What Is an NDA? Definition, Types & 2026 Rules

What Is a Non-Disclosure Agreement (NDA)?

A non-disclosure agreement (NDA) is a legally binding contract that prevents one or more parties from sharing or misusing confidential information. NDAs define what counts as confidential, who may access it, how long the restriction lasts, and what remedies apply if the agreement is breached. They are also called confidentiality agreements, CDAs, or proprietary information agreements.

Key takeaways

• An NDA is a contract, not a magic shield — it is only as strong as its definitions, exclusions, and remedies clauses.
• Three federal rules — the Defend Trade Secrets Act (2016), the Speak Out Act (2022), and the NLRB's McLaren Macomb ruling (2023) — can already void parts of any template NDA that hasn't been updated since those dates.
• The DTSA requires a whistleblower immunity notice in every NDA covering an employee, contractor, or consultant. Omitting it forfeits your right to exemplary damages and attorney's fees.
• SEC Rule 21F-17 enforcement in 2024 cost real companies between $19,500 and $18 million each — for NDA language that often looked compliant on its face.
• Sign before you disclose. An NDA that post-dates the disclosure of information does not protect what was shared before signing.

Mutual, One-Way, or Multilateral — Which Type Do You Need?

Most NDAs fall into one of three structures. The wrong structure can leave your information unprotected or impose unnecessary obligations on a party who has nothing to hide.

Type	Who Discloses	Who Is Bound	Best For
One-way (unilateral)	One party only	The receiving party	Hiring contractors, sharing a pitch deck, vendor demos, employee onboarding
Mutual (bilateral)	Both parties	Both parties	Partnerships, joint ventures, M&A due diligence, co-development discussions
Multilateral	Three or more parties	All parties	Multi-party vendor consortiums, three-way deals, group licensing discussions

A one-way NDA is faster to negotiate because only one party takes on obligations. It fits any situation where only one side is disclosing — for example, when you share your app's source code with a development contractor.

A mutual NDA makes sense when both sides are sharing secrets. M&A discussions are the clearest example: the buyer shares its acquisition thesis and financial capacity; the seller shares its books and customer data.

A multilateral NDA replaces a stack of separate bilateral agreements when three or more parties are all disclosing to each other — useful in consortium bids or joint ventures involving multiple vendors. One agreement, one signature round.

For a detailed comparison of how obligations and risks differ in each structure, see our guide to mutual vs. one-way NDAs.

Which Clauses Make an NDA Enforceable in 2026?

Courts regularly invalidate or partially void NDAs that lack clear definitions, standard exclusions, or up-to-date compliance language. Here is what a well-drafted NDA must contain in 2026.

1. Precise Definition of Confidential Information

This is the most frequently litigated clause in any NDA. Courts have thrown out NDAs that define confidential information as "everything we discuss" — the language gives the receiving party no practical guidance on what to protect.

Broken clause:

"Recipient agrees to keep all information disclosed by Company strictly confidential."

Why it fails: "All information" is unenforceable in many jurisdictions because it covers common industry knowledge, publicly available data, and information the recipient already knew before signing.

Fixed clause:

"Confidential Information means written materials marked 'Confidential' at the time of disclosure, and oral disclosures confirmed in a written summary within ten (10) business days — excluding information that is publicly available, was rightfully in the recipient's possession before disclosure, or was independently developed without use of the disclosed information."

The fix adds specificity, incorporates the four standard exclusions directly into the definition, and gives both parties a bright line. Courts can interpret and enforce it; they cannot enforce "everything we discuss."

2. Standard Exclusions (Four of Them)

Every enforceable NDA excludes information that: (a) is or becomes publicly available through no breach of the agreement; (b) the receiving party already knew before signing; (c) the receiving party independently developed without using the disclosed information; (d) a third party lawfully disclosed to the receiving party without restriction. Without these carve-outs, the NDA is one-sided and invites challenge.

3. Permitted Use Restriction

State precisely what the receiving party may do with the information — usually "solely for the purpose of evaluating [the specific opportunity]." Without this, the receiving party might argue they were permitted to use your pricing data to benchmark against competitors, since that's also an internal business use.

4. Duration

Standard business information: 2–5 years. Trade secrets: indefinite protection is legally available under the Defend Trade Secrets Act (18 U.S.C. § 1836) for U.S. parties and the EU Trade Secrets Directive (Directive 2016/943) for EU parties, but a perpetual clause applied to routine contractor relationships is frequently struck down as overreaching. Call out trade secrets separately as having indefinite protection; don't lump them in with general business information under a single term.

5. Return or Destruction of Information

At the end of the relationship or upon written request, the receiving party must return or securely destroy all confidential materials — including digital copies and cloud-stored documents. Require a written certification of destruction. Without it, you have no reliable evidence of compliance.

