How to create an NDA that holds up

Here's how to create an NDA in one breath: decide who is disclosing what, write down exactly which information is confidential, list what isn't, set how long the duty lasts, and get it signed before anything changes hands. Most of the work sits in the second step.

What makes an NDA hold up isn't length. It's precision. Two pages that name the information, the purpose and the term do better in a dispute than ten pages calling "all information" confidential. And if you work with employees or contractors in the US, the law expects one particular paragraph in the text, the whistleblower notice covered below.

Start from one of the NDA templates in Chaindoc's library or from your own draft; the steps are the same.

A non-disclosure agreement, a confidentiality agreement and a CDA (confidential disclosure agreement, the label common in universities and pharma) are the same instrument. Courts read the clauses, not the title. So the confidentiality agreement vs NDA question is really a different one: do you need a standalone document at all?

Often you don't. If you're already signing a services or employment contract, a confidentiality clause inside it does the job. A standalone NDA earns its place when talks start before any main contract exists: an investor pitch, a supplier quote, due diligence on an acquisition.

A unilateral (one-way) NDA binds only the side that receives information. It's the normal form when you hire a contractor, onboard an employee or show a prototype to a manufacturer: you disclose, they keep quiet.

A mutual NDA binds both sides, because both will hand over something sensitive: two companies exploring a joint venture, a buyer and seller swapping numbers before an acquisition. A multilateral NDA does the same for three or more parties in one document.

The mutual vs unilateral NDA choice isn't about politeness. Offer a one-way NDA when the other side will share too, and you'll get a mutual version back plus a round of edits. Sign a mutual one "to be fair" when only you disclose, and you've taken on obligations for nothing.

A practical test: list what each side will show the other in the first month. If one list is empty, go unilateral. Contractors bring their own wrinkles, like source code and sub-contractors, covered in our guide to NDAs for software contractors.

Knowing how to create an NDA mostly means knowing which two clauses carry the weight: the definition of confidential information and the exclusions. The table lists the NDA clauses a working agreement needs and the mistake that turns up most often in each.

The definition clause decides most disputes

Write it as categories with examples, not as a mood. "Financial information, including pricing, margins and forecasts" can be enforced. "Any information of any kind" invites the argument that the clause is too broad to mean anything, and in some countries (see the German case below) that argument wins. Honestly, if you can't describe what you're protecting, you probably don't need an NDA yet.

Here's the part template sites skip. In the US and the UK an NDA can't stop people talking to certain authorities, and in one case the law expects a specific paragraph in the text.

The DTSA whistleblower notice (US)

Under the Defend Trade Secrets Act, an employer must give notice of whistleblower immunity "in any contract or agreement with an employee that governs the use of a trade secret or other confidential information" (18 U.S.C. § 1833(b)). Contractors and consultants count as employees here. It tells the person they may disclose a trade secret in confidence to a government official or a lawyer to report a suspected violation of law, or in a sealed court filing. Print the immunity in the NDA or cross-reference a policy document that describes it.

The rule covers agreements entered into or updated after May 11, 2016. An NDA between two companies doesn't trigger it; anything signed by an individual who works for you does.

Carve-outs that override the text

• SEC Rule 21F-17: nobody may stop a person contacting SEC staff about a possible securities violation, including by enforcing a confidentiality agreement.
• The Speak Out Act (2022): a nondisclosure clause agreed before a dispute arises can't be enforced in a sexual assault or sexual harassment dispute. Trade secret protection is untouched.
• State law, often stricter. Washington voids clauses in employee and contractor agreements that stop someone disclosing illegal discrimination, harassment, retaliation, wage-and-hour violations or sexual assault.
• UK: a clause is void in so far as it stops a worker making a protected disclosure (Employment Rights Act 1996, s.43J), and since 1 October 2025 in so far as it stops a victim of crime telling the police, a lawyer or a support service (Victims and Prisoners Act 2024, s.17).

What to write when you create an NDA for staff

One permitted-disclosures paragraph covers all of it: nothing in the agreement limits reports to government agencies or regulators, testimony, talking to a lawyer, or any disclosure the law protects. For individuals in the US, add the DTSA immunity text. Leaving it out saves nothing and makes a judge read the rest with suspicion.

As long as the agreement says, so it should say two things: the disclosure period (how long the parties keep exchanging information, often the length of the talks) and the confidentiality period (how long the recipient must keep quiet afterwards).

