Non-disclosure agreements for small businesses

A non-disclosure agreement should protect a defined exchange of information for a defined purpose. Decide whether confidentiality is one-way or mutual and identify the correct parties. An NDA cannot replace a decision about how much information should be shared at the current stage.

Define permitted recipients, disclosure controls, exceptions and any return or deletion obligation. Distinguish confidential information from intellectual property ownership: permission to review a document is not permission to exploit the underlying work. Consider whether commercially sensitive information can initially be summarised or anonymised.

Limit the purpose as well as the recipients

State why the information is being shared: evaluating investment, pricing a project or exploring a defined collaboration. A recipient permitted to assess a proposal should not automatically have permission to use the information to develop a competing product or approach customers. The purpose restriction should be understandable to the employees and advisers who receive the material.

Identify whether both parties disclose information. A mutual agreement may be appropriate for a genuine two-way exchange, but its obligations should still fit the material involved. Avoid assuming equal information volumes mean equal risks. One party may disclose source code or a customer database while the other supplies only general commercial terms.

Define protected information and sensible exceptions

Describe the categories and how oral or visual disclosures are identified. Requiring every item to carry a particular label may create gaps if discussions or demonstrations matter. At the same time, an unlimited definition covering everything ever known can be difficult to administer. Use wording that fits the exchange and explains what the recipient must recognise as confidential.

Common exceptions concern information already public, independently developed or lawfully received elsewhere. Assess the evidence and conditions rather than treating an exception as a casual assertion. The recipient should be able to explain the basis for using material outside the confidentiality obligation. Keep the distinction between the disclosed content and the recipient's genuinely pre-existing knowledge clear.

Control onward disclosure in practice

Identify permitted employees, professional advisers and other recipients, with a need-to-know approach appropriate to the purpose. Consider obligations on those recipients and responsibility for their conduct. A broad permission to share with affiliates can expose material to businesses the discloser did not expect. Ask which organisations actually need access at the current stage.

Use staged disclosure where possible. Aggregated financial information or a limited demonstration may answer early questions without releasing the full underlying asset. An NDA supports confidentiality arrangements but does not decide whether personal data may lawfully be shared. Assess data protection separately and restrict the information to what the stage of the transaction requires.

Keep IP rights and confidentiality distinct

Permission to review confidential work should not be confused with an assignment or broad commercial licence. Identify any limited copying needed for evaluation and make clear how new work or feedback will be treated where relevant. Copyright ownership follows its own rules and agreements; the IPO guidance explains why commissioning or possessing a work does not automatically settle ownership. ^[2]

Check whether the draft includes unexpected licences, non-compete terms or restrictions beyond confidentiality. A document called NDA can contain broader obligations. Read the whole agreement before signing, including residual-knowledge wording and any right to retain or exploit ideas. Obtain advice if the proposed scope goes beyond the exchange the business intended.

Plan expiry, return and the response to a problem

Distinguish the period for making disclosures from how long obligations continue. Define return or deletion with practical treatment of backups and required records. Avoid promising a technically impossible purge without understanding the systems involved. Preserve evidence of what was shared, when and with whom so a later concern can be assessed factually.

Confirm the parties and signing authority; company execution requirements may be relevant to the document used. ^[1] If a disclosure problem occurs, preserve evidence and seek advice on proportionate action rather than assuming the NDA guarantees immediate recovery. Read Protecting confidential business information for operational confidentiality controls. Commercial contract review can help review the agreement against the intended discussion, information categories and recipients.

Check the material before it is released

Assign someone to review the actual disclosure pack against the approved purpose. Remove unrelated customer details, hidden spreadsheet tabs and comments that are not intended for the recipient. A document labelled summary can still contain its underlying data or earlier drafting history. Use an appropriate export or controlled-access process while preserving the company's original records. Record the version supplied so both parties can identify the information covered by a later question. This practical check supports the NDA by making the disclosure deliberate and traceable rather than assuming that the agreement itself prevents accidental inclusion of additional sensitive material.

Illustrative scenario

A business discusses a possible partnership and is asked for its full customer list. It first shares aggregated sales information under a limited discussion purpose. Detailed records are considered later through controlled access. The NDA supports that process, but the business still assesses data protection responsibilities and the need for each disclosure.

Preparation checklist

• Identify the discussion purpose and information categories.
• Check advisers, employees and other permitted recipients.
• Record what was disclosed and when.
• Review return, deletion, continuing use and compulsory disclosure provisions.