What Is an NDA? A Plain-Language Guide for Non-Lawyers

What is an NDA? A non-disclosure agreement is a legally binding contract in which one or more parties commit not to share specific information with third parties, for a defined period, under defined conditions. It creates a confidential relationship, but only within the boundaries the document explicitly describes. An NDA covers only what its text says it covers. Nothing more, and, because of mandatory exclusions, sometimes less than you might expect.

What an NDA actually obliges you to do

An NDA does not ask you to forget what you know. It asks you not to disclose particular categories of information to people outside the agreement. The scope of that obligation depends entirely on how the "Confidential Information" clause is written, and that clause varies considerably from one document to the next.

In practice, this means reading that clause carefully before anything else. Some NDAs define confidential information narrowly: "all financial projections shared during the evaluation period." Others define it broadly: "all information marked confidential, plus all information that a reasonable person would consider confidential given the context." The second version, standard in many template NDAs, can cover things you would not initially expect to fall under the agreement.

You are also typically obliged to use the information only for a stated purpose. In a business context, that purpose is usually described as "evaluating a potential business relationship" or "completing the contracted work." Using confidential information for any other purpose, even if you do not share it externally, can constitute a breach.

A third obligation worth noting: taking reasonable precautions against inadvertent disclosure. What counts as "reasonable" depends on the context and the governing law. At minimum, it means not forwarding protected documents to colleagues or advisers who are outside the agreed scope, and not discussing protected information in contexts where it could be overheard or observed.

The three types of NDA: unilateral, bilateral, and multilateral

Knowing which type of NDA you are dealing with tells you immediately where your obligations end and where the other party's begin. The structure changes what you are agreeing to.

A unilateral NDA binds only one party: the recipient. One side discloses information; the other receives it and accepts confidentiality obligations. This is the most common form in employment agreements, freelance contracts, and situations where a company shares its pitch deck, technical specifications, or pricing model with a potential partner. If you are the one receiving, you bear the full weight of the agreement.

A bilateral NDA, sometimes called a mutual NDA, binds both parties symmetrically. Both share sensitive information, and both accept the same confidentiality obligations in return. These are standard in joint ventures, partnership negotiations, and due diligence processes where each side has something to protect. If you receive a unilateral NDA in a situation where you will also be disclosing sensitive information, asking for a mutual agreement is a reasonable position.

A multilateral NDA covers three or more parties and is used when several entities need to share protected information simultaneously. Consortium agreements, multi-party research projects, and complex transactions involving multiple buyers are typical examples. These are worth reviewing more carefully because the interaction between obligations across parties can produce situations that a bilateral NDA would not create, and remedies may be asymmetric.

What information an NDA covers and what it does not

Every properly drafted NDA contains exclusions, and those exclusions are not optional additions. Certain categories of information cannot be protected by contract, regardless of how the confidentiality clause is worded. The standard exclusions found in EU and Swiss practice are:

• Information that was already in the public domain at the time it was disclosed to you

• Information you already had in your possession before receiving it under the NDA

• Information disclosed to you by a third party who was not themselves bound by a confidentiality obligation relating to that information

• Information you developed independently, without reference to what was shared with you

Courts across the EU, UK, and Switzerland consistently uphold these exclusions. An NDA that attempts to bind you to keeping secret something already in the public domain will be unenforceable on that point, regardless of the contractual language. If you encounter a template that omits these exclusions, that is a point to raise before signing.

One additional limit worth understanding: an NDA cannot prevent you from complying with a legal obligation to disclose information. If a regulator, a court, or a statutory authority requires you to produce documents, the NDA does not override that requirement. Most carefully drafted NDAs include a carve-out for legally compelled disclosures, sometimes requiring that you notify the disclosing party before producing the information if the law permits it.

Duration and territory: two clauses most people skip

Many people focus on the confidentiality obligations themselves and move past the duration and geographic scope provisions without reading them carefully. Both have significant practical consequences that are worth understanding before you sign.

On duration: most commercial NDAs run for two to five years from the date of signature or from the date the protected information was disclosed. Some NDAs, particularly in employment or IP-sensitive contexts, claim to be perpetual. Courts in several EU jurisdictions are skeptical of perpetual confidentiality obligations in a standard commercial context. They tend to interpret such clauses restrictively or, in some cases, to read an implied reasonable duration into the agreement. In Switzerland, the Code of Obligations does not place an explicit statutory cap on confidentiality duration, but proportionality is expected, and an NDA for a routine commercial negotiation that claims 20 years of protection is a point worth raising before you sign.

On territory: many template NDAs specify worldwide scope. That provision is relevant primarily in the event of a dispute: it affects which courts can be competent and which law governs the proceedings. An NDA governed by California law with a worldwide confidentiality scope does not prevent Swiss or German courts from hearing a case, but it signals that the parties agreed to a particular legal framework, which a local court may or may not recognize depending on the applicable conflict-of-law rules. If your operations are based in the EU or Switzerland, a governing law and jurisdiction clause pointing exclusively to a US state is worth examining, not because it is necessarily unenforceable, but because enforcement would be more complicated.

