How to Write an NDA: A Step-by-Step Guide with Free Template

An NDA is the handshake before the handshake. Before you show a potential partner your product roadmap, share source code with a contractor, or pitch an investor, you need one. But most templates floating around the internet have serious gaps — or are so broad they wouldn't survive a challenge.

Here's what actually goes into a solid NDA.

The two types of NDA: know which one you need

Unilateral (one-way) NDA: Only one party shares confidential information. The other party receives it and agrees to keep it secret. Use this when you're hiring a contractor, onboarding a vendor, or sharing your product with a potential acquirer.

Mutual NDA: Both parties share confidential information. Both are bound. Use this when you're exploring a partnership, joint venture, or two-way business relationship where secrets flow in both directions.

Most "standard NDAs" you find online default to mutual — even when a unilateral makes more sense. It matters because a mutual NDA means you also have obligations about how you handle the other party's information.

The 7 clauses every NDA must have

1. Definition of Confidential Information

This is the most important clause and the one most poorly drafted. Vague language like "any information shared between the parties" is nearly unenforceable. Good NDAs define confidential information specifically:

"All information disclosed by the Disclosing Party that is marked 'Confidential' or that a reasonable person would understand to be confidential given the nature of the information and the circumstances of disclosure, including but not limited to: trade secrets, source code, financial projections, customer lists, product roadmaps, and pricing data."

2. Exclusions

Courts won't enforce NDAs that try to protect information that's already public. Every NDA must carve out:

• Information already known to the receiving party
• Information that becomes public through no fault of the receiving party
• Information independently developed by the receiving party
• Information required to be disclosed by law or court order

3. Permitted Uses

State explicitly what the receiving party can do with the information. Usually: "solely for the purpose of evaluating a potential business relationship between the parties."

4. Duration

Two components: (1) how long the NDA lasts, and (2) how long confidentiality obligations survive termination. A 2-year NDA with a 5-year confidentiality tail is common. For trade secrets, some NDAs specify "until the information enters the public domain" — which can be perpetual.

5. Return or Destruction

On termination, what happens to confidential materials? The standard clause requires return or certified destruction of all documents and copies, often within 10 business days.

6. Remedies

Specify that breach entitles the injured party to injunctive relief (a court order to stop the breach) without posting a bond. Without this clause, you'd have to prove monetary damages — which is nearly impossible for a confidentiality breach.

7. Governing Law and Jurisdiction

Specify which state's law governs and where disputes will be resolved. This matters because non-compete clauses attached to NDAs are unenforceable in California, and courts in different states apply different standards to what counts as a protectable trade secret.

The clause most people miss: Non-Solicitation

Many NDAs — especially those shared between companies that might end up working together — should include a non-solicitation clause preventing either party from poaching the other's employees or clients. This is separate from a non-compete and is enforceable in most US states.

What makes an NDA unenforceable

• Overly broad scope — "All information ever shared" instead of specifically defined categories
• Unreasonable duration — Courts won't enforce perpetual NDAs on non-trade-secret information
• No consideration — If a contractor signs after starting work (not at the time of hire), the NDA may lack consideration and be voidable
• Missing signatures — An unsigned NDA is worth nothing

When you don't need an NDA

NDAs have limits. They don't stop determined bad actors — they create liability if someone leaks. For truly sensitive information (core algorithms, unpatented inventions), file for patent or trade secret protection. For employees, use an employment agreement with IP assignment clauses, not just an NDA.

Many experienced VCs and angels refuse to sign NDAs at early stages. Don't let a refusal to sign be a dealbreaker — use it as a signal about the relationship, not a legal barrier.

Generate a free NDA template →