What Is an NDA? Meaning, Types & How It Works (2026)

What Is a Non-Disclosure Agreement (NDA)?

A non-disclosure agreement (NDA) is a legally binding contract that prevents one or more parties from sharing or misusing confidential information. NDAs define what counts as confidential, who may access it, how long the restriction lasts, and what remedies apply if the agreement is breached. They are also called confidentiality agreements, CDAs, or proprietary information agreements.

Key takeaways

• An NDA is only as strong as its definitions, exclusions, and remedies clauses — vague language is the single most common reason courts void or narrow them.
• Three federal rules — the Defend Trade Secrets Act (2016), the Speak Out Act (2022), and the NLRB's McLaren Macomb ruling (2023) — can already void portions of any template NDA not updated since those dates.
• The DTSA requires a whistleblower immunity notice in every NDA covering an employee, contractor, or consultant. Omitting it forfeits your right to exemplary damages and attorney's fees.
• In January 2025, two investment advisers paid $45 million each — $90 million combined — to settle SEC Rule 21F-17 enforcement actions tied to NDA language in separation agreements.
• Sign before you disclose. An NDA signed after information has already been shared generally does not protect what was disclosed prior to execution.

Mutual, One-Way, or Multilateral: Which Type Do You Need?

Most NDAs fall into one of three structures. Using the wrong one can leave your information unprotected or impose unnecessary obligations on a party with nothing to hide.

Type	Who Discloses	Who Is Bound	Best For
One-way (unilateral)	One party only	The receiving party	Contractor onboarding, investor pitch decks, vendor demos, employee onboarding
Mutual (bilateral)	Both parties	Both parties	Partnerships, joint ventures, M&A due diligence, co-development discussions
Multilateral	Three or more parties	All parties	Consortium bids, three-way deals, group licensing arrangements

A one-way NDA is faster to negotiate because only one side takes on confidentiality obligations. It fits any situation where only one party is disclosing — for example, when you share your application's source code with a development contractor.

A mutual NDA makes sense when both sides are sharing secrets. M&A discussions are the clearest example: the buyer shares its acquisition thesis and financial capacity; the seller shares its books and customer data. Both parties need protection, so both parties carry the obligation.

A multilateral NDA replaces a stack of separate bilateral agreements when three or more parties are all disclosing to each other — useful in consortium bids or joint ventures involving multiple vendors. One agreement, one signature round, consistent terms across all parties.

For a side-by-side analysis of how obligations and negotiation leverage differ between structures, see our guide to mutual vs. one-way NDAs.

The 9 Clauses That Make an NDA Enforceable in 2026

Courts regularly void or narrow NDAs that lack clear definitions, standard exclusions, or current compliance language. Here is what a well-drafted NDA must contain in 2026 — and a concrete example of what a broken clause looks like versus a fixed one.

1. Precise Definition of Confidential Information

This is the most frequently litigated clause in any NDA. Courts have thrown out agreements that define confidential information as "everything we discuss" because the language gives the receiving party no practical guidance on what to protect.

Broken clause:

"Recipient agrees to keep all information disclosed by Company strictly confidential."

Why it fails: "All information" is unenforceable in many jurisdictions because it sweeps in common industry knowledge, publicly available data, and information the recipient already possessed before signing. A court facing this language cannot determine what the receiving party must protect, and often voids the definition entirely rather than rewriting it.

Fixed clause:

"Confidential Information means written materials marked 'Confidential' at the time of disclosure, and oral disclosures confirmed in a written summary within ten (10) business days — excluding information that is publicly available through no breach of this Agreement, was rightfully in the recipient's possession before disclosure, was independently developed without use of the disclosed information, or was disclosed to the recipient by a third party free of any confidentiality obligation."

The fix adds specificity, incorporates the four standard exclusions directly into the definition, and gives both parties a bright line. Courts can interpret and enforce it.

