NDAs That Actually Hold Up

A non-disclosure agreement is one of the first contracts most startups and creators ever sign. It is also one of the easiest to get wrong. Many NDAs are downloaded, lightly edited, and treated as magic words: surely no one will misuse my information now that there is a signature on file. In reality, a court will read the actual terms, and a poorly drafted NDA can be unenforceable exactly when you need it most.

This guide explains, in plain English, what separates an NDA that holds up from one that does not. It covers mutual versus one-way structures, the elements that make an agreement enforceable, the common mistakes that sink them, how NDAs fit into trade secret protection, and the situations where an NDA is simply the wrong tool. It is general education, not legal advice. For the bigger picture of protecting a young company’s intangible assets, start with our Startup IP pillar guide.

Mutual vs. one-way NDAs

Before drafting, decide who is actually disclosing secrets, because that determines the shape of the agreement.

A one-way (unilateral) NDA protects only the disclosing party. One side shares confidential information and the other side takes on the obligation to protect it. This fits situations where the flow of secrets runs in one direction: an employer giving a new hire access to internal systems, a company bringing on a contractor, or a founder showing technical details to a potential vendor. The receiving party has duties; the disclosing party does not.

A mutual (bilateral) NDA protects both parties because both expect to share sensitive information. This is the right structure for partnership talks, joint ventures, co-development projects, and merger or acquisition discussions, where each side will see the other’s financials, roadmaps, or technology. Mutual NDAs also tend to feel more even-handed, which can matter when two businesses are trying to start a relationship on good footing.

Picking the wrong structure is rarely fatal, but it signals carelessness. If only you are disclosing, a one-way NDA is cleaner and easier to enforce. If both sides are opening the books, a mutual NDA avoids the awkward problem of one party being unprotected.

The elements that make an NDA enforceable

An NDA is a contract, so it has to satisfy ordinary contract requirements: a genuine agreement, consideration (something of value exchanged), and lawful terms. Beyond those basics, the agreements that survive a challenge tend to share the following features.

• A clear, specific definition of confidential information. This is where most NDAs either succeed or fall apart. The agreement should identify the categories of protected information with reasonable specificity, things like source code, customer lists, pricing models, formulas, financial projections, or unreleased product designs, rather than reciting that “all information” is confidential. The narrower and more concrete the definition, the more a court will trust it.
• A legitimate business interest. Courts enforce confidentiality to protect genuine secrets and competitively sensitive material. An NDA that exists to suppress ordinary information, or to discourage someone from ever working in the field, lacks the legitimate interest that justifies a restriction.
• Reasonable scope. The obligations should be no broader than necessary to protect the information at stake. Sweeping restrictions that reach far beyond the actual secrets invite a court to narrow or void them.
• Standard carve-outs. A well-drafted NDA excludes information that is already public, that the receiving party knew beforehand, that they later receive lawfully from another source, or that they develop independently. These exclusions keep the agreement focused on real secrets and signal that it is not an attempt to lock down general knowledge.
• A sensible duration. The protection should last as long as the information stays sensitive, and no longer. For genuine trade secrets, that can be as long as secrecy holds. For ordinary business information, open-ended obligations draw scrutiny; many agreements set a defined post-relationship window. The right number depends on the information.
• Workable mechanics. Practical terms, who may receive the information internally, how it must be handled, what happens on return or destruction, and how disputes are resolved, make the agreement easier to apply and to enforce.

None of this requires legalese or length. A short, focused NDA that protects identifiable information usually beats a long one that tries to protect everything.

What to avoid

The same features that make an NDA weak show up again and again.

Overbroad definitions. Catch-all language that defines confidential information as essentially everything the person sees, hears, or learns is the most common failure point. California courts in particular look skeptically at definitions that sweep in publicly available facts or a person’s general experience. The broader the definition, the more a court suspects the real goal is restraint rather than secrecy, and the more likely it is to limit enforcement.

Perpetual terms on ordinary information. Promising to keep genuine trade secrets confidential for as long as they remain secret is reasonable. Demanding that someone guard routine business information forever is not, and an unreasonable duration can undermine the clause.

