Most of what's published about the NDA vs confidentiality agreement question lands on the same reassurance: they're the same contract under two names, so pick a title and move on. That's accurate but misleading. The label really doesn't change your legal position. What changes it is whether the document names the information precisely enough to identify, sets a duration that matches what that information is worth, and lines up with how your company handles it on an ordinary Tuesday.
Founders tend to stop at the title question because it's the easy one. The expensive failures live in three other places: a scope so vague it protects nothing in particular, a duration copied from someone else's template, and a set of promises the business never backs up with access controls. Get those three right and the heading on page one is decoration. Get them wrong and a document called either name collapses when you need it.
Table of Contents
- NDA and Confidentiality Agreement Side by Side
- Clauses That Decide Whether the Document Works
- How Long Confidentiality Obligations Should Last
- Where Confidentiality Terms Go Too Far
- Choosing the Right Document for Each Situation
- Protection Depends on Controls, Not the Label
NDA and Confidentiality Agreement Side by Side
In U.S. business practice, NDA and confidentiality agreement describe the same core contract: a private agreement that identifies protected information, limits how the recipient may use or disclose it, and sets out obligations after access ends. The distinction is one of emphasis rather than legal category. An NDA foregrounds the recipient's promise not to disclose. A confidentiality agreement usually signals a fuller operational framework built around that promise.
| Aspect | NDA | Confidentiality agreement |
|---|---|---|
| Typical emphasis | Recipient's promise not to disclose | Broader framework covering permitted users, security, return of information and exclusions |
| Typical direction | Often one-way, from discloser to recipient | Often mutual, where both sides share sensitive information |
| Typical length | Short, often a few pages | Longer, with more operational terms |
| Common use | Pitches, first meetings, vendor evaluations | Due diligence, ongoing collaboration, data sharing |
| How courts read it | Enforceable; judged on scope, duration and actual secrecy measures | Enforceable; fuller operational terms are stronger evidence of reasonable secrecy measures |
Read those rows as a question of emphasis, not category. Nothing stops a document titled NDA from carrying security obligations, and nothing stops a confidentiality agreement from running three pages. What the fuller framework buys you is coverage of everything that happens after signature: who inside the recipient's company may see the material, what system it sits behind, when it comes back or gets destroyed, what falls outside protection, and how long duties run.
A practical test: if you can't say in one sentence who may see the information and for how long, you're holding the short version and you need the fuller one.
Direction is the other half of the choice. A mutual document suits a two-way exchange where both sides hand over sensitive material. A unilateral NDA matches a one-way flow, where you disclose and the other side only receives. If you inspect just two rows before drafting, check direction and scope, because they decide most of what follows: which clauses stay symmetrical, how the definition gets written, and whether each side's material needs its own schedule.
One thing founders rarely think about until a dispute is whether the emails they exchanged with counsel about that draft remain protected. Keeping lawyer-client chats legally protected explains what shields those conversations and where the line sits.
Clauses That Decide Whether the Document Works
The naming argument is settled further up the chain than most founders realize. U.S. federal regulations define a "Non-Disclosure Agreement" to include "any nondisclosure or confidentiality agreement, policy, or form," which is about as explicit as a regulatory definition gets (48 CFR 2803.901). Protection comes from the operative provisions. The heading is furniture.
A workable agreement answers eight questions in writing. Skip one and the gap becomes the argument the other side makes.
- Direction of disclosure. Decide unilateral or mutual first. A founder-to-investor conversation usually runs mutual because both sides exchange sensitive material. A company-to-contractor engagement usually runs unilateral because only one side discloses anything worth protecting.
- A definition that names things. List categories: pricing models, unreleased product roadmaps, a named customer list with contract terms, source code repositories. "All business information" hands the interpretation to a judge who has never seen your business.
- Permitted purpose and authorized recipients. Restrict use to evaluating a specific transaction or performing specific work, and name who may access the material, such as outside counsel, the accountant and two named engineers.
- Exclusions. Public information, material the recipient already knew, material developed independently without reference to the disclosure, and information lawfully received from a third party with no duty attached.
- Compelled disclosure. Require notice before disclosure where lawful and cooperation on a protective order, so a subpoena doesn't become a breach.