2. Four Standard Exclusions

Every enforceable NDA excludes information that: (a) is or becomes publicly available through no breach of the agreement; (b) the receiving party already knew before signing; (c) the receiving party independently developed without using the disclosed information; (d) a third party lawfully disclosed to the receiving party without restriction. Without these carve-outs, the NDA is facially overbroad and invites challenge.

3. Permitted Use Restriction

State precisely what the receiving party may do with the information — typically "solely for the purpose of evaluating [the specific opportunity]." Without this, a receiving party may argue that using your pricing data to benchmark against competitors was an internal business use the NDA did not prohibit.

4. Duration

Standard business information: 2–5 years. Trade secrets: indefinite protection is legally available under the Defend Trade Secrets Act (18 U.S.C. § 1836) for U.S. parties and EU Trade Secrets Directive (Directive 2016/943) for EU parties — but a perpetual clause applied to routine contractor relationships is frequently struck down as overreaching. Call out trade secrets separately with their own indefinite survival clause; don't lump them with general business information under a single term.

5. Return or Destruction of Information

At the end of the relationship or on written request, the receiving party must return or securely destroy all confidential materials — including digital copies and cloud-stored documents. Require a written certification of destruction. Without that certification, you have no reliable evidence of compliance if a dispute later arises.

6. DTSA Whistleblower Immunity Notice (Required by Federal Law)

If your NDA covers an employee, contractor, or consultant and protects trade secret information, federal law requires you to include this notice under 18 U.S.C. § 1833(b)(3)(A):

Pursuant to 18 U.S.C. § 1833(b), an individual may not be held criminally or civilly liable under any federal or state trade secret law for disclosure of a trade secret made in confidence to a government official or attorney solely for the purpose of reporting or investigating a suspected violation of law, or in a filing made under seal in a lawsuit.

Omitting this notice bars you from recovering exemplary damages — up to two times actual damages — and attorney's fees under 18 U.S.C. § 1836(b)(3)(C), even if you win on the merits. The requirement applies to every employee- or contractor-facing NDA entered into or updated after May 11, 2016. The DTSA defines "employee" broadly to include contractors and consultants, so a W-2 limitation does not help.

7. Government Agency Reporting Carve-Out

Separately from the DTSA notice, every NDA needs an express carve-out permitting the receiving party to report to the SEC, NLRB, EEOC, DOJ, CFTC, CFPB, and applicable state agencies — without prior authorization from the disclosing party, and without waiving any right to a government whistleblower award. This carve-out must be explicit, and it must preserve the award right. Permitting government contact while separately waiving the right to receive a financial award from any of those agencies is itself a Rule 21F-17 violation.

8. Data Protection Clause

Any NDA involving the sharing of personal data — employee records, customer lists, user analytics — must address data protection obligations. For EU and UK parties, GDPR (Regulation (EU) 2016/679) and UK GDPR apply. For California businesses, CCPA (Cal. Civ. Code § 1798.100 et seq.) compliance is required. The clause should specify permitted processing purposes, data security standards, and breach notification timelines.

9. AI Training Restriction

Template NDAs drafted before 2024 almost never include this. Add a clause prohibiting the receiving party from using confidential information to train, fine-tune, or prompt-engineer any AI or machine learning model. Without it, a contractor who feeds your proprietary data into an AI tool may not have technically breached confidentiality — they only used the data for an internal purpose. This gap became an industry standard to close in 2024–2025.

For a deeper look at how confidentiality language functions within broader contracts, see our confidentiality clause explained guide.

When a Template NDA Becomes a Legal Liability: A Date-Based Audit

The most useful framing for an NDA review is not "what clauses should I add?" but "which of my existing agreements are already defective by law?" Match your NDA's signing date against each effective date below.

