NDA Template: What Every Clause Does, and Where the Standard Form Gives Out

An NDA is a contract that turns information into a controlled asset: one side hands something over, the other side accepts limits on what may be done with it.

This article walks the clauses in order, explains what each one is for, and then shows the three places where a downloaded form stops carrying weight. Every legal statement below is tied to statute or to a court record, and where we give our own assessment it is marked as ours; the jurisdiction is named every time, because trade secret rules diverge sharply between the United States, the United Kingdom and the European Union.

The short answer

A signed NDA gives you one thing reliably: a contractual claim if the other side talks. It does not move ownership of anything, it does not survive the information becoming public, and it does not stop a person who worked the problem out independently. Those limits are written into the statutes themselves.

Three shapes, three risk profiles

Pick the shape from the direction of the information flow, then read the clauses below against it.

Clause by clause: what each block is doing

Definition of confidential information. This is the load-bearing clause. Two drafting styles compete: an enumerated list (source code, build artefacts, telemetry schemas, unreleased roadmaps) and a catch-all ("all information disclosed by the discloser"). The list is enforceable and narrow; the catch-all is broad and invites an argument that nothing was ever identified with enough precision to protect. Marking requirements sit here too, and whether protection applies by default or only to marked material is what a breach argument then has to prove.

Exclusions. Standard carve-outs: already public, already lawfully known to the recipient, received from a third party without a duty, independently developed without use of the disclosure. These are not concessions. Under the EU trade secrets regime, information stops qualifying as a trade secret once it is generally known or readily accessible to people in the relevant circles. Article 11(3)(b) of Directive (EU) 2016/943 then requires an interim measure to be revoked on the respondent's request when the information no longer meets that test for reasons that cannot be attributed to the respondent, and Article 13(2) requires the same for a final injunction. The UK regulations split the modality: on the alleged infringer's application a court may revoke an interim order on those grounds (regulation 13(1)(b)), and on the defendant's application it must revoke a final measure (regulation 15(3)). A clause that pretends public information stays confidential simply fails at that point.

Permitted purpose. The single clause that decides whether "we evaluated your build and then shipped a similar feature" is a breach. Purpose language should tie the use to the transaction being negotiated and nothing else.

Permitted recipients. Employees with a need to know, named affiliates, professional advisers, and subcontractors. Two mechanics matter: whether the recipient must flow the same obligations down, and whether the recipient stays liable for the people it told. Without both, the chain leaks at the second link.

Term of the obligation versus term of the agreement. These are different clocks, and conflating them is a common defect in a downloaded form. The agreement can end while the confidentiality obligation runs on. Trade secret protection in the UK and the EU lasts as long as the information stays secret, because secrecy is part of the definition itself (Article 2(1)(a) of Directive (EU) 2016/943), so there is no fixed expiry date to plan around. The statutory limitation clock does have one: the UK regulations set a six-year limitation period in England and Wales and Northern Ireland and a five-year prescriptive period in Scotland, running from the later of the day the unlawful use ceases and the day of knowledge. Under US federal law a civil trade secret action must be brought within three years of discovery or of when reasonable diligence should have produced discovery.

Return and destruction. Two duties, and they diverge in practice: physical or logical return of materials, and certified destruction of copies including backups. Carve out what the recipient must legally retain, or the clause becomes unperformable the moment a regulator or an auditor is involved.

Governing law and dispute forum. Choose both, and choose them knowing that the substantive rules differ. What counts as improper acquisition, whether reverse engineering is lawful, and what injunctive relief is available are all jurisdiction-specific.

Remedies and interim relief. Covered in its own section below, because the promise in most templates is considerably larger than what a court will grant.

Relationship to rights in the work product. A confidentiality clause restrains disclosure. It does not assign anything. This is fault line three.

A template that gets the definition, the purpose and the permitted-recipient chain right is worth more than one with an aggressive remedies clause and a vague definition. Definition and purpose decide whether there was a breach at all. Remedies language decides much less than it promises: §1836(b)(3)(A) puts statutory conditions on a US injunction, regulation 12(2) and Article 11(2) make a court weigh eight proportionality factors before granting one, and in ZeniMax the docket record shows the motion for a permanent injunction denied.
— Futura Digital's assessment

Fault line one: the reporting channel the template never mentions

The United States, the United Kingdom and the European Union each carve reporting to authorities out of confidentiality obligations. The template does not, and in the United States that omission is priced.

