A founder at a growing startup constantly evaluates and negotiates new business relationships with vendors, customers, investors, and partners. Part of cultivating these relationships means sharing secrets: your roadmap with joint venture partners, your codebase with buyers at the bottom of the funnel, your IP with software development agencies.
You protect these secrets with a non-disclosure agreement (NDA). But which NDA fits which relationship, and what sets the different types apart?
The right NDA depends on factors such as how information flows between parties, how many parties are involved, what’s being protected, and how the information can be used.
Here, we’ll break down the terms and legal limits that shape how any NDA operates, and the kinds of NDAs that suit different commercial scenarios.
What is a non-disclosure agreement?
An NDA is a contract that protects confidential information shared between two or more parties. The contract defines what constitutes confidential information and the receiving party’s obligations to protect it, including what to do with the data after the contract ends.
NDAs generally protect non-public information that could harm the disclosing party if shared, such as:
- Trade secrets
- Customer data
- Financial information
- Business plans
- Pricing
- Technical know-how and processes
If the receiver breaks the agreement by sharing confidential information, the discloser can seek monetary damages and injunctive relief.
Signing an NDA is a standard approach to protecting confidentiality in a commercial setting. To remain enforceable, companies must keep the document focused on confidentiality and avoid shoehorning in other restrictions on business activities, such as non-compete and non-solicitation provisions. These terms are more heavily regulated than confidentiality clauses, and some states will not enforce an NDA containing them.
NDA vs. CDA vs. confidentiality agreement
NDAs are common in commercial settings, but academic, research, and pharmaceutical fields often use confidentiality disclosure agreements (CDAs). CDAs are similar to NDAs but contain specific provisions for research protocols and regulatory requirements. Both fall under the umbrella of “confidentiality agreements.”
Regardless of the document type, the most important language to look for is what information is protected and who must protect it.
Types of NDA agreements
There are three main types of non-disclosure agreements: a unilateral NDA, a mutual NDA, and a multilateral NDA.
Unilateral NDA
A unilateral NDA protects confidential information moving in one direction, from the disclosing party to the receiving party. The receiver has a contractual obligation to prevent the specified information from being shared or subject to unauthorized use. Also called a one-way NDA, a unilateral NDA best suits situations with a clear discloser and receiver, such as:
- A vendor sharing confidential product roadmaps and proprietary algorithms with potential clients.
- A company disclosing IP, financials, and hiring plans to potential investors during funding conversations.
- An operations team granting a third-party contractor access to internal systems and company data.
The protection applies to data flowing from the discloser to the receiver, but it doesn’t protect any information the receiver shares during the contract.
Mutual NDA
A mutual NDA protects trade secrets and other confidential information shared between parties. Unlike a unilateral NDA, a mutual NDA makes both parties responsible for keeping the other’s secrets. Mutual NDAs, also known as bilateral or two-way NDAs, are common during:
- Joint business ventures, when two companies pool their operational, financial, and human resources to achieve a strategic goal.
- Partnership discussions between two businesses sharing IP, strategic plans, and product roadmaps to create an out-of-the-box integration between their products.
- M&A conversations when both companies share financials, brand strategies, and business contracts as part of due diligence.
Multilateral NDA
A multilateral NDA protects information flowing between multiple parties and outlines confidentiality rules for each. Multilateral NDAs are typical in complex, multi-company deals such as consortiums and multi-party joint ventures, where it’s often more practical to use a single agreement instead of a web of bilateral agreements.
When each type of NDA makes sense
- Unilateral NDAs: One-way NDAs make the most sense in business relationships where one party shares and the other receives, and their roles never overlap—for example, during vendor onboarding and investor conversations.
- Mutual NDAs: Two-way NDAs are best suited to more integrated business partnerships in which both parties disclose and receive confidential information. This might apply to conversations about mergers and acquisitions.
- Multilateral NDAs: A multi-party agreement is a strong strategic choice in partnerships with more than two parties, such as in complex multi-company deals.
Common non-disclosure agreement terms
An NDA's strength lies in the clarity and enforceability of its terms. While each contract is different, common terms in confidentiality agreements include:
- Definition of parties: The names of the parties involved and their roles in the contract. Unilateral contracts, for example, may define parties as “disclosing” and “receiving” to designate the flow of information and the confidentiality obligations.
- Definition of confidential information: The names or types of information being shared and protected under the agreement. IP, finances, customer and employee data are commonly considered confidential, but they must be included in this definition to be protected.
- Permitted use: What the receiver is and isn’t allowed to do with the information. Permitted-use terms should be as specific as possible; vague language can lead to misuse.
- Exclusions: The information not considered confidential because it’s publicly available, independently developed, previously known, or was disclosed by a third party.
- Agreement duration: How long the contract remains in effect. The duration of the agreement can differ from the confidentiality terms, which can continue after a contract ends.
- Return or destruction duties: What parties have to do with information at the end of the engagement. While a contract can’t mandate forgetting learned knowledge, it can stipulate whether the materials should be returned or destroyed.
Some of the most commonly negotiated terms include:
- Remedies for breach: Sanctions if confidential information is not protected. Remedies range from damages and injunctive relief to specific performance.
- Residuals clauses: Carve-outs that allow counterparties to use information they retrieved from their memory without assistance. Residuals clauses can narrow protections and create loopholes if they are not negotiated
- Compelled-disclosure notice language: Provisions that protect a party from the consequences of sharing confidential information when legally required to do so, for example, by court order.
- Affiliate-sharing provisions: Clauses that allow counterparties to share confidential information with members of their team or third parties they work with to complete the job.
NDA laws and limitations
NDAs are common across industries and are generally considered valid. But an NDA’s enforceability depends on the state laws that govern it. Courts may narrow or strike down overbroad definitions of confidential information. And they may not enforce non-compete or non-solicitation language in an NDA. California, North Dakota, Oklahoma, and Minnesota ban or heavily restrict non-competes, so adding them to an NDA can invalidate the entire agreement or prompt stricter review.
State-specific regulations aside, NDAs are generally valid in the U.S. if they:
- Clearly define confidential information.
- Maintain a lawful scope (i.e., don’t restrict legal activity or include other restrictive covenants).
- Have valid consideration, whether in the form of monetary compensation or an equal exchange for maintaining confidentiality.
Commercial NDAs have a few notable limits. For example, they must make room for:
- Whistleblower and reporting protections: An NDA can’t be used to stop people from reporting illegal activity, such as fraud or securities violations, to law enforcement or government agencies. Terms that attempt to prevent reporting are often unenforceable.
- Attorney-client privilege: NDAs can’t bar clients from sharing confidential information with their lawyer.
NDAs are enforceable in standard commercial contexts, but public policy limits, jurisdictional variation, and specific drafting all shape the extent of their protection.
Crosby handles the commercial contract review layer
NDAs are part of many commercial transactions, from vendor onboarding to partnership discussions, M&A due diligence, and contractor engagements. While NDAs generally protect confidential information, drafting errors can allow IP, trade secrets, or sensitive business information to leak. Crosby redlines commercial NDAs, applying consistent standards across unilateral and mutual forms.
Crosby’s custom-built agents use market data and your preferences to take the first pass on contract redlines, and barred attorneys oversee the work. Median turnaround time is less than four hours, and Crosby uses transparent, flat-fee billing.