When should a startup use an NDA?

8 June 20265 min readContracts

What an NDA actually does

It creates a contractual obligation not to disclose or misuse defined information, and it creates a record of what was disclosed, to whom, and on what terms. Those two functions are real and worth having.

What it does not do is prevent disclosure. If someone means to take your information, they will, and your position afterwards depends on being able to prove three things: that the information was confidential, that this person disclosed or used it, and what that cost you. The third is usually the hardest, and the reason confidentiality litigation is less common than the volume of NDAs signed would suggest. Where a breach is threatened rather than complete, an injunction is often the more meaningful relief, which is one reason clauses expressly acknowledging that damages may be an inadequate remedy are worth including.

When to insist on one

• Before technical disclosure. Architecture, source code, unpublished specifications, formulations, process detail.
• In acquisition or partnership discussions. Where you will hand over financials, customer lists, pricing or margin structures.
• With contractors and agencies. Anyone who will have access to internal systems or data. Here the obligation belongs in the engagement contract, alongside the intellectual property assignment.
• With employees handling sensitive material. Again, within the employment contract rather than as a separate document.
• Where a customer requires reciprocity. Enterprise customers will frequently want mutual confidentiality before a proof of concept.

When asking is a mistake

Before pitching an investor

Most institutional investors will decline, and it is not obstinacy. They see many companies in the same space and cannot take on overlapping confidentiality obligations to all of them. Asking marks the founder as inexperienced and costs the meeting far more often than it protects anything.

The answer is not to disclose less enthusiastically; it is to disclose differently. A pitch should carry the market, the problem, the traction and the team. The unpublished technical detail and the customer list can wait for diligence, which happens under an agreement in any event.

Where the idea is the only asset

An NDA protects information. It does not protect an idea from being had by someone else independently, and it is worth being clear-eyed that ideas are rarely the scarce input. If a business can be replicated from a description of it, the NDA is not the thing that will save it.

As a first document with a small counterparty

Sending a six-page mutual NDA to a two-person supplier before a first conversation slows everything down for a marginal gain. Judgment about proportion matters here as much as drafting.

What a workable NDA contains

A definition of confidential information that is neither everything nor nothing

"All information exchanged between the parties" is unhelpfully broad and invites a court to read it down. A definition that requires every document to be stamped "confidential" is unworkable in practice, because nobody does it. The middle course — information disclosed in connection with a stated purpose, which is either marked confidential or would reasonably be understood to be confidential in the circumstances — is the one that survives use.

The standard exclusions

Information already public, already known to the recipient, independently developed without reference to the disclosure, or received from a third party without breach. A counterparty will insist on these, and they are reasonable. Add a carve-out permitting disclosure required by law or by a court, with notice to the disclosing party where notice is permissible.

A stated purpose

The information is disclosed for a defined purpose and may be used only for it. This is the clause that converts "you did not disclose it" into "you were not permitted to use it for that", which is frequently the more provable complaint.

Permitted recipients

Employees, advisors and affiliates who need to know, on terms no less protective, with the disclosing party remaining responsible for their compliance.

A term proportionate to the information

Three to five years from disclosure is common for ordinary commercial information. For genuine trade secrets, an obligation lasting as long as the information remains secret is usual. Perpetual confidentiality over everything exchanged is unattractive and unlikely to be treated generously.

Return or destruction, and residuals

What happens at the end — return, destruction, or deletion subject to backup retention. Note that a "residuals" clause, permitting use of what individuals retain in unaided memory, substantially weakens the agreement for the disclosing party; read for it before signing someone else's paper.

Governing law, jurisdiction and remedies

Where disputes are to be resolved, and an acknowledgement that damages may be inadequate and that injunctive relief may be sought. If arbitration is chosen, the clause must name a seat and a workable appointment mechanism, or it will generate its own preliminary dispute.

What an NDA is not

It is not a non-compete, and it should not be used as one. Section 27 of the Indian Contract Act, 1872 makes an agreement in restraint of trade void, and Indian courts have generally declined to enforce restraints on competing after a relationship ends. A confidentiality agreement drafted to prevent someone from working in the same field is likely to be read for what it is.

Non-solicitation of employees and customers occupies a middle position and is more often upheld where it is reasonable in scope and duration, but it belongs in a properly drafted clause rather than smuggled into the definition of confidential information.

Two practical habits

First, keep a record of what you disclosed and when. An NDA with no evidence of what passed under it is difficult to enforce, and a short covering email identifying the material is usually enough.

Second, prefer a confidentiality clause inside the main agreement over a standalone NDA signed months earlier. Standalone NDAs are routinely forgotten, and their stated purpose — "evaluating a potential relationship" — often does not cover the relationship that eventually forms.