What happens if you breach an NDA

The remedies available for breach depend on the terms of the NDA and the governing law. The three most relevant remedies in EU and Swiss civil practice are different in nature and speed.

Injunctive relief: the disclosing party can apply to a court to immediately stop the breach. This can mean preventing further disclosure of protected information, ordering the return or destruction of documents, or requiring the deletion of copied files. Courts in EU jurisdictions typically grant injunctive relief relatively quickly in cases where the breach is clear and ongoing, because the alternative, waiting for a full trial, would allow the harm to compound.

Damages: the party that suffered the breach can claim compensation for the harm caused. Quantifying damages for a confidentiality breach is genuinely difficult: pricing a trade secret that has been shared is not straightforward. Some NDAs address this by including a liquidated damages clause, specifying a pre-agreed sum that the breaching party must pay. Liquidated damages clauses are generally enforceable in EU member states and Switzerland, as long as they are proportionate to the actual or estimated harm. Courts can reduce a liquidated damages amount they consider excessive.

Termination of the underlying relationship: where the NDA exists alongside a service agreement, employment contract, or partnership arrangement, a breach can trigger termination of that relationship. For many businesses, this consequence carries more immediate weight than any financial penalty, particularly in ongoing relationships involving repeated access to protected information.

One clarification that often surprises people: NDA breaches are civil matters in most EU and Swiss jurisdictions, not criminal ones. There are exceptions, particularly when the breached information qualifies as a trade secret under EU Directive 2016/943, which creates a specific legal framework with its own enforcement mechanisms. But a standard commercial NDA breach does not, by itself, expose you to criminal prosecution.

NDAs under EU and Swiss law: what differs from US-style templates

Most NDA templates circulating online originate from US legal practice, drafted under common law assumptions. If you operate in the EU or Switzerland, several differences are worth understanding before accepting a US-origin template.

The EU Trade Secrets Directive (2016/943), transposed into national law across EU member states since 2018, defines what qualifies as a legally protected trade secret and sets minimum standards for protection and enforcement. An NDA drafted for EU use will typically reference or align with this framework. A US-origin template may not, which can create gaps in the protection available under applicable local law, particularly for information that would qualify as a trade secret under the Directive.

In Switzerland, there is no direct equivalent to the Trade Secrets Directive, but the Code of Obligations provides the contractual basis for confidentiality, and the Unfair Competition Act (UCA) offers additional protections for trade secrets in certain contexts. Swiss courts generally interpret confidentiality obligations strictly. Ambiguous definitions of confidential information tend to be read narrowly in favor of the party that did not draft the agreement, which is an additional reason to ensure that the definition covers what you actually need it to cover.

Under the GDPR, an NDA cannot be used to justify refusing a data subject's request for access to their personal data. If the information described as confidential in an NDA includes personal data, there is a potential tension between the NDA and GDPR obligations that is worth addressing before signing. This is relevant in any NDA involving customer records, employee data, or health information.

If you are presented with a template drafted for a foreign jurisdiction, asking for the governing law to be adjusted to your own is a reasonable request. In most commercial negotiations, particularly at early stages, it is accepted without difficulty.

Five things to review before signing any NDA

Before putting your name on an NDA, these five points are worth confirming. For high-stakes transactions, checking them with a legal adviser before signing is worth the time.

1. The definition of Confidential Information. Is it specific to what you are actually going to share, or is it a catch-all that could cover things you would not expect? If the definition is unusually broad, it is reasonable to ask for it to be narrowed in the text before signing.

2. The permitted purpose. Confirm that the stated purpose matches what you are actually doing together. If the purpose is described as "evaluating a partnership" but your engagement is something different, the NDA may not fit the situation accurately.

3. Duration. Is it proportionate to the context? A two-year NDA for a standard commercial negotiation is normal. A ten-year or perpetual NDA for the same situation is worth questioning, and courts in several jurisdictions may not enforce it in full.

4. Governing law and jurisdiction. Which country's law governs the agreement, and which courts have jurisdiction? If you are based in the EU or Switzerland, US governing law adds complexity in any dispute, particularly if you would need to enforce the agreement or defend yourself against a claim.

5. Standard exclusions and carve-outs. Confirm that the exclusions for public-domain information, information you already had, and legally compelled disclosures are present. Their absence in a template is a point to raise before signing.

An NDA is a standard instrument in commercial and professional life. Reading one carefully before signing takes less time than most people assume, and it reduces the chance of accepting obligations you did not intend to take on. If you want an analysis of what a specific NDA commits you to before you sign it, the tools below read legal documents clause by clause and flag the provisions that deserve attention.