Two to five years after disclosure is the usual range for ordinary business information; US federal law fixes no number. Trade secrets work differently. Their legal protection lasts while they stay secret, so the NDA should protect them for that long, not until a date on the calendar.

What works badly is one unlimited term for everything. A court weighing an employee clause that bans talking about "all internal matters" forever sees a restraint on the person's next job. The periods below are market practice, not legal limits.

Yes. A well-drafted NDA is an ordinary contract, and courts enforce it with injunctions and damages. Under the Defend Trade Secrets Act a US court can order the recipient to stop, award damages and, in willful and malicious cases, add up to twice that amount. Trouble starts when an NDA tries to cover everything.

The clearest recent example comes from Germany. In October 2024 the Federal Labour Court looked at an employee clause demanding silence about all business secrets and "all other matters and processes" learned on the job, with no end date (BAG, 8 AZR 172/23). The court struck it down as a catch-all that worked like a post-employment non-compete clause without the compensation German law requires for one. Then it went further: the employer's trade-secret claim failed too, because it couldn't show what it had actually done to keep the data secret.

That second point travels. US federal law protects a trade secret only if the owner took "reasonable measures to keep such information secret". UK law and the EU trade secrets directive ask for "reasonable steps". An NDA is one of those measures, not all of them. If the files sit in a folder anyone in the company can open, the signature won't carry the case alone.

So, are NDAs enforceable? The narrow ones are, when access controls you could show a court back up the paper.

Most people working out how to make an NDA start from a template, and that's fine. Templates in Word and Google Docs formats are easy to find, and DocuSign offers a free NDA template that you fill in and sign inside its own service once you've created an account. For a full draft explained line by line, see our clause-by-clause NDA template.

Whatever the source, change these before anyone signs:

• the parties and the purpose, which no template can know
• the definition, rewritten as your own categories
• the term, split into the two clocks
• governing law, which defaults to wherever the template's author is based
• the permitted-disclosures paragraph, still missing from plenty of free templates

An NDA template in Google Docs or Word also travels by email as an editable file. Convert the final text to PDF before signing, so both sides sign the same version.

An NDA signed electronically is as valid as one signed in ink. In the US, ESIGN says a contract or signature can't be denied legal effect just because it's electronic (15 U.S.C. § 7001); Article 25 of the EU's eIDAS Regulation says the same. Neither asks for a notary or a witness.

The signature itself is rarely disputed. The version is: which text was signed, and whether it changed afterwards. So how you get an NDA signed matters more than which button anyone clicks. Keep together:

1. 1.
   the final PDF exactly as signed
2. 2.
   the signing record (who signed, when, from which email address)
3. 3.
   a way to show the file hasn't changed since

When you send it for e-signature through Chaindoc, the server hashes the file on upload, writes the document's version hash to a blockchain when you publish it, and records each signer's proof once signing is complete. For a PDF that carries a digital signature, Chaindoc's verification service recalculates the document hash and compares it with the one sealed in the signature, which settles an "it was edited afterwards" claim quickly.

For an acquisition or a licensing deal, add an identity check on the signer. For a routine supplier NDA, an email-verified signature is plenty.

A signed NDA only helps if someone can find it when it matters. In a spreadsheet or in NDA management software, track four things per agreement:

• the counterparty and the purpose
• when the disclosure period and the confidentiality period end
• who on your side received what
• whether the return-or-destroy confirmation came back

Contract management in Chaindoc keeps each signed NDA with its signing record, and the title, description and metadata fields make it searchable. Put both end dates in the description.

Read the draft once more as the other side's lawyer would, looking for a way out:

• The definition still says "all information" somewhere, or the list doesn't match what you'll share.
• No exclusions, or exclusions that swallow the rule ("information the recipient considers public").
• One term for everything, trade secrets included.
• No permitted-disclosures paragraph and, for US employees or contractors, no DTSA notice.
• A penalty nobody can justify.
• No governing law in a cross-border deal.
• Talks started weeks ago and the effective date doesn't reach back to them.

If a breach happens, you'll need to prove the agreement, the breach and the loss; our guide on what a breach of contract claim needs walks through it. That's the real test of how to create an NDA: not whether it looks thorough, but whether each clause gives a court something specific to enforce.