6. DTSA Whistleblower Immunity Notice (Required by Federal Law)

If your NDA covers an employee, contractor, or consultant and protects trade secret information, federal law requires you to include this notice under 18 U.S.C. § 1833(b)(3)(A):

Pursuant to 18 U.S.C. § 1833(b), an individual may not be held criminally or civilly liable under any federal or state trade secret law for disclosure of a trade secret made in confidence to a government official or attorney solely for the purpose of reporting or investigating a suspected violation of law, or in a filing made under seal in a lawsuit.

If you omit this notice, 18 U.S.C. § 1836(b)(3)(C) bars you from recovering exemplary damages — up to two times actual damages — and attorney's fees, even if you win. This penalty applies to every employee- or contractor-facing NDA entered into or updated after May 11, 2016. The DTSA defines "employee" broadly to include individuals performing work as contractors or consultants, so the notice requirement is not limited to W-2 employees.

7. Government Agency Reporting Carve-Out

Separately from the DTSA notice, every NDA needs an express carve-out permitting the receiving party to report to the SEC, NLRB, EEOC, DOJ, and applicable state agencies — without prior authorization from the disclosing party, and without waiving any right to a government whistleblower award. This carve-out must be explicit. SEC enforcement has established that permitting government contact while separately waiving the right to a financial award is itself a Rule 21F-17 violation.

8. Data Protection Clause

Any NDA involving the sharing of personal data — employee records, customer lists, user analytics — must address data protection obligations. For EU and UK parties, GDPR (Regulation (EU) 2016/679) and UK GDPR apply. For California businesses, CCPA (Cal. Civ. Code § 1798.100 et seq.) compliance is required. The clause should specify permitted processing purposes, data security standards, and breach notification timelines.

9. AI Training Restriction

Template NDAs drafted before 2024 almost never include this. Add a clause prohibiting the receiving party from using confidential information to train, fine-tune, or prompt-engineer any AI or machine learning model. Without it, a contractor who feeds your proprietary data into an AI tool may not have technically breached confidentiality — they only used the data for an internal purpose. This gap became industry-standard to close in 2024–2025.

For a deeper look at how confidentiality language works within broader contracts, see our guide to confidentiality clauses explained.

Which Federal Rules Have Already Voided Parts of Your Template NDA?

Most articles stop at "here is what to include." This section covers what can undo the protection you think you have — before anyone violates a word.

The Speak Out Act (Pub. L. 117-224, December 7, 2022): Any pre-dispute NDA clause that prevents an employee from disclosing facts about a workplace sexual harassment or sexual assault dispute is unenforceable in federal, state, and tribal court. The Act does not affect NDAs protecting trade secrets or proprietary information, and it does not apply to NDAs signed after a dispute has already arisen — for example, as part of a settlement. But a standard onboarding NDA that broadly covers "all information relating to employment" may include language that runs directly into this restriction.

NLRB McLaren Macomb (372 NLRB No. 58, February 21, 2023): The National Labor Relations Board held that severance agreements with confidentiality and non-disparagement clauses that broadly restrict non-supervisory employees from exercising their rights under Section 7 of the NLRA are facially unlawful. The NLRB's General Counsel confirmed the ruling applies retroactively — agreements proffered before February 21, 2023 can still be challenged if they are currently being maintained or enforced. Narrowly tailored confidentiality clauses, limited to protecting trade secrets for a defined period with an express carve-out for employees' Section 7 rights, remain lawful.

SEC Rule 21F-17 (17 C.F.R. § 240.21F-17): Any NDA that requires a party to obtain the company's consent before contacting the SEC, prohibits initiating contact with regulators, or waives the right to receive a SEC whistleblower award violates Rule 21F-17. The rule applies not just to employees but also to contractors and clients. The enforcement record makes the stakes concrete.

What Does SEC Enforcement Actually Cost Companies?

This is what separates a theoretical rule from a real business risk.

In January 2024, JP Morgan Securities agreed to pay the SEC $18 million to settle Rule 21F-17 allegations. The SEC found that JPMS had regularly asked retail clients to sign confidential release agreements that required them to represent they had not filed complaints with any governmental agency.

In September 2023, the SEC fined investment advisor D.E. Shaw $10 million for requiring new employees to sign NDAs prohibiting disclosure of confidential information to anyone outside the company — including regulators — and requiring departing employees to sign waivers affirming they had not filed any complaints with any governmental agency.

On September 9, 2024, the SEC announced settlements with seven additional public companies — including Acadia Healthcare, AppFolio, IDEX Corporation, LSB Industries, Smart for Life, TransUnion, and a.k.a. Brands Holding — for a combined total exceeding $3 million in penalties. Individual fines ranged from $19,500 to $1.3 million, driven primarily by the number of violative agreements each company had in circulation.