The federal immunity provision protects an individual from criminal or civil liability under any federal or state trade secret law for disclosing a trade secret in confidence to a federal, state or local government official or to an attorney, solely for the purpose of reporting or investigating a suspected violation of law, and for disclosure in a document filed under seal. Attached to it is a notice duty: an employer must give notice of that immunity in any contract or agreement with an employee that governs the use of a trade secret or other confidential information. A cross-reference to a policy document satisfies it.

The consequence of skipping the notice is specific. Where the employer has not complied, the employer may not be awarded exemplary damages or attorney fees under 18 U.S.C. §1836(b)(3) in an action against an employee who was not given notice. Exemplary damages there run up to twice the compensatory award. And "employee" for this purpose is defined to include any individual performing work as a contractor or consultant. The duty applies to contracts entered into or updated after 11 May 2016, which is the date that decides whether your current outsourcing paperwork is exposed. The whole mechanism sits in 18 U.S.C. §1833(b).

In the United Kingdom, section 43J of the Employment Rights Act 1996 makes any provision in an agreement between a worker and their employer void in so far as it purports to preclude the worker from making a protected disclosure, and it reaches settlement agreements as well as contracts of employment. "Worker" for this purpose is extended by section 43K beyond the standard definition, covering individuals supplied through a third party on terms substantially determined by the client, and individuals contracting to execute work in a place the client does not control. An individual freelancer can therefore be inside it; a subcontracting company is not.

A separate and wider voiding rule for harassment and discrimination now exists in the statute book as section 202A of the same Act. Its state today needs stating precisely. The insertion was commenced on 6 January 2026 for specified purposes only: the commencement instrument brought subsection (2) of the enacting section into force "for the purposes of making regulations under section 202A of the 1996 Act". A second instrument, on 6 April 2026, commenced only the provision dealing with the parliamentary procedure for those regulations. The regulations defining "excepted agreements" have not been made. So the voiding rule in section 202A(1) is not operating yet, and bringing it into general force needs a further commencement instrument. It is scheduled, and treating it as live today would be a mistake.

In the European Union, the trade secrets directive requires a court to dismiss an application for its measures and remedies where the disclosure was made for revealing misconduct, wrongdoing or illegal activity, provided the respondent acted to protect the general public interest. That is Article 5(b) of Directive (EU) 2016/943. The whistleblowing directive goes further and forbids waiver outright: Article 24 of Directive (EU) 2019/1937 requires Member States to ensure that the rights and remedies it provides "cannot be waived or limited by any agreement, policy, form or condition of employment, including a pre-dispute arbitration agreement". Its protection is not general, though. Article 2 ties it to breaches of listed Union acts in named areas. Consumer protection and the protection of privacy and personal data together with network and information security are the two closest to a studio's daily work, and the same list also covers financial services and the prevention of money laundering, and product safety and compliance. Two limbs of Article 2 carry no sector limit at all: breaches affecting the financial interests of the Union, and breaches relating to the internal market, including breaches of Union competition and State aid rules and of corporate tax rules.

Fault line two: the secret and the study nobody forbade

The second gap is about what the recipient may do with the product itself. Documents are already covered by the clauses above.

Under EU law, acquiring a trade secret is lawful when it comes from "observation, study, disassembly or testing of a product or object that has been made available to the public or that is lawfully in the possession of the acquirer of the information who is free from any legally valid duty to limit the acquisition of the trade secret". That is Article 3(1)(b). Read the tail of it: the outcome turns on the presence of a contractual limit. A confidentiality clause about information the discloser hands over does not create a limit on studying a product the recipient lawfully holds. The clause that would create it has to be drafted, and a template does not contain it.

US federal law reaches the same place from the definition side. "Improper means" is defined to include theft, bribery, misrepresentation, breach or inducement of a breach of a duty to maintain secrecy, and espionage; it "does not include reverse engineering, independent derivation, or any other lawful means of acquisition". That is 18 U.S.C. §1839(6), subparagraphs (A) and (B).

