Alex is Sprintlaw's co-founder and a legal technology leader. He holds law and media degrees from the University of Sydney and has been recognized by Australasian Lawyer, Lawyers Weekly and the Sydney Young Entrepreneur Awards for his work building Sprintlaw and improving access to business legal support.
For US startups, founders, and small business owners, protecting your confidential information is essential as you grow. Whether you are pitching to investors, exploring a partnership, or hiring new employees, you will likely be asked to sign or provide a non-disclosure agreement (NDA). Many founders make the mistake of using a generic NDA template or agreeing to terms without understanding their impact. Others overlook state-specific rules or fail to update NDAs as their business evolves. This guide explains what to look for in an NDA, how to negotiate key terms, and why state law matters. You will also find practical examples, checklists, and common mistakes to help you avoid costly errors and protect your business's interests.
What Is a Non-Disclosure Agreement?
An NDA is a contract that sets the rules for sharing confidential information between parties. NDAs are used in a wide range of business situations, such as:
- Discussing a potential merger, acquisition, or investment
- Working with contractors, consultants, or vendors
- Collaborating with other businesses or research partners
- Onboarding employees who will have access to sensitive information
The main purpose of an NDA is to prevent the receiving party from using or disclosing your confidential information without your permission. In the US, NDAs are generally enforced under state contract law, not federal law. This means the rules can vary depending on the state, the type of information, and the parties involved.
There are two main types of NDAs:
- Unilateral NDA: Only one party is disclosing confidential information (for example, a startup pitching to an investor).
- Mutual NDA: Both parties are sharing confidential information (for example, two companies exploring a joint venture).
Choosing the right type is the first step before you negotiate or sign an NDA. If both sides will share sensitive information, a mutual NDA is usually more balanced and easier to negotiate.
Key NDA Terms to Review and Negotiate
Not all NDAs are created equal. Before you sign, carefully review the following terms and consider negotiating where needed:
- Definition of Confidential Information: The contract should clearly state what is considered confidential. For example, does it cover only written documents, or also oral conversations, emails, prototypes, source code, or business plans? A vague definition can lead to disputes.
Example: If you are sharing a new product concept, make sure the definition includes drawings, mockups, and verbal presentations. - Obligations of the Receiving Party: The NDA should specify what steps the receiving party must take to protect your information. Common standards include using "reasonable care" or the same level of care as they use for their own confidential information. Some NDAs require stricter measures, such as encryption or limiting access to certain employees.
- Exclusions from Confidentiality: Most NDAs exclude information that is already public, independently developed by the receiving party, or obtained from another source without restriction. Make sure these exclusions are included and clearly worded to avoid disputes.
Checklist: Confirm that the NDA excludes information that is (1) public, (2) already known to the recipient, (3) independently developed, or (4) disclosed by a third party without breach. - Term and Duration: The NDA should state how long the confidentiality obligations last. Some NDAs last for a set period (such as two or five years), while others last indefinitely for trade secrets. Consider what is reasonable for your industry and the sensitivity of the information.
Example: For software source code, you may want an indefinite term; for a marketing plan, two to three years may be enough. - Permitted Disclosures: The NDA should clarify whether the receiving party can share information with employees, advisors, or affiliates, and under what conditions. Some NDAs require written consent before sharing, while others allow disclosure to those with a "need to know."
Checklist: List who can access the information and what safeguards are required. - Return or Destruction of Information: The agreement should specify what happens to confidential information at the end of the relationship. Does the receiving party need to return all documents, destroy electronic files, or certify destruction?
Example: After a failed deal, you may want all prototypes and documents returned or destroyed within 30 days. - Remedies and Liability: The NDA should state what happens if the agreement is breached. Some NDAs allow for monetary damages, while others provide for injunctive relief (a court order to stop disclosure). Consider whether the remedies are practical and fair.
Checklist: Check if the NDA limits liability, requires arbitration, or waives certain remedies. - Jurisdiction and Governing Law: The NDA should specify which state's law applies and where disputes will be resolved. This can affect your rights, the cost of enforcement, and the likelihood of success.
Example: If you are based in Texas but the other party is in California, consider which state's law is more favorable to your position.