Clauses that act as de facto non-competes. This is the big one, and it is where overbreadth becomes dangerous. If an NDA is written so broadly that a former employee or contractor cannot use the general skills and experience they brought with them, or cannot work in their field at all, courts can treat it as a disguised non-compete. In California, Business and Professions Code section 16600 voids agreements that restrain someone from engaging in a lawful profession, trade, or business, and courts read it broadly. An NDA that effectively bars a person from working will be trimmed or struck on that basis, no matter what the clause is labeled. We cover that line in detail in our guide on the NDA vs. non-compete in California.

Treating the NDA as the only protection. A signature is not a vault. If the underlying information is freely shared internally, posted publicly, or never marked as confidential, the agreement protects far less than the owner assumes.

NDAs as trade secret protection

NDAs do more than create a private promise; they are part of how you keep a trade secret protectable in the first place. Under trade secret law, including the California Uniform Trade Secrets Act and the federal Defend Trade Secrets Act, information only qualifies as a trade secret if the owner takes reasonable measures to keep it secret. Confidentiality agreements are a standard, expected measure.

That has a practical consequence. If you disclose sensitive information without an NDA and it later leaks, an opponent can argue you did not treat it as a secret, weakening or destroying its trade secret status. A signed NDA is evidence that you took the information seriously and limited who could access it.

But the agreement works best as one layer among several. Access controls, need-to-know permissions, labeling material as confidential, and limiting how widely secrets circulate all reinforce both the NDA and the underlying trade secret. For the full picture of building those layers, see how to protect a trade secret in California, and explore the broader trade secrets topic hub.

When an NDA isn’t the right tool

An NDA is not the answer to every confidentiality worry, and reaching for one reflexively can backfire.

The clearest example is pitching investors. Most professional investors decline to sign NDAs at the pitch stage, and not because they plan to steal the idea. They review enormous numbers of pitches, many addressing similar problems, and signing an NDA for each would create legal conflicts and slow their work to a crawl. Demanding one can also signal mistrust at the very start of a relationship you hope will become a funding partnership. The usual approach is to share the vision and the market opportunity freely while holding back the deepest technical details until a deal is genuinely progressing. (If an investor will sign at a later, more serious stage, a one-way NDA protecting the founder is the natural structure.)

NDAs also do little against problems they were never designed for. They do not, by themselves, establish who owns inventions, code, or creative work; that calls for clear IP assignment terms. They are a poor substitute for publishing or patenting when the goal is public credit or a registered right. And they cannot resurrect a secret that has already been disclosed publicly. Matching the tool to the goal matters: an NDA protects information you intend to keep confidential and share selectively, nothing more.

A quick NDA checklist

Use this as a plain-English gut check, not a substitute for legal drafting:

• Right structure? One-way if only you disclose, mutual if both sides share.
• Defined information? Specific categories of confidential information, not “everything.”
• Legitimate interest? Protecting real secrets, not restraining competition or careers.
• Reasonable scope? No broader than the secrets at stake.
• Carve-outs included? Public, previously known, lawfully received, and independently developed information excluded.
• Sensible term? As long as the information stays sensitive, not perpetual on routine data.
• Not a hidden non-compete? Nothing that effectively bars someone from working in their field.
• Backed by practice? Access limits, labeling, and need-to-know handling behind the agreement.
• Right tool? An NDA fits the situation, rather than an ownership, patent, or investor-pitch question in disguise.

The bottom line

The NDAs that hold up are the focused ones. They protect identifiable confidential information through a clear definition, a reasonable scope tied to a legitimate interest, standard carve-outs, and a duration that matches how long the information actually stays sensitive. The ones that fail are the overbroad templates, the perpetual obligations on ordinary information, and the clauses that quietly function as non-competes, which courts, especially in California, will narrow or strike. Treat the NDA as one of several reasonable measures protecting your trade secrets, match it to who is really disclosing, and recognize the situations, like investor pitches, where it is not the right tool at all.

This article is general legal education, not legal advice, and reading it does not create an attorney-client relationship. Confidentiality and trade secret rules are detailed, fact-specific, and vary by jurisdiction. Before drafting, signing, or trying to enforce any NDA, consult an attorney licensed in your jurisdiction.