For software there is a ceiling on how far the contractual limit can go. Directive 2009/24/EC grants the lawful user a right to make a back-up copy that may not be prevented by contract "in so far as it is necessary for that use" (Article 5(2)), a right to observe, study or test the functioning of the program to determine the ideas and principles underlying it while performing acts they are entitled to perform (Article 5(3)), and a decompilation right for interoperability purposes subject to conditions (Article 6). Article 8 then closes the loop: any contractual provisions contrary to Article 6 or to the exceptions in Article 5(2) and (3) "shall be null and void". Note the asymmetry that gets missed. Article 5(1), the general use-and-error-correction exception, opens with "in the absence of specific contractual provisions" and can therefore be displaced by contract. Articles 5(2), 5(3) and 6 cannot.

Practical reading for a build demo: study of what you showed is limited by the permitted purpose clause. The confidentiality clause does not reach that act at all. Draft the purpose clause as a use restriction on the object, and expect its enforceability to be tested against the software directive if the counterparty is in the EU.

Fault line three: confidentiality standing in for two documents it cannot be

The third gap is the expensive one, because it is invisible until the deal closes.

It is not a rights document. Under US copyright law a work is "made for hire" in two situations only: it was prepared by an employee within the scope of employment, or it was specially ordered or commissioned and falls within one of nine enumerated categories (a contribution to a collective work, part of a motion picture or other audiovisual work, a translation, a supplementary work, a compilation, an instructional text, a test, answer material for a test, or an atlas), and the parties expressly agreed in a written instrument signed by them. That list is in 17 U.S.C. §101. Source code as a literary work is not on it. Separately, 17 U.S.C. §204(a) makes a transfer of copyright ownership other than by operation of law invalid unless there is an instrument of conveyance, or a note or memorandum of the transfer, in writing and signed by the owner of the rights conveyed or such owner's duly authorized agent.

The Supreme Court settled how to sort the two routes in Community for Creative Non-Violence v. Reid, 490 U.S. 730 (1989). A court applies common law agency principles first to decide whether the maker was an employee or an independent contractor, and only then reaches the right subsection. In the Court's own words, "we agree with the Court of Appeals that Reid was not an employee of CCNV but an independent contractor", and because he was an independent contractor the work-for-hire question depended on the enumerated categories, which the sculpture could not satisfy. The Court also stated the rule that matters to anyone commissioning art or code: "only enumerated categories of commissioned works may be accorded work for hire status. The hiring party's right to control the product simply is not determinative." Detailed art direction does not create ownership. A signed assignment does. Getting the assignment right is creator and contractor IP work, and it lives in its own signed document alongside the NDA.

It is not a data processing agreement. When a contractor touches player data on your instructions, Article 28(3) of the GDPR requires a contract or other legal act that sets out the subject-matter and duration of the processing, the nature and purpose, the type of personal data, the categories of data subjects, and the controller's obligations and rights, and that stipulates eight specific things the processor must do: process only on documented instructions; ensure that persons authorised to process the data have committed themselves to confidentiality or are under a statutory confidentiality obligation; take the Article 32 security measures; respect the sub-processor conditions; assist with data subject rights; assist with Articles 32 to 36; delete or return the data at the end of the service; and make information available and allow audits.

An NDA between the two companies gets close to exactly one of those eight, and not even fully, because the confidentiality obligation in point (b) is a duty the processor owes in respect of its own authorised personnel. The exposure for getting this wrong is set by Article 83(4)(a): infringements of the controller's and processor's obligations under Articles 8, 11, 25 to 39, 42 and 43 — Article 28 among them — attract administrative fines up to €10,000,000, or in the case of an undertaking up to 2% of total worldwide annual turnover of the preceding financial year, whichever is higher. Sorting the processing paperwork is GDPR data protection work, and it belongs in the same folder as the product document package that a launch already needs.

The three fault lines have one thing in common. Each is a place where the template is silent and the silence has a default answer supplied by statute, and in every case the default runs against the discloser. That is why we scope an NDA as one document in a set, sized against the transaction it serves.
— Futura Digital's assessment

Interim relief and injunctions: what a court will actually give you

Most templates promise that breach causes irreparable harm and that injunctive relief will follow. Each of the three systems attaches conditions.