Before signing, walk through each term and ask if it fits your business's needs. If you are unsure, consider getting a legal review.
Common NDA Mistakes and How to Avoid Them
Many startups and operators make similar mistakes when using NDAs. Here are some of the most common, with tips on how to avoid them:
- Using a generic template without review: Templates can be a good starting point, but they may not fit your specific deal or state law. Always review and adapt the NDA to your situation.
Example: A template that works in Delaware may not comply with California's restrictions on employee NDAs. - Failing to define confidential information clearly: If the definition is too broad or too narrow, it can create confusion or weaken your protection. Be specific about what is covered.
Checklist: List all types of information you want to protect, including oral, written, and electronic data. - Overly restrictive or unenforceable terms: Some NDAs try to restrict too much, such as preventing someone from working in their field or sharing information that is already public. Courts may refuse to enforce these terms, especially in states like California or Oklahoma.
- Ignoring state-specific rules: Some states have laws that limit or void certain NDA terms, especially in employment or harassment contexts. For example, Illinois and New York restrict NDAs that attempt to silence employees about discrimination or harassment.
Checklist: Research your state's NDA laws or consult an attorney before finalizing the agreement. - Not considering practical enforcement: If you do not have the resources to enforce an NDA, or if the other party is overseas, your protection may be limited. Think about whether the NDA is realistic for your situation.
Example: A small startup may not be able to pursue litigation against a multinational company in a foreign jurisdiction. - Forgetting to update NDAs as your business grows: As your company adds new products, partners, or markets, your NDA needs may change. Review your agreements regularly.
Checklist: Schedule an annual review of your standard NDAs and update them as needed.
Learning from these mistakes can save time, money, and headaches down the road.
Negotiation Tips for Founders and Operators
Negotiating an NDA is about more than just protecting your side. It is also about building trust and setting clear expectations. Here are practical tips for founders, operators, and managers:
- Start with your goals: Know what information you need to protect and why. This helps you focus on the terms that project most.
Example: If your main concern is protecting a trade secret algorithm, focus on the definition and duration. - Be ready to explain your terms: If you propose changes, be prepared to explain why they are important for your business. For example, if you want a longer duration, explain the business reasons.
Checklist: Write down your key concerns before negotiations begin. - Balance protection with practicality: Do not ask for terms that are impossible to enforce or that will scare off partners. For example, asking for an indefinite NDA for information that will soon be public may not be reasonable.
- Negotiate mutuality if needed: If both sides are sharing information, a mutual NDA is often fairer and easier to negotiate.
Example: In a joint venture, both companies may want similar protections. - Clarify permitted disclosures: Make sure both sides agree on who can see the information, such as employees, advisors, or affiliates. This avoids confusion later.
Checklist: List all individuals or roles who will have access and confirm agreement. - Document changes: If you negotiate changes, make sure they are written into the agreement. Do not rely on verbal promises.
Example: If you agree to a shorter duration, update the contract before signing. - Know when to walk away: If the other party refuses to agree to reasonable terms, it may be better to walk away than to risk your confidential information.
Checklist: Set your deal-breakers before negotiations begin.
Negotiating an NDA is often a quick process, but taking the time to get it right can make a big difference for your business. Consider role-playing negotiations with your team to prepare for common objections.
State Law Differences and Industry Considerations
NDAs are generally governed by state contract law, which means the rules can vary widely depending on where your business operates or where the other party is located. Here are some state and industry-specific points to consider:
- Employee NDAs: Some states, like California, limit the use of NDAs to prevent employees from discussing wages or workplace conditions. Others, like New York and Illinois, have rules about NDAs in harassment or discrimination cases.
Example: In California, an NDA cannot prevent an employee from discussing unlawful workplace conduct. - Trade Secret Protection: Most states have adopted some version of the Uniform Trade Secrets Act (UTSA), which provides additional protection for trade secrets. However, the definition of a trade secret and the remedies available can vary.
Checklist: Confirm that your NDA does not conflict with your state's trade secret laws. - Non-Compete Clauses: Some NDAs include non-compete or non-solicit clauses. These are subject to strict rules in many states, and may not be enforceable at all in places like California or Oklahoma.
