NDA Generator — a confidentiality agreement, filled in.

What comes out the other end

The document has four parts, and the order matters if anyone ever has to read it in court. A short recital names the parties, the effective date and the purpose; then ten numbered clauses do the actual work; then any optional clauses you switched on; then two signature blocks with name, title and date lines. Nothing on the page is decorative — each clause exists because a specific thing goes wrong without it.

1. The purpose clause is the one that limits everything else. Confidentiality is defined relative to a purpose, so "evaluating a potential business relationship" protects what you say during that evaluation. Leave the purpose out and the agreement covers every secret the disclosing party has ever held, which is the version courts narrow or throw out.
2. The definition of confidential information does two jobs. It catches information marked confidential, and it also catches information a reasonable person would understand to be confidential given the circumstances. The second half is what covers things said out loud in a meeting that nobody marked.
3. The obligations clause sets the standard of care. The document uses the same care the receiving party applies to its own information of similar importance, with a reasonable-care floor, and caps it at people who need to know. Without the need-to-know limit, the receiving party can forward the information internally and argue it was authorised.
4. The exclusions are what keep it enforceable. Information already known, information that becomes public through no fault of the receiver, information lawfully obtained from a third party, and information independently developed are all carved out. An NDA without these four will not survive contact with a defendant who already knew the information.
5. Compelled disclosure gives a subpoena a process. Notice to the disclosing party first where legally permitted, cooperation on a protective order, and disclosure limited to what the law actually requires.
6. Return and destruction has an end date. On request or on expiry, the receiving party returns or destroys everything, keeps one archival copy for legal compliance, and keeps whatever is sitting in routine backups that nobody can selectively delete.

Mutual or one-way

Mutual covers the case where both sides will be talking, which is most early conversations: a partnership discussion, an acquisition exploration, a joint technical evaluation. Each party is both discloser and receiver, and every clause is written in terms of "each party" and "the other party" so neither side holds the better position.

One-way covers the case where only one side has anything to protect. A contractor being briefed on a build. An employee on their first day. A vendor being shown a roadmap before they are allowed to quote. The document swaps in named roles — Disclosing Party and Receiving Party — and it is worth checking which of the two you are being asked to be before you sign.

The asymmetry is the part to read twice. A one-way NDA handed to you as the receiving party is usually fine and unremarkable. What to look for is the definition clause: if it lets the other side declare confidential anything they tell you, at any time, without marking it, then you have accepted a duty over information you cannot identify, and the survival period means that duty outlasts the conversation by years.

A worked example

A two-person design studio and a nine-person hardware startup want to talk about the studio redesigning the startup's enclosure. Both will be sharing — the studio will see unreleased CAD, the startup will see the studio's process and pricing. That is a mutual agreement.

Fill in the fields: Mutual, Party 1 "Kestrel Design Co.", Party 2 "Volta Hardware Inc.", purpose "evaluating a potential product design engagement", effective date today, term three (3) years, duty lasts three (3) years, governing law Delaware where the startup is incorporated. Switch on two optional clauses — Non-solicitation and Injunctive relief — which is the free plan's allowance of 2 of 6.

The result is a fourteen-clause document of roughly 1,100 words, which comes out at two printed pages. Clause 6 reads: the agreement begins today and continues for three years unless either side gives thirty days' notice, and the confidentiality duty continues for three years after each disclosure, with trade secrets protected for as long as they remain secret. Clause 14 is the general clause, and below it sit two signature blocks. Save the PDF and send it; the other side signs, and the exchange can start.

Note what the survival number is counting from. It runs from the date of each disclosure, not from the effective date, so information shared in the last month of a three-year agreement is still protected for three years after that — six years after signing. That is intentional, and it matches what people mean when they say "for three years after we stop talking".

Where these go wrong

• Signing in the wrong name. The most common and the most expensive. An agreement signed by you personally does not bind your company, and an agreement signed by a company that does not exist yet binds nobody. Use the exact registered name, including LLC or Inc., and sign with a title.
• No purpose, or a purpose of "any and all information". Over-broad NDAs get narrowed by courts or ignored in practice. One sentence naming the actual project is worth more than a page of boilerplate.
• Perpetual confidentiality for ordinary information. A duty that never ends over information that goes stale in eighteen months is the clause a judge trims. Trade secrets are the exception and get their own treatment.
• Confidentiality that swallows the whistleblower. An NDA cannot be used to stop someone reporting a crime or a regulatory violation, and in several states a clause that appears to is void on its face.
• Treating it as an IP assignment. The document says no licence is granted and no rights transfer, which is the correct default. If you are paying a contractor to build something you want to own, that needs an assignment, and this document deliberately does not provide one.
• Choosing a governing law at random. Enforcement happens in the chosen jurisdiction. A Delaware clause for two companies in Oregon means a dispute costs a plane ticket.
• Leaving the date blank. The survival period counts from disclosure, but the term counts from the effective date, and an undated agreement makes both unprovable.

Questions