The definition of confidential information is the most consequential drafting decision in any NDA. It determines what the agreement actually protects. Most DIY NDAs get this wrong in one of two directions: they define confidential information so broadly that courts refuse to enforce it, or so narrowly that important information falls outside the definition.

The too-broad version is the more common failure. A definition like “all information shared between the parties” or “everything disclosed in connection with this relationship” sounds comprehensive. Courts disagree. A marketing agency whose NDA defined confidential information as “all information shared between the parties” found the court refused to enforce it when seeking to protect against a former client, ruling the definition too sweeping. Sweeping definitions that attempt to protect everything effectively protect nothing, because they are unreasonable on their face.

The too-narrow version is subtler but equally damaging. An NDA that requires all confidential information to be marked in writing as “CONFIDENTIAL” at the time of disclosure leaves oral disclosures and unmarked materials unprotected. In a business relationship where sensitive information flows continuously through conversations and presentations, this gap is significant.

An NDA binds the legal entities that signed it, not the people or brands associated with them. This distinction matters more than most DIY drafters realize. Companies operate under trading names, DBA names, abbreviated names, and informal names that differ from their full legal entity name. Signing an NDA in any name other than the complete, correct legal entity name can result in the agreement being unenforceable against the party it was supposed to bind.

In one documented case, an executive signed an NDA in his personal name rather than in the company’s legal entity name, then shared the company’s core trade secrets with a direct competitor. When challenged, the competitor correctly responded that it had no NDA with the company, only with the individual. The case was lost on summary judgment. The confidential information was already in the competitor’s hands and the NDA provided no recourse.

Omitting suffixes such as “Limited,” “Inc.,” “LLC,” or “Corp.” from a party’s name, or using a parent company name when a subsidiary owns the information, can each render the agreement void. The same problem arises when a company uses its DBA name rather than its registered legal name. If the entity named in the NDA is not the entity that owns the information or is being asked to maintain confidentiality, the document may bind no one.

Duration is one of the most consistently litigated NDA provisions. Courts in the United States apply a reasonableness standard: the confidentiality period must be long enough to protect a legitimate business interest, but not so long that it constitutes an unfair restraint on the receiving party. When an NDA fails this test, courts may strike down the duration clause or refuse to enforce the agreement at all.

An NDA that lasts indefinitely or for an unreasonably long time can be unenforceable. The Virginia court in Lasership v. Watson refused to enforce an NDA partly because its provisions were to apply for the rest of the employee’s life. An Illinois court in Trailer Leasing struck down an NDA whose geographic and temporal scope was found unreasonable. Courts are particularly skeptical of indefinite terms applied to standard business information that does not rise to the level of a trade secret.

The opposite problem also exists. Many DIY NDAs set durations that are shorter than the period during which the confidential information retains commercial value. An NDA’s confidentiality period may expire while proprietary information is still commercially sensitive, losing enforcement leverage not through misconduct but because the agreement no longer covers the period when protection is most needed. A startup that signs a two-year NDA before a partnership discussion and then reaches commercial success four years later may find the NDA has already expired when a dispute arises.

A one-way NDA, also called a unilateral NDA, creates confidentiality obligations on the receiving party only. The disclosing party shares information; the receiving party is bound to protect it. This structure is appropriate when information flows in one direction only.

The mistake occurs when both parties are sharing sensitive information but only a one-way NDA is in place. In a joint development conversation, a partnership negotiation, or a due diligence process where each party shows the other its technology, financials, and strategy, a one-way NDA leaves one party’s disclosures completely unprotected. When you are the only party bound by confidentiality obligations, your disclosures may be protected narrowly while the recipient retains broad freedom to use what it learns. A judge, jury, or arbitrator will read a one-way NDA exactly as it is written: as an agreement under which only one party is protected.

DIY drafters frequently default to one-way NDAs because that is what most templates provide. They do not stop to consider whether the information flow in their specific situation is actually one-directional. In many cases it is not, and the structural choice silently leaves half the disclosed information without any protection.

When a breach of confidentiality is discovered, the priority is usually to stop it from continuing rather than to calculate what it has already cost. Financial damages calculated after a disclosure has occurred are rarely adequate: the information is already out, it may already be in the hands of competitors, and the ability to contain it diminishes with every day that passes. The appropriate remedy in this situation is an injunction: a court order requiring the breaching party to stop the disclosure immediately.

Courts generally require that an NDA explicitly provide for injunctive relief before they will grant it. An NDA that only specifies financial damages leaves the disclosing party without access to the most urgent remedy available when information is actively being disclosed. Many DIY templates that focus on the monetary consequences of a breach omit the injunctive relief provision entirely, leaving a significant gap in available remedies.

The injunctive relief clause should also include a statement acknowledging that a breach would cause irreparable harm, because this acknowledgment strengthens the argument for granting an injunction without requiring the disclosing party to prove the extent of harm at the emergency hearing stage.