Evaluation Framework
Work through the following ten areas systematically for every NDA that comes in.
1. Agreement Format and Direction
- Mutual vs. unilateral: Determine whether both parties share information (mutual) or only one side discloses (unilateral, and if so, confirm the direction is correct for the relationship)
- Context fit: Verify the NDA type matches the business scenario -- mutual for exploratory discussions, unilateral when information flows one way
- Standalone check: Confirm this is a pure confidentiality agreement rather than a confidentiality section buried inside a broader commercial contract
2. Scope of Protected Information
- Breadth: The definition should be appropriately bounded, not an all-encompassing net like "any and all information regardless of form or marking"
- Designation mechanics: If marking or written identification is required, confirm the process is workable (written confirmation within 30 days of oral disclosure is the market norm)
- Required exceptions: Standard carve-outs must be present (see Area 4 below)
- Overreach: The definition must not capture publicly available data or material the receiving party developed on its own
3. Recipient Duties
- Care standard: The agreement should require reasonable care, or at minimum the same level of protection the recipient applies to its own sensitive information
- Purpose limitation: Usage must be confined to the stated business objective
- Sharing restrictions: Distribution limited to individuals with a genuine need who are bound by equivalent obligations
- Practicality: No operationally burdensome mandates such as encrypting every communication or maintaining physical access logs
4. Required Carve-Outs
Every acceptable NDA must contain all five of these exceptions:
- Publicly available: Information already in or entering the public domain without fault of the recipient
- Already known: Information the recipient possessed before it was disclosed
- Self-developed: Information the recipient created independently without accessing or referencing the disclosed material
- Legitimate third-party source: Information obtained from another party who was free to share it
- Compelled disclosure: The right to disclose under legal, regulatory, or judicial compulsion, with notice to the discloser where law permits
5. Authorized Sharing
- Internal personnel: Employees with a need to access the information
- Professional advisors: Outside counsel, accountants, and consultants operating under matching confidentiality duties
- Corporate affiliates: Parent, subsidiary, or sister companies when the business purpose requires it
- Regulatory and judicial: Disclosures mandated by law, regulation, or court order
6. Time Boundaries
- Agreement duration: A reasonable window for the business relationship, typically one to three years
- Post-termination survival: Confidentiality duties should persist for a defined period after the agreement ends, typically two to five years; trade secrets may justify longer protection
- No perpetual obligations: Indefinite confidentiality commitments are unacceptable unless narrowly limited to trade secret material
7. Information Return and Disposal
- Trigger: Obligation activates upon termination or upon written request
- Scope: Covers all copies of protected information in any medium
- Compliance exception: Must allow retention of copies that law, regulation, or internal compliance and backup policies require
- Verification: A written confirmation of disposal is standard; a sworn affidavit is excessive
8. Enforcement and Remedies
- Equitable relief: An acknowledgment that breach could cause irreparable harm and that injunctive or equitable remedies may be appropriate -- this is standard language
- No pre-set damages: Liquidated damages provisions are unusual and unwelcome in NDAs
- Balanced application: In mutual agreements, remedy provisions should apply equally to both sides
9. Hidden Provisions to Flag
Watch for terms that do not belong in a standard confidentiality agreement:
- Employee non-solicitation -- inappropriate in an NDA
- Non-compete restrictions -- inappropriate in an NDA
- Exclusivity -- should not prevent either party from pursuing parallel discussions with others
- Standstill -- only appropriate in a formal M&A context
- Residuals clause -- if present, must be tightly limited to unaided memory of authorized individuals and must exclude trade secrets and patented material
- IP transfer or license -- an NDA should grant zero intellectual property rights
- Audit provisions -- not customary in standard confidentiality agreements
10. Jurisdiction and Dispute Mechanics
- Forum selection: Should be a well-regarded commercial jurisdiction
- Internal consistency: Governing law and dispute forum should be in the same or closely related jurisdictions
- Dispute pathway: Litigation is generally preferred over arbitration for NDA disputes; mandatory arbitration is a flag
Classification Rules
GREEN -- Approve for Signature
Every one of these conditions must hold:
- Mutual structure (or correctly-directed unilateral)
- All five required carve-outs present
- Duration within standard bands (one to three year term, two to five year survival)
- Free of non-solicitation, non-compete, and exclusivity provisions
- No residuals clause, or one that is tightly constrained
- Reasonable forum and governing law
- Standard remedy provisions without liquidated damages
- Authorized sharing extends to employees, advisors, and contractors
- Return/disposal provisions include a compliance retention exception
- Confidential information definition is reasonably bounded
Next step: Route for execution under standard delegation authority. No attorney review needed.