United States. A court may grant an injunction to prevent actual or threatened misappropriation, but the order must not prevent a person from entering into an employment relationship, and conditions placed on such employment must rest on evidence of threatened misappropriation; what the person happens to know is by itself an insufficient basis for them. The order also must not conflict with applicable State law prohibiting restraints on the practice of a lawful profession, trade or business. In exceptional circumstances that make an injunction inequitable, the court may instead condition future use on payment of a reasonable royalty for no longer than the period for which use could have been prohibited. All of that is 18 U.S.C. §1836(b)(3)(A).

California is the sharpest example of the State-law limit. Business and Professions Code §16600 provides that "except as provided in this chapter, every contract by which anyone is restrained from engaging in a lawful profession, trade, or business of any kind is to that extent void", is to be read broadly to void any noncompete in an employment context however narrowly tailored, and is not limited to contracts where the restrained person is a party. Section 16600.5 adds that a contract void under the chapter is unenforceable regardless of where and when it was signed, that an employer must not attempt to enforce one even where the contract was signed and the employment maintained outside California, and that an employee, a former employee or a prospective employee has a private action for injunctive relief, actual damages, and attorney's fees. The two sections are built differently. Section 16600 opens with "except as provided in this chapter", so it voids a restraint only where nothing in the chapter excepts it. Section 16600.5 does not repeat that qualifier; it opens on "any contract that is void under this chapter", which is what carries the same exceptions into it — the sale of business goodwill in §16601, a partner's covenant on the dissolution of the partnership or dissociation from it in §16602, and a member's covenant on the dissolution of an LLC or the termination of that member's interest in it in §16602.5.

United Kingdom. The Trade Secrets (Enforcement, etc.) Regulations 2018 give a court power to order interim cessation or prohibition of use or disclosure, prohibition of dealings in infringing goods, and seizure or delivery up (regulation 11(1)). Before making the order the court may require evidence satisfying it, to a sufficient degree of certainty, that a trade secret exists, that the applicant is the trade secret holder, and that the alleged infringer has acquired, is using or disclosing, or is about to use or disclose it (regulation 12(1)). The court must weigh eight proportionality factors including the measures taken to protect the secret and the safeguard of fundamental rights (regulation 12(2)). The order may be made conditional on the applicant lodging security (regulation 11(8)), and where the court sets no period, the holder must bring merits proceedings within 20 working days or 31 calendar days, whichever is longer (regulation 11(4)). Final injunctions and corrective measures come under regulation 14, and a person facing them may apply for compensation instead where they neither knew nor ought to have known of the upstream unlawfulness, the measures would cause disproportionate harm, and payment appears reasonably satisfactory; that compensation is capped at the royalties or fees that would have been due for the period during which use could have been prohibited (regulation 16). Regulation 3 preserves the wider breach of confidence action alongside all of this.

European Union. The structure mirrors the UK regulations because they implement it: Article 10 for provisional and precautionary measures, Article 11(1) for the evidential threshold and Article 11(2) for the same eight proportionality factors, Article 11(3)(a) for the 20 working days / 31 calendar days rule, Article 11(4) for security, Article 12 for injunctions and corrective measures on the merits, and Article 13(3) for pecuniary compensation in place of an injunction, capped at the royalties that would have been due.

The practical point behind all three: interim relief is available, it is conditional, and it is fast-expiring unless you are ready to litigate the merits. The remedies paragraph in a template does not shorten any of that.

Where the template gives out, scenario by scenario

STEP 1 — Publisher negotiations

A unilateral NDA covering only your disclosures leaves the publisher's term sheets, market data and feedback unprotected, and leaves you with no argument when a similar title appears. Make it mutual, and make the permitted purpose the specific deal.

STEP 2 — Showing a build

The confidentiality clause governs documents. Study of the object needs the purpose clause, and against an EU counterparty the software directive caps how far that restriction can run. Assume the build will be examined and pick what you show accordingly.

STEP 3 — Source code to a contractor

Three documents do this job: confidentiality, a signed assignment or licence of the copyright, and escrow or deposit arrangements if the contractor holds the only working copy. The NDA covers none of the second or third.

