An NDA review in four minutes: a walkthrough with the issues we expect to see

A mutual NDA arrives at 08:50. Six pages, from a prospective supplier, “standard form, just need it signed before the call”. The call is at 09:00. Review has already read it and the add-in shows nine flags: two High, four Medium, three Note.

Four minutes is enough, if you spend them in the right order. Here is the order.

Minute one: who, what, and what counts

Start with the parties. Does the definition include affiliates on both sides, or only on theirs? A mutual NDA where one party’s affiliates may receive information and the other’s may not is mutual in name only. Review flags asymmetric affiliate coverage at Medium.

Then the purpose clause. It should describe the evaluation of a specific relationship, not “any business dealings between the parties”. A wide purpose means the information can be used for anything the counterparty later calls a business dealing. Narrow it.

Then the definition of Confidential Information. There are two families. Marked-only definitions protect information that is labelled confidential, with oral disclosures protected only if confirmed in writing within some period, often thirty days. All-information definitions protect everything disclosed in connection with the purpose. The first is easier to administer and almost nobody administers it; in practice, the thirty-day written confirmation never happens and the oral disclosure is unprotected. Review flags the written-confirmation requirement at Medium when the firm’s playbook prefers the all-information form.

Check the standard exclusions are all present: public domain through no fault of the recipient, already known to the recipient, independently developed, received from a third party without restriction. A missing exclusion is a High flag. A subtly narrowed one, such as “independently developed without reference to the Confidential Information” tightened to “independently developed by personnel who had no access”, is usually a Note, and usually acceptable.

Minute two: how long, and what survives

Separate the term of the agreement from the duration of the obligation. A two-year agreement with a confidentiality obligation that ends when the agreement ends protects nothing disclosed in month twenty-three for very long. The usual pattern is a short agreement term and a longer obligation, three to five years from disclosure, with trade secrets protected for as long as they remain trade secrets.

Then the survival clause. Review flags, at High, any NDA where the confidentiality obligation is not expressly stated to survive termination or expiry. It is the most common serious issue we see in supplier-form NDAs, and it is almost always an oversight rather than a tactic.

Return or destruction on request should carry a carve-out for routine backup copies and for retention required by law or regulation, with the obligation continuing to apply to anything retained. A clause with no carve-out is a Medium; your IT department cannot comply with it.

Minute three: what got smuggled in

This is the minute that matters. An NDA is a small document and people put things in it hoping nobody will look.

A residuals clause, allowing the recipient to use whatever its people retain in unaided memory, is a licence by another name. In a mutual NDA with a larger counterparty it operates one way in practice. Review flags residuals at High.

A non-solicitation or non-compete has no place in a confidentiality agreement and Review flags either at High. An exclusivity undertaking is the same.

An assignment of intellectual property in feedback or improvements is a Medium if limited to feedback on the counterparty’s own products, and a High if it reaches further.

Check for the clause that should be there: no obligation to proceed with any transaction. Its absence is a Medium.

Check governing law against jurisdiction. Review 4.1 and later flag a mismatch automatically. In a supplier form, the governing law is frequently the supplier’s home law and the jurisdiction clause something else, copied from a different template.

Injunctive relief without proof of damages is standard and acceptable if mutual. An indemnity is unusual in an NDA and is a Medium at least; read what it covers.

Minute four: the flags, and the decision

By now you have read the nine flags in context. The two High flags on this document are the residuals clause and the missing survival language. Both are redlined inline; both redlines come from the firm’s playbook and cite it. The four Mediums are the written-confirmation requirement, the one-sided affiliates definition, the absent no-obligation clause, and the return-or-destroy clause with no backup carve-out. The three Notes are defined-term inconsistencies and a notices clause with a fax number.

Accept the High redlines. Accept two of the Mediums and leave the others for the call, since the supplier may concede them verbally. Dismiss the Notes; the fax number is not your problem.

Send the marked-up draft at 08:57.

Checklist

• Parties and affiliates: symmetric?
• Purpose: specific?
• Definition: marked-only or all-information, and does the firm’s playbook agree?
• Exclusions: all four present and not narrowed?
• Term versus obligation: separate, and long enough?
• Survival: express?
• Return or destroy: backup and legal-retention carve-outs?
• Residuals, non-solicit, non-compete, exclusivity, IP assignment: absent?
• No obligation to proceed: present?
• Governing law and jurisdiction: matched?
• Injunctive relief: mutual?
• Indemnity: absent, or understood?

Four minutes is enough for an NDA when you know what you are looking for. It is not enough for an NDA that is secretly something else, which is why minute three comes before minute four.