Example: In Oklahoma, most non-compete agreements are void by law. - Industry Standards: Certain industries, such as healthcare, finance, or technology, may have additional confidentiality requirements under federal or state law (for example, HIPAA for healthcare data). Make sure your NDA does not conflict with these rules.
Checklist: Identify any industry-specific confidentiality laws that apply to your business. - International Considerations: If you are sharing information with parties outside the US, local laws may affect the enforceability of your NDA. Consider whether you need additional agreements or protections.
Example: The EU's General Data Protection Regulation (GDPR) may impact how you handle personal data in NDAs with European partners.
It is important to tailor your NDA to your industry and the states involved. When in doubt, consider a legal review before signing, especially for business sales, cross-border deals, or when dealing with sensitive intellectual property.
When to Seek Legal Review of an NDA
While many NDAs are signed without legal review, there are situations where it is wise to get professional input. Consider seeking a review if:
- The NDA involves significant intellectual property, trade secrets, or sensitive business information.
- The other party is a large company, investor, or government entity with their own legal team.
- The NDA includes unusual terms, such as broad non-compete or non-solicit clauses.
- You are unsure about state-specific rules or industry regulations.
- The NDA will apply in multiple states or countries.
- You are being asked to sign an NDA you do not fully understand.
- The NDA includes arbitration, liquidated damages, or other complex provisions.
A legal review can help spot red flags, suggest practical changes, and ensure the NDA fits your business goals. Even if you use templates, having a professional review your key contracts can help avoid costly mistakes. For example, a founder in Illinois may not realize that certain confidentiality provisions are unenforceable in harassment cases unless reviewed by counsel.
Consider creating a checklist for your team to use before signing any NDA:
- Have we clearly defined what is confidential?
- Do the exclusions match our needs?
- Is the duration reasonable?
- Are the remedies and liability provisions fair?
- Does the NDA comply with state and industry rules?
- Do we understand all terms, or should we seek legal review?
FAQs
What is the difference between a unilateral and mutual NDA?
A unilateral NDA is used when only one party is sharing confidential information, such as when a startup pitches to an investor. A mutual NDA is used when both parties expect to share sensitive information, such as in a potential partnership or joint venture. Mutual NDAs are often easier to negotiate when both sides have similar concerns.
Can NDAs be enforced in every US state?
Most states will enforce NDAs as long as they are reasonable and do not violate public policy. However, some states have special rules or limits, especially for NDAs in employment or harassment cases. For example, California restricts NDAs that prevent employees from discussing unlawful workplace conduct, and Illinois limits NDAs in harassment settlements. Always check state law before relying on an NDA.
How long should an NDA last?
The duration of an NDA depends on the type of information and the needs of your business. Many NDAs last two to five years, but some may last indefinitely for trade secrets. Be realistic about how long the information needs to stay confidential. For example, a product roadmap may only need protection for a couple of years, while a secret formula may require indefinite protection.
What happens if someone breaches an NDA?
If someone breaches an NDA, the agreement may allow you to seek damages or ask a court to stop further disclosure (injunctive relief). The practical ability to enforce an NDA depends on the terms, the parties involved, and the resources available for legal action. Some NDAs require arbitration or limit damages, so review these clauses carefully.
Are NDAs the same as non-compete agreements?
No. NDAs are about protecting confidential information, while non-compete agreements restrict someone from working for a competitor. Non-compete clauses are subject to stricter rules in many states and may not be enforceable everywhere. Always review non-compete language separately and check if it is allowed in your state.
Key Takeaways
- NDAs are important tools for protecting confidential information, but not all NDAs are the same.
- Review key terms such as the definition of confidential information, duration, exclusions, and remedies before signing.
- State laws and industry rules can affect what is enforceable in your NDA.
- Common mistakes include using generic templates, ignoring state law, and failing to update agreements as your business grows.
- Negotiating clear, practical terms helps protect your business and builds trust with partners.
- Consider legal review if your NDA involves sensitive information, unusual terms, or multiple states or countries.
If you have questions about negotiating or reviewing a non-disclosure agreement for your US business, contact our team at (888) 449-8437 or team@sprintlaw.com. Where legal services are required, they are delivered by licensed lawyers at trusted US law firms through the Sprintlaw platform.