Rule / Event	Effective Date	Agreements at Risk	Consequence
DTSA Whistleblower Notice (18 U.S.C. § 1833(b))	May 11, 2016	Employee/contractor NDAs signed after this date without the notice	Loss of exemplary damages and attorney's fees in any DTSA action
California SB 331 — Silenced No More Act	January 1, 2022	California employer NDAs covering harassment or discrimination on any protected basis	Clauses silencing protected disclosures are void under Cal. Civ. Code § 1001
Washington HB 1795	June 9, 2022	Washington employer NDAs in cases of unlawful workplace conduct	Retroactive ban; violators face actual or statutory damages and attorney's fees
Speak Out Act (Pub. L. 117-224)	December 7, 2022	Any pre-dispute employee NDA with broad harassment or assault disclosure clauses	Those clauses are void under federal law
NLRB McLaren Macomb (372 NLRB No. 58)	February 21, 2023	Severance NDAs with non-supervisory employees lacking Section 7 carve-outs	Overbroad confidentiality and non-disparagement are an unfair labor practice; applies retroactively
SEC Rule 21F-17 — Award-Waiver Enforcement	Ongoing; major actions in 2023–2026	Any NDA that waives whistleblower award rights, even with a government-reporting carve-out	Civil penalties from $148,000 to $90 million per enforcement action
AI Training Restriction	Industry standard since 2024–2025	NDAs with vendors or contractors with AI tool access, signed before 2024	Gap allowing confidential data to be used for LLM training without a technical breach

A focused review of your template NDA against these seven rows — matching agreement signing dates to effective dates — identifies almost every material defect without a full legal audit.

The Real Cost of a Non-Compliant NDA: SEC Enforcement Data

Most NDA articles list what the rules require. This section documents what happens when companies get it wrong, using named enforcement actions.

January 2025 — Two RIAs, $90 million combined. The SEC charged two registered investment advisers with Rule 21F-17 violations for requiring departing employees in separation agreements to represent, as a condition of receiving post-separation benefits, that they had not filed a complaint with any governmental agency. The SEC found that this structure effectively identified and penalized whistleblowers by tying compensation to the absence of regulatory contact. Each adviser settled for $45 million, totaling $90 million — the largest combined Rule 21F-17 action to date. The charges were bundled with related investment model violations, but the NDA language was a named violation in its own right.

May 2026 — National athletic footwear retailer, $148,000. The SEC imposed a $148,000 civil penalty on a national footwear retailer for separation agreements that required departing employees to waive their right to receive a SEC whistleblower award. The SEC noted the comparatively modest penalty reflected cooperation and remediation credit — the company had revised its agreements before the settlement. This action is notable because it came under the current SEC leadership, which publicly described its enforcement focus as "lying, cheating, or stealing" rather than technical violations. The footwear retailer action demonstrates that award-waiver language remains an active enforcement target regardless of administration.

September 2024 — Seven companies, $3 million-plus combined. The SEC settled with Acadia Healthcare, AppFolio, IDEX Corporation, LSB Industries, Smart for Life, TransUnion, and a.k.a. Brands Holding for a combined total exceeding $3 million. Individual penalties ranged from $19,500 to $1.3 million. Critically, several of these agreements already included language permitting employees to participate in government whistleblower programs — but also contained separate award-waiver provisions. The SEC treated the permission-to-report and the award-waiver as two distinct violations.

January 2024 — JP Morgan Securities, $18 million. The SEC found that JPMS regularly asked retail clients to sign confidential release agreements requiring them to represent they had not filed complaints with any governmental agency.

The enforcement record establishes one principle clearly: permission to report is not enough. Any NDA that separately waives the right to receive a government whistleblower award — even while expressly permitting regulatory contact — violates Rule 21F-17. The CFTC and CFPB have each initiated parallel enforcement programs applying the same logic to their regulated industries.

