How to review an NDA in 10 minutes
A practical, ordered checklist for reviewing a non-disclosure agreement: definition of confidential information, term, carve-outs, residuals, return of materials, and the traps to catch.
The short answer
Most NDAs are variations on the same handful of clauses, so a focused review is faster than people expect. Read them in this order: is it mutual, what counts as confidential, what is carved out, how long the duty lasts, what you must do with the information, and what happens on breach. Ninety percent of NDA problems live in the definition of confidential information and in the residuals clause.
Step 1 — Is it mutual or one-way?
A one-way NDA binds only the receiving party. That is appropriate if only one side is genuinely sharing information. If both sides will exchange anything, ask for mutual — it is a standard request and rarely refused.
Check the definitions carefully in a supposedly mutual NDA. Some are mutual in name only, with obligations that in practice attach to just one side's information.
Step 2 — How is "Confidential Information" defined?
This is the clause that determines everything downstream. Three common models:
- Marked-only: information must be labelled confidential. Clean and certain, but easy to lose protection by forgetting to mark something.
- Everything disclosed: broad protection, but you may find yourself bound in relation to information you did not realise you received.
- Reasonable-person standard: anything a reasonable person would understand to be confidential. A sensible middle ground and the most common.
Step 3 — Check the carve-outs
Four exclusions should always be there. If any is missing, ask for it — the omission is either sloppy drafting or deliberate over-reach.
- Information already public, or that becomes public without your fault.
- Information you already lawfully held before disclosure.
- Information received lawfully from a third party with no duty of confidence.
- Information you independently developed without using the disclosure.
Step 4 — Term and survival
Two clocks run in every NDA and people routinely confuse them. The disclosure period is how long the parties will keep exchanging information. The confidentiality period is how long the duty to protect it lasts after that.
Two to five years is typical for commercial information. Perpetual obligations are reasonable for trade secrets and source code, questionable for ordinary business information — an unlimited duty is an unlimited compliance burden.
Step 5 — The residuals clause
A residuals clause says the receiving party may freely use anything its people retain in unaided memory. It sounds harmless. It can gut the entire agreement, because almost anything a person genuinely remembers becomes fair game.
If you are the discloser, push back hard or delete it. If you are the receiver and your team works in the same technical space, it is genuinely valuable protection against accidental contamination. Either way, notice it — it is the most consequential clause people skim past.
Step 6 — Everything else worth 30 seconds
Run down this list before you sign:
- Permitted recipients: can you share with affiliates, advisers, and contractors on a need-to-know basis?
- Compelled disclosure: are you allowed to comply with a court order or regulator, with notice where lawful?
- Return or destruction: is deleting from backups realistically achievable, or does the clause demand the impossible?
- No-licence and no-obligation language: the NDA should not grant IP rights or commit either side to a deal.
- Non-solicit and non-compete riders: these do not belong in an NDA and are easy to miss.
- Injunctive relief: standard and normally acceptable.
- Governing law and forum: is a dispute realistically manageable in the named venue?
Sample clause language
Illustrative wording, written for this guide — not copied from any real contract.
"Confidential Information" means all information disclosed by Discloser to Recipient, in any form, whether or not marked as confidential, together with all information Recipient learns or infers about Discloser's business from any source.
"Or infers" and "from any source" pull in information the discloser never actually gave you, including things you learn publicly. Almost impossible to comply with confidently.
"Confidential Information" means information disclosed by or on behalf of the Disclosing Party that is either marked confidential at the time of disclosure or that a reasonable person in the circumstances would understand to be confidential, including product roadmaps, pricing, customer lists, and technical designs. It does not include information that is or becomes public through no fault of the Receiving Party, was lawfully known to the Receiving Party before disclosure, is lawfully received from a third party without restriction, or is independently developed without reference to the Confidential Information.
Clear standard, illustrative examples, and all four standard carve-outs in one place.
Red flags to look for
- One-way when both sides are sharing information.
- Missing carve-outs for public, pre-known, third-party, or independently developed information.
- A residuals clause slipped in without comment.
- Perpetual confidentiality for ordinary business information.
- A non-solicit or non-compete hidden inside an NDA.
- No exception for legally compelled disclosure.
- Destruction obligations that ignore backup and archiving reality.
- Assignment of intellectual property or ideas arising from the discussions.
What to ask for
- Make it mutual.
- Add the four standard carve-outs if any are missing.
- Set the confidentiality period at three to five years, with trade secrets protected for as long as they remain secret.
- Delete the residuals clause, or limit it to the individuals who actually had access.
- Add affiliates, advisers, and contractors as permitted recipients on a need-to-know basis.
- Add "to the extent technically feasible" to destruction obligations covering backups.
- Strike any non-solicit or non-compete language and negotiate it separately, if at all.
Find this clause in your own contract
Upload a PDF, Word file, or image and Lawly AI will pull out the clauses that matter, quote the exact wording, and explain the risk in plain English.
Frequently asked questions
How long should an NDA last?
Three to five years covers most commercial information. Trade secrets and source code are commonly protected for as long as they remain secret. Anything perpetual for routine business information deserves a question.
Is a mutual NDA always better?
If both sides will share anything at all, yes — it is simpler and symmetrical. If only one side is disclosing, a one-way NDA is honest and fine.
Can an NDA stop me from working for a competitor?
A pure NDA should not, but some contain non-compete or non-solicit riders that do. Search the document for "solicit," "compete," and "employ" before signing — those are separate commitments with very different consequences.
What happens if someone breaches an NDA?
The usual remedies are an injunction to stop further disclosure and damages for loss suffered. Proving quantifiable loss from a disclosure is often hard, which is why injunctive relief and, occasionally, liquidated damages appear in these agreements.
Related guides
This guide is general educational information about how these clauses usually work. It is not legal advice, and contract law differs by jurisdiction. For a decision that matters, speak to a qualified lawyer.