states limit how long confidentiality can be enforced after employment. For trade secrets, obligations may last as long as the information remains secret. Always specify the term in the NDA and check if your state has specific limits. For example, New York courts may enforce a longer NDA if the information is highly sensitive, while California courts may only enforce confidentiality for as long as the information is a trade secret.

What happens if someone breaches an NDA?

If someone breaches an NDA, the disclosing party may seek remedies such as an injunction (court order to stop disclosure), monetary damages, or both. The exact remedies depend on the NDA terms and state law. Some NDAs include specific provisions for attorney fees or liquidated damages, but courts may not always enforce these if they are unreasonable. For example, a court may refuse to enforce a liquidated damages clause if it is seen as a penalty rather than a reasonable estimate of loss.

Do I need a lawyer to draft or review an NDA?

While you can use templates or draft your own NDA, having a lawyer review or customize the agreement can help ensure it is enforceable and fits your business needs. This is especially important if you operate in multiple states or a regulated industry, or if you are sharing highly sensitive information. Legal review can also help identify state-specific issues or industry requirements you may have missed.

Can I use the same NDA for employees, contractors, and partners?

It is possible to use a similar NDA for different parties, but you may need to adjust terms based on the relationship. For example, employee NDAs may need to comply with state labor laws, while partner or investor NDAs may require different exclusions or remedies. Tailoring the NDA to each situation helps avoid disputes and ensures the agreement is practical. For instance, an NDA for a vendor may need to address data security requirements, while an NDA for an investor may focus on business plans and financials.

Key Takeaways

• Non-disclosure agreements are essential for protecting sensitive business information, but their effectiveness depends on clear, enforceable terms tailored to your business and state law.
• State law, industry rules, and the specific relationship between parties can all affect what an NDA should include and how it is enforced.
• Common mistakes include using generic templates, missing exclusions, failing to specify duration, and ignoring state-specific requirements.
• Regularly review and update your NDAs as your business grows, laws change, or you enter new markets or industries.
• Consider legal review for NDAs involving valuable trade secrets, cross-state relationships, or regulated industries to reduce risk and avoid disputes.

If you need help reviewing or updating a non-disclosure agreement for your startup or small business, contact our team at (888) 449-8437 or team@sprintlaw.com. Where legal services are required, they are delivered by licensed lawyers at trusted US law firms through the Sprintlaw platform.