How to Get a Compliant NDA Signed Quickly

1. Choose the right type. Use the type table above to select one-way, mutual, or multilateral for your situation before drafting anything.
2. Start from a current template. A free NDA template built after 2023 will include the DTSA notice, Speak Out Act carve-outs, and government-agency reporting language. Recycled Word documents from before 2022 almost certainly do not.
3. Insert the DTSA whistleblower notice verbatim for every NDA involving an employee, contractor, or consultant with access to trade secret information. This is a per-agreement requirement — it cannot be fixed retroactively without a new signed agreement.
4. Add a government-reporting carve-out that expressly permits contact with the SEC, NLRB, EEOC, CFTC, and applicable state agencies and expressly preserves the right to receive a government whistleblower award from any of them. Both elements — permission to contact and preservation of the award right — must appear in the same carve-out.
5. Define confidential information specifically. Use the "marked confidential plus written confirmation within 10 business days" formula from the fixed clause above. Name the excluded categories explicitly.
6. Set a term. Two to five years for standard information; indefinite only for genuine trade secrets, called out separately with their own survival clause. Avoid applying perpetual terms to general contractor NDAs.
7. Sign via electronic signature. The U.S. E-Sign Act (15 U.S.C. § 7001) and EU eIDAS Regulation (No. 910/2014) give electronic signatures the same legal weight as wet signatures for standard commercial NDAs. See our guide to electronic signatures for jurisdiction-specific requirements.
8. File the signed copy immediately. A signed NDA you cannot locate is nearly useless in litigation.

Create a context-aware NDA with Pactlio — the drafting process asks for your specific situation (contractor, investor pitch, partnership) and adjusts the clause set accordingly, including the DTSA notice and government-reporting carve-out automatically.

Before sending any NDA, run it against the risk checklist in our guide to reviewing a contract to catch common errors before the other side does. And if you want to understand what makes any contract legally binding beyond just NDAs, see our what makes a contract legally binding guide.

How NDA Rules Differ by Jurisdiction

NDA law is primarily state contract law in the U.S. and statutory law abroad. The table below covers the most common jurisdictions for cross-border deals.

Jurisdiction	Key Law	Notable Rule
United States (federal)	DTSA, 18 U.S.C. § 1836; Speak Out Act, Pub. L. 117-224	DTSA notice required in all employee/contractor NDAs; Speak Out Act voids pre-dispute harassment NDA clauses
California	Cal. Bus. & Prof. Code § 16600; SB 331 (Cal. Civ. Code § 1001, eff. Jan. 1, 2022)	NDAs enforceable for trade secrets; SB 331 restricts harassment and discrimination-related NDAs beyond federal law
New York	N.Y. Gen. Oblig. Law § 5-336	Harassment-related NDAs require victim's consent and a 21-day review period; SB S5404 (introduced 2026) proposes extending restrictions to discrimination and abuse
Washington	HB 1795 (eff. June 9, 2022)	Most restrictive in the U.S. — retroactively bans NDAs in cases of unlawful workplace conduct; violators face actual or statutory damages and attorney's fees
European Union	EU Trade Secrets Directive (Directive 2016/943); GDPR (Regulation (EU) 2016/679)	Harmonized civil remedies for trade secret misappropriation; personal data in NDAs must comply with GDPR
United Kingdom	UK GDPR; Trade Secrets (Enforcement, etc.) Regulations 2018 (SI 2018/597)	Common law of confidence applies independently of contract; UK GDPR governs personal data post-Brexit
Canada	Provincial contract law; common law	No federal trade secrets statute; protection through provincial contract and tort law; NDA structure broadly mirrors U.S. unilateral and mutual forms

For state-specific NDA rules in the U.S., see our guide to contract law in California, which explains how California courts read confidentiality clauses that function as de facto non-competes.