The critical enforcement lesson: in the September 2024 actions, the relevant agreements already included language explicitly permitting employees to participate in government whistleblower programs. The SEC still found violations because those same agreements also required employees to waive their right to receive a financial award for whistleblowing. Permission to report is not enough — you must also not waive the award right.

Is Your Current NDA Compliant? A Date-Based Audit

The most useful framing for an NDA compliance review is not "what clauses should I add?" but "which of my existing agreements are already defective?" Match your agreement's signing date against each effective date below.

Rule / Event	Effective Date	Agreements at Risk	What's Defective
DTSA Whistleblower Notice (18 U.S.C. § 1833(b))	May 11, 2016	Employee/contractor/consultant NDAs signed after this date without the notice	Loss of exemplary damages and attorney's fees in any DTSA action
California SB 331 — Silenced No More Act	January 1, 2022	California employer NDAs covering harassment, discrimination, or retaliation on any protected basis	Clauses silencing protected disclosures are void under Cal. Civ. Code § 1001
Washington HB 1795	June 9, 2022	Washington employer NDAs in cases of unlawful workplace conduct	Retroactive ban; violators face actual or statutory damages and attorney's fees
Speak Out Act (Pub. L. 117-224)	December 7, 2022	Any pre-dispute employee NDA with broad harassment or assault disclosure clauses	Those clauses are void under federal law
NLRB McLaren Macomb (372 NLRB No. 58)	February 21, 2023	Severance NDAs with non-supervisory employees lacking Section 7 carve-outs	Overbroad confidentiality and non-disparagement are an unfair labor practice; applies retroactively
SEC Rule 21F-17 — Award-Waiver Enforcement	Ongoing; major actions in 2023–2024	Any NDA that waives whistleblower award rights, even with a government-reporting carve-out	Civil penalties ranging from $19,500 to $18 million per company
AI Training Restriction	Industry standard since 2024–2025	NDAs with vendors or contractors with AI tool access signed before 2024	Gap allowing confidential data to be fed into LLMs without a technical breach

A focused review of your template NDA against these seven rows — matching agreement signing dates to effective dates — identifies almost every material defect. The SEC enforcement program that produced the 2023 and 2024 actions against D.E. Shaw, JP Morgan, AppFolio, and others remains active.

How Do You Get a Compliant NDA Signed Quickly?

1. Choose the right type. Use the type table above to pick one-way, mutual, or multilateral for your specific situation.
2. Start from a current template. A free NDA template or an AI-assisted generator ensures core clauses are present. Avoid recycling old Word documents — pre-2022 templates almost certainly lack the DTSA notice, Speak Out Act carve-outs, and the government-agency reporting language the SEC now requires.
3. Add the DTSA whistleblower notice for every NDA with an employee, contractor, or consultant with access to trade secrets. This is a per-agreement requirement — it cannot be fixed retroactively without a new signed agreement.
4. Add a government-reporting carve-out that expressly permits contact with the SEC, NLRB, EEOC, and applicable state agencies and expressly preserves the right to receive a government whistleblower award from any of them.
5. Define confidential information specifically. Use the "marked confidential plus written confirmation within 10 business days" formula from the fixed clause above.
6. Set a duration. Two to five years for standard information; indefinite only for genuine trade secrets, called out separately with their own survival clause.
7. Send via electronic signature. The U.S. E-Sign Act (15 U.S.C. § 7001) and EU eIDAS Regulation (No. 910/2014) give electronic signatures the same legal weight as wet signatures for standard commercial NDAs. See our guide to electronic signatures for jurisdiction-specific requirements.
8. File the signed copy immediately. A signed NDA you cannot locate is nearly useless in litigation.

Create a context-aware NDA with Pactlio — the drafting process asks for your specific situation (contractor, investor pitch, partnership) and adjusts the clause set accordingly.

Before sending any NDA, run it against the checklist in our guide to reviewing a contract to catch common errors before the other side does.

How Do NDA Rules Differ by Jurisdiction?

NDA law is primarily state contract law in the U.S. and statutory law abroad. The table below covers the most common jurisdictions for cross-border deals.

