Non-Disclosure Agreement NDA

A non-disclosure agreement states what information is confidential, what the recipient may do with it, and for how long. Suppose a company that is considering buying a competitor asks to see its customer contracts. The owner will want a signed promise first that the contracts will be read only to assess the purchase, and will not be shown to anyone outside the buyer's deal team.

The agreement starts with a definition of the confidential information. Too narrow, and something important falls outside it. Too wide, and it becomes hard to apply. Next comes the permitted purpose, followed by the people who may see the information, such as employees and professional advisers who need it. Standard exclusions follow: information that is already public, that the recipient already held, or that the recipient developed independently. Most agreements also allow disclosure that a law or a court requires.

The closing clauses set the duration, require the information to be returned or destroyed at the end, and name the governing law. What a party can claim after a breach depends on that law.

Because the legal protection depends on what the holder did to keep the information secret, and the agreement is evidence of it. The EU Trade Secrets Directive, Directive (EU) 2016/943, protects trade secrets where the holder has taken reasonable steps to keep them secret. Requiring a signed agreement before sharing information is one way to show that such steps were taken.

An agreement also does things the general law does not. It can cover information that would not meet the legal test for a trade secret. It also records what was shared, with whom and for what purpose.

Yes, in principle. Article 25(1) of the eIDAS Regulation says that an electronic signature cannot be denied legal effect or refused as evidence solely because it is electronic. Article 2(3) leaves national rules on the form of contracts in place, so the governing law has the last word. A form requirement is most likely to matter when the confidentiality terms sit inside another contract that has its own rules, such as an employment contract.

The signature level is usually a question of evidence. These agreements are signed often and quickly, and a simple electronic signature is common. That works until the agreement has to be enforced. The party relying on it must then show who signed, and that the signer could bind the company named in it. A qualified electronic signature has the equivalent legal effect of a handwritten one under Article 25(2), and it is issued only after the signer's identity has been verified. The more valuable the information, the more that proof is worth.

No EU rule requires an identity check before a non-disclosure agreement is signed. Signing one is not among the events that trigger customer due diligence. Article 19(1) of the EU Anti-Money Laundering Regulation lists those events, and the first is establishing a business relationship. The duty falls on a firm in relation to its own client. As a rule it does not extend to the party on the other side of a confidentiality agreement.

The timing can still catch a firm out. A non-disclosure agreement is often the first document signed in a deal, before any engagement letter. An adviser who starts acting for a client at that point may already have established a business relationship, with the duties that follow.

For the parties themselves, the practical question is authority. An agreement signed by someone who had no power to bind the company may not bind it. Whether it does depends on the governing law. Before sharing anything sensitive, check that the name on the signature block matches a person entitled to represent the company, or ask for the power of attorney.

Not on its own. A non-disclosure agreement is a promise between two parties, while the GDPR sets duties owed to the people the data is about. Those duties apply whatever the contract says. Under Article 5(1)(c) of the GDPR, personal data shared must be limited to what the purpose requires. In the example above, that could mean removing the names of individual contacts from the customer contracts before the buyer reads them.

If the recipient will process personal data on behalf of the discloser, Article 28(3) requires a contract with specific content. Confidentiality is one item on that list. The others include processing only on documented instructions, security measures and rules on sub-processors. A non-disclosure agreement that lacks them does not meet the requirement.

As long as the agreement says, within the limits of the governing law. Many run for a fixed number of years from signing or from the end of the discussions. Others protect trade secrets for as long as the information stays secret. Whether an obligation with no end date can be enforced is a question for national law, so an agreement that relies on one deserves a second look.

Records matter as much as the term. Keep the signed agreement together with a log of what was disclosed, to whom and when, and the confirmation that material was returned or destroyed. A claim for breach is hard to bring without proof of what the other side received. How long to keep the file depends on the limitation period under the governing law.