- Return or destruction. Set a deadline and, for trade secrets, a written certification that copies and derivatives are gone.
- Duration. Tied to the information class, covered below, rather than a round number borrowed from a template.
- Remedies. An express injunctive-relief clause helps at a preliminary hearing, but don't treat an injunction as automatic.
The federal definition reaches classified-information forms too, which tells you something useful. "NDA" is a functional label covering a wide range of instruments, not a standardized architecture. The same rules also bar internal confidentiality terms that restrict lawful reporting of waste, fraud or abuse on government contracts, so a broad gag clause can be unenforceable on its own terms.
Draft the exclusions list before the definition. Working out where protection stops tells you what it covers, and it's faster than trying to enumerate everything upstream. Customized agreements protect scope, revenue, IP ownership and termination rights in ways a downloaded template rarely manages for a specific business model, and clauses in a contract shows how those provisions interact inside a longer document. If you're tightening your own drafting process, drafting contracts that hold up is a useful companion.
How Long Confidentiality Obligations Should Last
Start with the market. 74% of NDAs with a fixed expiration in 2024 used a one-year term, according to Common Paper's 2024 Contract Benchmark Report. That's a default for ordinary commercial paper, not a rule of law, and copying it onto every category of information is where duration clauses go wrong.
Two failures cost founders real protection. The first is a fixed end date bolted onto a trade secret, which can cut off the protection the secret was supposed to receive while it's still valuable. The second is an open-ended obligation on routine business information, which invites a fight about reasonableness and gives a court room to trim the clause or refuse it entirely. Classify by sensitivity first, then match a duration to each class.
| Information type | Typical duration | Drafting note |
|---|---|---|
| Ordinary business information | One year, the most common fixed term (74% in 2024 benchmark) | Tie the period to the deal or relationship end |
| Trade secrets, including source code and algorithms | As long as the information stays secret, subject to applicable law | A fixed end date can end trade-secret protection; pair with reasonable secrecy measures and a survival clause |
Counting From Disclosure or From the End of the Deal
The starting point matters as much as the length. A term that runs from disclosure can expire while the relationship is still live, which is the worst outcome for a multi-year vendor arrangement. A term that runs from termination or expiration tracks the deal and gives you a clean clock.
A separate survival clause does the work the main term can't. It keeps the confidentiality duty alive after the agreement itself ends, after the contractor is off the project, and after the investor passes on the round.
Drafting rule: set the duration by information class, then add a survival clause so confidential treatment doesn't die on the same day as the agreement.
For anything you'd call a trade secret, a fixed calendar date is the wrong instrument. Trade secret protection lasts while the information stays secret, which is a factual question about your controls, not a drafting preference.
Keep a one-page register listing each protected category, its class, and its expiry or review date. Check it once a year. Two minutes of calendar work prevents the situation where a customer list falls out of protection because nobody remembered the date.
Where Confidentiality Terms Go Too Far
A confidentiality clause can create noncompete risk when it claims more than confidential information. Defining protected material to include an employee's general knowledge, skills, public information, or experience across an entire industry may restrict future work instead of protecting identifiable business information. Legal scholarship describes such provisions as potential “de facto” noncompetes (Washington University Law Review).
That overreach can weaken the protection the agreement is meant to provide. Specify the confidential categories, exclude information that is public or independently developed, and avoid language that treats everything learned on the job as the company's secret.
Federal and state rules also affect how restrictions operate. State restrictions vary, so businesses with employees in multiple states should review governing-law and forum clauses alongside the scope of confidentiality duties.
Some disclosures cannot be barred by contract. SEC Rule 21F-17 prohibits actions that impede communication with the Securities and Exchange Commission about possible securities violations, including enforcing or threatening to enforce a confidentiality agreement (17 CFR 240.21F-17). Under the Defend Trade Secrets Act, an employer generally must provide the statutory whistleblower-immunity notice in the agreement or a cross-referenced policy to seek exemplary damages and attorney fees against an employee (Bloomberg Law's explanation of confidentiality agreements).