STEP 4 — Player data

The moment personal data moves, Article 28(3) applies and an NDA is not a substitute. Get the processing terms, the sub-processor chain and the deletion-or-return mechanic written down.

STEP 5 — Investor diligence

An investor may decline to sign an NDA at all, and where one signs, the carve-outs for existing portfolio companies and for information independently received are what decide its reach. Stage the disclosure instead: what goes into the data room at which round, and what never leaves the building.

STEP 6 — Freelancers across jurisdictions

One governing-law clause, several mandatory local rules that override it. Reporting carve-outs, restraint-of-trade limits and employee-mobility protections all attach by the individual's location and status, and the governing-law clause does not move them.

STEP 7 — "They took the idea and we cannot prove a breach"

This is a proof problem, and it is solved before the disclosure. Log what was shown, to whom, on what date and under which agreement. The measures taken to keep information secret are an element of trade secret status in both the EU and the US definitions, and in the UK they are a listed factor in the interim-relief balance.

What an NDA does not do at all

Three cases, and what actually happened in them

ZeniMax v. Oculus. The trade secret headline and the judgment diverge. The jury charge and verdict form submitted a common law trade secret misappropriation claim and listed the technologies ZeniMax asserted as its secrets, among them distortion correction and chromatic aberration correction. Question 1 asked whether ZeniMax had proved that any defendant misappropriated those claimed trade secrets, and on page 18 of that form the jury wrote "no" against each of the five: Oculus, Facebook, Palmer Luckey, Brendan Iribe and John Carmack. The Final Judgment in ZeniMax Media Inc. v. Oculus VR LLC, No. 3:14-CV-1849-K (N.D. Tex.), awarded $200,000,000 on the breach of contract claim and $50,000,000 on the copyright infringement claim, entered judgment for the plaintiffs on the conversion claim against Carmack with no damages, and then stated: "As to all other claims asserted in this matter by Plaintiffs, judgment is entered in favor of Defendants and against Plaintiffs. Plaintiffs shall take nothing on these claims." The jury's $250,000,000 across three defendants for false designation was removed on the defendants' Rule 50(b) motion, the court holding the evidence of damages and of proximate cause legally insufficient. That reasoning is in the accompanying Memorandum Opinion and Order. The docket record for the same day carries a further order denying the plaintiffs' motion for entry of a permanent injunction. The cross-appeals were dismissed on 11 December 2018 by stipulation of the parties, and satisfaction of judgment was filed. What carried $200 million was the contract. The trade secret claim produced nothing.

Vestergaard Frandsen v Bestnet Europe. In [2013] UKSC 31, Lord Neuberger, with the agreement of Lord Clarke, Lord Sumption, Lord Reed and Lord Carnwath, dismissed the appeal against a former employee. Her contract required her to "keep absolutely confidential all information relating to the employment and any knowledge gained in the course of the employment and which inherently should not be disclosed to any third party", expressly continuing after termination. She had helped found and run the competing company. The judgment records at paragraph 30 that those express provisions "are of no assistance to Vestergaard's case", because the information actually misused "was plainly neither 'information relating to [her] employment' nor 'knowledge gained in the course of [her] employment'". It was knowledge gained by a consultant. Paragraph 31 rejected an implied term of strict liability as inconsistent with the narrower express clause and "almost penal in nature". The protection ran exactly as far as the words of the clause, and stopped.

Community for Creative Non-Violence v. Reid. 490 U.S. 730 (1989). The commissioning party directed the design, paid the price, took delivery and displayed the work, and did not own the copyright. The Court held the sculptor was an independent contractor under common law agency principles, so the work-for-hire question turned on the enumerated categories, which sculpture does not satisfy. Control over the output is not the test.

What to check in the form on your desk

Points one to five are drafting. Points six and seven are the ones that turn a clean NDA into an incomplete file, and they are why the paperwork for a launch gets scoped as a set of documents sized to the deal. That is the same logic that shapes licensing and compliance work generally.

Our working rule when we review a counterparty's form: fix the definition and the purpose, insert the reporting carve-out, and then check what other documents the transaction needs. An NDA that is correct and alone is a common way to lose ownership of work you paid for.
— Futura Digital's assessment