Common Mistakes to Avoid

• Overbroad definition of confidential information. "Everything we discuss" invites a court to void the definition entirely. Name the categories explicitly and use a marking or written-confirmation requirement to create a bright line.
• Skipping the DTSA whistleblower notice. Every employee- or contractor-facing NDA needs this notice verbatim. Fixing it retroactively requires a new signed agreement — there is no amend-in-place remedy.
• No government-agency reporting carve-out. An NDA that could be read as preventing SEC, NLRB, or EEOC reporting — or that separately waives a whistleblower award — violates Rule 21F-17 and exposes your company to civil penalties, not just an unenforceable clause.
• Permitting government contact while waiving the award right. The 2024 and 2025 SEC enforcement actions established this as a standalone violation. Two investment advisers paid $45 million each for this distinction in January 2025.
• Perpetual duration on a contractor NDA. Courts read perpetual NDAs applied to general contractor relationships as de facto non-competes and often sever or void the duration clause. Use two to five years plus a separate survival clause for genuine trade secrets.
• Signing after disclosure. An NDA only protects information disclosed after execution, unless it expressly covers prior disclosures — and that requires deliberate drafting, not a simple backdating.
• Template severance NDAs post-McLaren Macomb. Boilerplate severance NDAs for non-supervisory employees that lack Section 7 carve-outs are an unfair labor practice the moment you proffer them — even if you never try to enforce them. The NLRB confirmed this applies retroactively.

For a broader checklist of risky contract language, see red flags in contracts.

Sources

• Defend Trade Secrets Act of 2016, Pub. L. 114-153: https://www.congress.gov/114/plaws/publ153/PLAW-114publ153.pdf
• 18 U.S.C. § 1833 — Exceptions to Prohibitions (DTSA Whistleblower Immunity): https://www.law.cornell.edu/uscode/text/18/1833
• 18 U.S.C. § 1836 — Civil Proceedings (DTSA): https://uscode.house.gov/view.xhtml?path=%2Fprelim%40title18%2Fpart1%2Fchapter90&edition=prelim
• Speak Out Act, Pub. L. 117-224 (December 7, 2022): https://www.congress.gov/bill/117th-congress/senate-bill/4524/text
• NLRB, McLaren Macomb, 372 NLRB No. 58 (February 21, 2023): https://www.nlrb.gov/news-outreach/news-story/nlrb-general-counsel-issues-memo-with-guidance-to-regions-on-severance
• SEC Rule 21F-17, 17 C.F.R. § 240.21F-17: https://www.sec.gov/rules/final/2011/34-64545.pdf
• SEC vs. Two RIAs, Rule 21F-17 ($90 million combined, January 2025): https://www.sidley.com/en/insights/newsupdates/2025/10/2025-fiscal-year-in-review-sec-enforcement-against-investment-advisers
• SEC — Rule 21F-17 Footwear Retailer Settlement ($148,000, May 2026): https://www.gibsondunn.com/securities-enforcement-2026-mid-year-update/
• SEC — Settled Enforcement Actions Against Seven Companies, Rule 21F-17 (September 9, 2024): https://corpgov.law.harvard.edu/2024/10/02/settled-actions-reiterate-secs-broad-interpretation-of-rule-21f-17a-whistleblower-impediments/
• SEC vs. JP Morgan Securities ($18 million, January 2024): https://kkc.com/frequently-asked-questions/the-sec-whistleblower-program-and-non-disclosure-agreements-ndas/
• Washington HB 1795 (signed 2022, eff. June 9, 2022): https://app.leg.wa.gov/billsummary?BillNumber=1795&Year=2021
• California SB 331 (Silenced No More Act, eff. January 1, 2022): https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202120220SB331
• EU Trade Secrets Directive 2016/943: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016L0943
• UK Trade Secrets (Enforcement, etc.) Regulations 2018 (SI 2018/597): https://www.legislation.gov.uk/uksi/2018/597/contents
• LII Wex — Non-Disclosure Agreement: https://www.law.cornell.edu/wex/non-disclosure_agreement_(nda)
• NDA Enforceability by State 2026: https://www.vaquill.ai/blog/nda-enforceability-by-state

This article is general information, not legal advice. Laws vary by jurisdiction. Pactlio generates professional drafts for review — have a licensed attorney review anything important.