Include clear exceptions for legally protected disclosures, government reporting, subpoenas, and cooperation with regulators. Then ask whether the restriction would prevent someone from working in their field. If it would, narrow the clause and protect trade secrets through access controls as well as precise drafting.
Choosing the Right Document for Each Situation
Work through three questions in order: the direction of information flow, then the sensitivity of what's moving, then the duration. Most drafting errors come from starting with duration, because the calendar is the easiest thing to copy from someone else's paper.
| Situation | Usually fits | Clause to add |
|---|---|---|
| Investor or acquirer reviewing financials | Mutual confidentiality agreement | Purpose limited to evaluating the deal, with return or destruction if it does not close |
| Pitching an idea to a prospective partner | Unilateral NDA | Scope limited to the pitch materials and a clear exclusion for public information |
| Contractor building software | Unilateral NDA with invention assignment | Return of code and credentials at the end of the engagement |
| Employee with access to customer lists | Confidentiality agreement in the employment contract | Whistleblower-immunity notice under the Defend Trade Secrets Act |
| Sharing data with an overseas vendor | Confidentiality agreement with data-handling terms | Governing law and forum clause |
| Brand partner or creator deal | Confidentiality agreement within the deal terms | Exclusions for information already public or independently created |
Two Situations Worked Through
A founder pitching a prospective investor who will share financials back should use a mutual confidentiality agreement limited to evaluating the deal, with a return-or-destroy obligation if no deal closes. The mutuality isn't courtesy. It's what gets the investor to sign without a negotiation, and it captures the investor's own data, which you're now obligated to protect too.
A company hiring a contractor to build software needs a unilateral NDA paired with an invention assignment, plus a clause requiring return of code and credentials when the engagement ends. Without the assignment, the contractor may own what they build. Without the credential clause, a departing developer keeps production access long after the final invoice.
When both sides disclose, mutual is the fairer structure. When one side discloses, a unilateral NDA matches the actual flow and is easier to enforce clause by clause.
List the information categories each party will receive before you draft a word. That list usually answers the mutual-versus-unilateral question before you get to the template. We draft NDA and confidentiality agreements to protect trade secrets, proprietary data and pre-launch projects, and our contract review and negotiation work covers redlining NDAs, vendor agreements and SaaS deals before anything is shared. Signing is a separate step, and startup walkthrough for non-compete signatures is a practical guide to getting execution right once the terms are settled.
Protection Depends on Controls, Not the Label
The title on an agreement does little to protect information by itself. What matters is whether the document identifies what must stay confidential, limits who can use or disclose it, and matches the safeguards the business follows.
The Uniform Trade Secrets Act was completed in 1979 and amended in 1985. Many states, including Florida and Delaware, have adopted versions of the Act. Federal law also allows a trade secret owner to bring a civil action when misappropriation involves a product or service used in, or intended for use in, interstate or foreign commerce. Remedies may include an injunction, damages for actual loss or unjust enrichment, a reasonable royalty, and, in some circumstances, exemplary damages and attorney's fees (Cornell's overview of trade secrets).
A confidentiality clause cannot substitute for reasonable steps to keep information secret. Use specific categories, limit access, and apply safeguards consistently. A customer list identified in the agreement and stored in a CRM with role-based permissions is easier to protect than a broad reference to “business information” that nobody manages in practice.
Before you sign: Check that the agreement describes controls the business actually uses, covers the right information, includes appropriate exceptions for public information and protected reporting, and sets a duration for each category.
Keep an inventory of protected information, limit access by role, document onboarding and offboarding, and preserve evidence that the business treated the material as confidential. Data security practices for businesses can help align day-to-day controls with the agreement.
For trade secrets, regulated data, or a deal likely to lead to a dispute, have counsel review the document before sharing information. Coto & Waddington, Attorneys at Law offers contract review and negotiation, with flat, predictable pricing and transparent proposals. No attorney-client relationship forms until the firm and client execute a signed engagement agreement.
Sharing a data room, source code repository, or customer list without clear terms and practical safeguards can expose information to unnecessary risk. Coto & Waddington drafts, reviews, and redlines NDAs and confidentiality agreements to protect trade secrets, proprietary data, and pre-launch projects. Visit Coto & Waddington, Attorneys at Law to request a proposal.