YELLOW -- Targeted Attorney Review
At least one of these conditions exists, but the agreement is fundamentally sound:
- Confidential information definition is broader than ideal but not unreasonable
- Duration exceeds the standard band but remains within market norms (five-year term, seven-year survival)
- One standard carve-out is absent but could be easily added
- Residuals clause exists but is narrowly tailored to unaided memory
- Governing law in an acceptable but secondary-choice jurisdiction
- Modest asymmetry in a mutual agreement (one party has slightly wider sharing rights)
- Marking requirements exist but are manageable in practice
- Return/disposal section lacks an explicit compliance retention exception (likely implied, should be added)
- Unusual but benign provisions (such as a duty to report suspected breaches)
Next step: Forward to the assigned reviewer with a specific list of issues. Typically resolvable with a single round of targeted edits.
RED -- Full Legal Engagement Required
At least one of these conditions exists:
- Wrong structure for the relationship (unilateral when mutual is needed, or facing the wrong direction)
- Critical carve-outs missing (particularly independent development or compelled disclosure)
- Non-solicitation or non-compete language embedded in the NDA
- Exclusivity or standstill terms without proper M&A context
- Extreme duration (ten or more years, or perpetual without trade secret justification)
- Definition so broad it could encompass public information or independently created work
- Expansive residuals clause that functions as a de facto usage license
- Intellectual property assignment or license grant concealed in the NDA
- Liquidated damages or penalty terms
- Audit rights with vague scope or no notice requirements
- Hostile jurisdiction combined with mandatory arbitration
- The document is not actually a confidentiality agreement (contains substantive commercial obligations, exclusivity, or deal terms beyond non-disclosure)
Next step: Do not execute. Engage counsel for comprehensive review. Prepare a counterproposal using the organization's standard-form NDA, or decline and negotiate.
Frequently Encountered Issues
Overreaching Confidential Information Definition
Preferred approach: Limit protected information to non-public material disclosed in connection with the stated purpose. Information should be marked as confidential or be of a nature that a reasonable person would recognize as sensitive given the context.
Absent Independent Development Exception
Preferred approach: Insist on a carve-out for material developed internally without access to or reliance on the discloser's protected information. Exposure without it: Creates vulnerability to claims that internally-built products or features derived from the counterparty's confidential material.
Employee Non-Solicitation Buried in an NDA
Preferred approach: Remove entirely. Non-solicitation terms belong in employment agreements, acquisition documents, or specific commercial deals. Fallback: If the other side insists, confine to active targeting (exclude general recruiting) and cap the duration at twelve months.
Overreaching Residuals Language
Preferred approach: Resist residuals clauses entirely. If unavoidable, restrict to: (a) general concepts and know-how retained in the unassisted memory of authorized personnel; (b) explicitly carve out trade secrets and patentable subject matter; (c) confirm no IP rights are granted. Exposure if too broad: Effectively creates a blanket license to exploit the discloser's sensitive information for any purpose.
Indefinite Confidentiality Duties
Preferred approach: Set a defined survival window of two to five years from disclosure or termination, whichever falls later. Offer a separate trade secret carve-out providing protection for as long as qualifying information retains trade secret status.
Routing Summary
| Classification | Recommended Path | Expected Turnaround | |---|---|---| | GREEN | Execute under standard signature authority | Same business day | | YELLOW | Route to designated reviewer with flagged issues | One to two business days | | RED | Full counsel engagement; counterproposal or standard form substitution | Three to five business days |
For YELLOW and RED outcomes:
- Identify the specific reviewer or role responsible (when organizational routing rules exist)
- Provide a concise issue summary so the reviewer can quickly orient
- For RED-classified agreements, recommend substituting the organization's own standard NDA as a counterproposal when one is available