Jurisdiction	Key Law	Notable Rule
United States (federal)	Defend Trade Secrets Act, 18 U.S.C. § 1836	Federal civil claim for trade secret misappropriation; DTSA notice required in all employee and contractor NDAs
California	Cal. Bus. & Prof. Code § 16600; SB 331 (Cal. Civ. Code § 1001, eff. Jan. 1, 2022)	Non-competes are nearly void; NDAs enforceable for trade secrets; SB 331 restricts harassment and discrimination-related NDAs beyond federal law
New York	N.Y. Gen. Oblig. Law § 5-336	Harassment-related NDAs require victim's consent and a 21-day review period; Senate Bill S5404 (introduced 2026) proposed further restrictions
Washington	HB 1795 (eff. June 9, 2022)	Most restrictive in the U.S. — retroactively bans NDAs in cases of unlawful workplace conduct; violators face actual or statutory damages and attorney's fees
European Union	EU Trade Secrets Directive (Directive 2016/943); GDPR (Regulation (EU) 2016/679)	Harmonized civil remedies for trade secret misappropriation; personal data in NDAs must comply with GDPR
United Kingdom	UK GDPR; Trade Secrets (Enforcement, etc.) Regulations 2018 (SI 2018/597)	Common law of confidence applies independently of contract; UK GDPR governs personal data post-Brexit
Canada	Provincial contract law; common law	No federal trade secrets statute; protection through provincial contract and tort law; NDA structure broadly similar to U.S. unilateral and mutual forms

For state-specific NDA rules in the U.S., see our guide to contract law in California, which covers how California courts read confidentiality clauses that function as de facto non-competes.

Common Mistakes to Avoid

• Overbroad definition of confidential information. "Everything we discuss" invites a court to void the definition entirely. Name the categories explicitly with a marking or confirmation requirement.
• Skipping the DTSA whistleblower notice. This is a per-agreement defect — every employee- or contractor-facing NDA needs it, and fixing it retroactively requires a new signed agreement.
• No government-agency reporting carve-out. An NDA that could be read as preventing SEC, NLRB, or EEOC reporting — or that waives a whistleblower award — violates Rule 21F-17 and exposes your company to civil penalties, not just an unenforceable clause.
• Waiving whistleblower award rights while permitting government contact. The September 2024 SEC enforcement actions established this is a distinct violation. JP Morgan paid $18 million for this distinction alone.
• Perpetual duration on a contractor NDA. Courts read perpetual NDAs as de facto non-competes and often sever or void the duration clause. Use two to five years plus a separate survival clause for genuine trade secrets.
• Signing after disclosure. An NDA only protects information disclosed after it is signed, unless it expressly covers prior disclosures — and that language requires deliberate drafting.
• Template confidentiality in a severance agreement. Post-McLaren Macomb, boilerplate severance NDAs for non-supervisory employees that lack Section 7 carve-outs are an unfair labor practice the moment you proffer them — even if you never try to enforce them.

For a broader checklist of risky contract language, see red flags in contracts. For the elements that make any contract enforceable beyond just NDAs, see what makes a contract legally binding.

Sources

• Defend Trade Secrets Act of 2016, Pub. L. 114-153: https://www.congress.gov/114/plaws/publ153/PLAW-114publ153.pdf
• 18 U.S.C. § 1833 — Exceptions to Prohibitions (DTSA Whistleblower Immunity): https://www.law.cornell.edu/uscode/text/18/1833
• 18 U.S.C. § 1836 — Civil Proceedings (DTSA): https://uscode.house.gov/view.xhtml?path=%2Fprelim%40title18%2Fpart1%2Fchapter90&edition=prelim
• Speak Out Act, Pub. L. 117-224 (December 7, 2022): https://www.congress.gov/bill/117th-congress/senate-bill/4524/text
• NLRB, McLaren Macomb, 372 NLRB No. 58 (February 21, 2023): https://www.nlrb.gov/news-outreach/news-story/nlrb-general-counsel-issues-memo-with-guidance-to-regions-on-severance
• SEC Rule 21F-17, 17 C.F.R. § 240.21F-17: https://www.sec.gov/rules/final/2011/34-64545.pdf
• SEC — Settled Enforcement Actions Against Seven Companies, Rule 21F-17 (September 9, 2024): https://corpgov.law.harvard.edu/2024/10/02/settled-actions-reiterate-secs-broad-interpretation-of-rule-21f-17a-whistleblower-impediments/
• SEC vs. D.E. Shaw ($10 million, September 2023) and JP Morgan ($18 million, January 2024) — summary: https://kkc.com/frequently-asked-questions/the-sec-whistleblower-program-and-non-disclosure-agreements-ndas/
• Washington HB 1795 (signed 2022, eff. June 9, 2022): https://app.leg.wa.gov/billsummary?BillNumber=1795&Year=2021
• California SB 331 (Silenced No More Act, eff. January 1, 2022): https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202120220SB331
• EU Trade Secrets Directive 2016/943: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016L0943
• UK Trade Secrets (Enforcement, etc.) Regulations 2018 (SI 2018/597): https://www.legislation.gov.uk/uksi/2018/597/contents
• LII Wex — Non-Disclosure Agreement: https://www.law.cornell.edu/wex/non-disclosure_agreement_(nda)
• NDA Enforceability by State 2026: https://www.vaquill.ai/blog/nda-enforceability-by-state

This article is general information, not legal advice. Laws vary by jurisdiction. Pactlio generates professional drafts for review — have a licensed attorney review anything important.