NDA Review Checklist: 8 Things to Check Before Signing

1. Is 'confidential information' defined too broadly?

The definition of "confidential information" determines the scope of everything else in the NDA. A tight definition protects both parties appropriately. An overly broad definition turns ordinary business communication into a potential breach.

Watch out for definitions that include:
• Any information "disclosed in connection with the relationship" without further limitation
• Information that is "marked confidential" but also "any information a reasonable person would consider confidential" — this second catch-all is very broad
• The other party's general "business methods" or "strategies" without specificity

A fair definition typically includes a reasonable list of categories (trade secrets, customer lists, financial data, product roadmaps, etc.) plus a carve-out for information in the public domain, information you knew before signing, and information independently developed.

2. Is the NDA mutual or one-sided?

A mutual NDA (also called a bilateral NDA) binds both parties equally — each party's confidential information is protected by the same obligations. A unilateral NDA only protects one party (typically the disclosing party).

The issue: if you are sharing confidential information with the other party, a one-sided NDA leaves your information unprotected. This is a significant gap.

Ask yourself: will both parties be sharing sensitive information, or only one? If both, insist on a mutual NDA. If you're a vendor being shown customer data, a one-sided NDA protecting the customer's data may be appropriate — but be clear about who is protected.

3. How long do the obligations last?

Duration is one of the most commonly negotiated NDA provisions.

Reasonable duration for most NDAs: **2–5 years** from the Effective Date or from the date of disclosure.

Red flags:
• "Perpetual" or "indefinitely" — NDAs without expiration dates are overreaching for most business relationships
• Very short durations (less than 1 year) that may not adequately protect genuinely sensitive information
• Different durations for different categories of information without justification

Trade secrets are the exception: protection for trade secrets can legitimately extend indefinitely under separate trade secret law, even if the NDA itself expires. Many NDAs include a carve-out that says confidentiality obligations for trade secrets survive the expiration of the agreement.

4. Are the standard carve-outs present?

Every well-drafted NDA should include carve-outs for situations where confidentiality obligations don't apply. If these are missing, you could be in breach even when using information you had every right to use.

The four standard carve-outs:
1. **Public domain**: Information that is or becomes publicly available through no fault of yours
2. **Prior knowledge**: Information you already knew before signing (often requires you to document it)
3. **Independent development**: Information you develop independently without reference to the disclosed information
4. **Required disclosure**: Information you are required to disclose by law, court order, or regulatory requirement (typically requires you to give notice to the other party)

If any of these four are missing, ask why and push to add them.

5. Is there a hidden non-compete or non-solicitation clause?

Many NDAs include provisions beyond confidentiality. These "extra" provisions are easy to overlook because they're buried in an agreement you already expect to be signing.

Common extras to watch for:
• **Non-solicitation of employees**: You can't recruit the other party's employees for a defined period
• **Non-solicitation of customers**: You can't solicit the other party's customers for a defined period
• **Non-compete**: You can't work for or with competitors — often much harder to enforce in an NDA context, but still alarming if you don't see it coming

These provisions may be reasonable in specific contexts (like a business partnership NDA), but they may be entirely out of place in an NDA for preliminary business discussions. Read the full agreement.

6. Who bears the burden of proof for breach?

Some NDAs shift the burden of proof in ways that can be very difficult for you to meet.

For example: "Recipient shall bear the burden of proving that any disclosed information falls within a carve-out." This means that if there's a dispute about whether information was truly public or independently developed, you have to prove it — which can be expensive and difficult.

A fair NDA is neutral about burden of proof, or at least doesn't make it structurally harder for you to prove your case. If the burden-shifting language is particularly aggressive, negotiate to remove it or make it mutual.

7. What remedies are specified?

The remedies section tells you what the other party can do if you breach the NDA.

Standard remedies include injunctive relief (a court order to stop the disclosure) and monetary damages. These are both normal and expected.

Be cautious about:
• **Liquidated damages clauses** that specify a large fixed payment per breach without requiring proof of actual harm — these can be disproportionate
• **Mandatory waiver of jury trial** — common in commercial contexts, but worth noting
• **Requirement that you cover the other party's legal fees** even if you ultimately prevail

"Irreparable harm" language stating that breach would cause irreparable harm and that the disclosing party is entitled to injunctive relief is standard and uncontroversial — this is not a red flag.

8. Which state's law governs?

The governing law clause determines which state's courts and statutes apply if there's a dispute. This matters for NDAs because state law can affect:

• Whether non-solicitation provisions are enforceable (some states limit these)
• What constitutes adequate "consideration" for the NDA
• How courts interpret vague contract language
• The statute of limitations for bringing a claim

If you're in California and the NDA specifies New York law, that choice of law may (or may not) be honored by a California court. Courts often apply the law of the state with the most significant relationship to the dispute.

If the governing law is far from where you're located and the legal context seems designed to be disadvantageous to you (e.g., a state with more aggressive trade secret remedies), it's worth asking why that state was chosen and whether it can be changed to your home state.