NDA Review Checklist: 14 Clauses to Check Before Signing

NDAs get signed unread because they look standard. Most are. The ones that are not usually differ in three places: the definition of Confidential Information, the term, and whatever has been added after clause 8.

Fourteen checks, roughly in order of how often they matter.

The core

1. Is it mutual or one-way? If both sides will disclose, it should be mutual. Why it matters.

2. How is Confidential Information defined? The standard is information disclosed in connection with a stated purpose. Watch for "all information disclosed, whether or not marked confidential, whether written or oral" with no boundaries — that definition covers a conversation about the weather.

3. Are the four standard carve-outs present? Information should be excluded if it: - is or becomes public through no fault of the recipient - was already known to the recipient before disclosure - is independently developed without reference to the disclosed information - is received from a third party without breach of an obligation

An NDA missing these is not a normal NDA. Their absence means you can breach it by using something you already knew.

4. Is there a carve-out for legally compelled disclosure? You must be able to comply with a court order or regulator. It should require notice to the discloser where lawful, not prohibit disclosure.

5. What is the term? Two to five years is standard for commercial information, with trade secrets often carved out to run for as long as they stay secret. Perpetual confidentiality over all information is aggressive and is the single most common thing worth pushing back on.

6. Is the purpose defined? A defined purpose limits what you may do with the information and, just as importantly, tells you what you are allowed to do. "Evaluating a potential commercial relationship" is normal.

What people miss

7. Non-solicitation and non-compete language. Restrictions on hiring the other side's staff, or on working with competitors, appear inside agreements titled "Non-Disclosure Agreement" surprisingly often. If you find one, it belongs in a separate negotiation.

8. IP assignments or licences. An NDA should assign nothing and license nothing. Feedback clauses granting the discloser rights over your comments are common and worth deleting or narrowing.

9. Residuals. Whether you may use general knowledge retained in unaided memory. Guide.

10. Return and destruction. Check for an exception covering automated backups and regulatory retention. Without it, a clause requiring destruction of all copies is one you cannot actually comply with.

11. Who is bound? Employees, contractors, advisers and affiliates should be covered on the disclosing side and permitted recipients on yours. If you cannot show the information to your lawyer or accountant, the agreement is unworkable.

The teeth

12. Remedies. Injunctive relief without proof of damage is standard. Liquidated damages — a fixed sum per breach — are not, and should be resisted.

13. Costs. A one-way clause making you pay the other side's legal fees is worth making mutual or deleting.

14. Governing law and forum. Ask yourself what it would cost to defend a claim in that jurisdiction. A distant forum is a practical deterrent to defending yourself even when you are right.

What normal looks like

Term	Standard	Push back
Direction	Mutual, where both disclose	One-way in a two-way deal
Definition	Tied to a stated purpose	"All information", no limits
Carve-outs	All four present	Missing or narrowed
Term	2–5 years; trade secrets longer	Perpetual on everything
Non-solicit	Absent, or separately negotiated	Buried in clause 9
Remedies	Injunctive relief	Liquidated damages per breach
Destruction	With a backup exception	Absolute

Before you upload it anywhere

Read the NDA's own terms on disclosure to third parties before pasting it into an AI tool. Many consumer AI products reserve the right to train on your input, and a SaaS vendor is a third party. If the agreement restricts onward disclosure, check the tool's terms first — including ours.

FAQ

How long should an NDA last?

Two to five years for ordinary commercial information, with a separate provision letting trade secret protection run for as long as the information stays secret. A blanket perpetual obligation over everything is the term most worth negotiating.

What are the standard NDA carve-outs?

Information that is public, already known to the recipient, independently developed, or received from a third party without breach. Plus an exception for disclosure compelled by law. An NDA lacking these is unusual and should be questioned.

Can an NDA include a non-compete?

It can, and some do. That is a reason to read past clause 8. Restrictions on competing or on hiring staff are substantively different from confidentiality obligations and deserve separate negotiation.

Is it safe to upload an NDA to an AI tool?

Check the NDA's restrictions on disclosure to third parties, then check the tool's terms on whether it trains on your input. Many free tools do. A tool that commits in writing not to train on uploads and lets you delete permanently is a different proposition from a general chatbot.

What is the difference between an NDA and a confidentiality agreement?

Nothing substantive — they are the same instrument under different names. "Confidentiality agreement" is also used for the confidentiality clause inside a larger contract, which is worth reading with the same checklist.

---