The most common dangerous provision in NDAs is a confidential information definition that attempts to cover everything. A typical example: “all information disclosed by either party in any form, whether or not marked confidential.” Courts in multiple US states have found such definitions so broad as to be unenforceable, reasoning that a party cannot meaningfully protect information when it cannot give the receiving party fair notice of what is covered.

Furthermore, an overly broad definition may inadvertently cover information that does not qualify for NDA protection: publicly available information, general industry knowledge, and skills a receiving party developed before the relationship. Including these categories can undermine the entire agreement in states that scrutinize NDA scope.

The correct approach is a definition that describes specific categories of information by type, such as financial data, product specifications, customer lists, and technical documentation, with a mechanism for identifying information as confidential at disclosure.

An NDA that runs “in perpetuity” or “until the information is no longer confidential” creates significant enforceability risk in multiple US states. California Business and Professions Code Section 16600 broadly prohibits restraints on trade, and California courts have applied this reasoning to employee NDA provisions that effectively prevent former employees from using general knowledge and skills indefinitely.

In other states, unlimited duration NDAs are technically enforceable but may be challenged on reasonableness grounds in litigation. Courts generally evaluate whether the duration is proportionate to the business interest being protected.

The industry standard for general confidential information is a defined term of two to five years. Trade secret protection is properly handled separately, as it survives as long as the information maintains its trade secret status under the Defend Trade Secrets Act and applicable state law, regardless of what the NDA says.

The most effective remedy for NDA breach is an injunction: a court order stopping further disclosure or use of confidential information. Monetary damages alone are often inadequate because the harm from disclosure cannot be fully compensated after the fact.

However, obtaining an injunction is significantly easier when the NDA explicitly acknowledges that breach will cause irreparable harm and that injunctive relief is an appropriate remedy. Without this provision, the injured party must prove irreparable harm and inadequacy of monetary damages in an emergency motion before a court that has not yet considered the merits. With the provision, the contractual acknowledgment of irreparable harm is strong evidence that supports the emergency motion.

This provision is absent from a significant proportion of NDAs drafted without legal oversight. It costs nothing to include and materially strengthens the agreement’s enforceability as a practical matter.

A residuals clause permits the receiving party to use, in subsequent work, ideas or information retained in the unaided memory of its personnel without reference to confidential documents. When present in an NDA without careful limitation, a residuals clause can effectively gut the agreement’s core protection for exactly the category of information most at risk: the high-value technical and strategic knowledge that employees or contractors retain in memory after a relationship ends.

The danger runs in both directions. An NDA that includes a residuals clause without negotiating its scope may provide far less protection than the disclosing party believes. An NDA that omits any consideration of residuals in a technology or IP context may create ambiguity about whether a former employee who builds a competing product used confidential information or legitimately relied on their own retained knowledge.

An NDA without a return or destruction clause leaves confidential materials in the receiving party’s possession indefinitely after the relationship ends. The confidentiality obligation may technically survive, but the practical ability to enforce it is significantly weakened when the receiving party retains copies of the information.

A well-drafted return or destruction clause requires the receiving party to return or certify the destruction of all confidential materials within a defined period of the relationship ending or upon written demand. It should specify whether return or destruction is required, whether electronic copies must be deleted, and whether a certification of destruction must be provided.

This clause is particularly important for NDAs covering technical documentation, financial projections, customer data, and product specifications: exactly the categories that create competitive risk if retained by a counterparty after a deal does not close.

Without a governing law clause, the applicable state law for any NDA dispute is determined by conflict-of-laws principles, which vary by state and can produce unexpected results. For a California company sharing information with a New York counterparty under an NDA without a governing law clause, both states’ laws might be argued to apply, and the question of which applies could itself require resolution before the underlying dispute can be addressed.

The stakes are significant because states differ on critical NDA enforceability questions. California’s treatment of duration, non-compete provisions sometimes embedded in NDAs, and trade secret definitions differs materially from Delaware, Texas, New York, and Florida. The governing law clause determines which state’s standards apply to these questions.

Most NDAs include a carve-out for information the receiving party already knew before the disclosure. This is appropriate and standard. The danger is in how the carve-out is defined and substantiated. An NDA that creates a broad prior knowledge carve-out without requiring the receiving party to document that prior knowledge at the time of disclosure creates an attractive post-hoc defense for a party that later wishes to claim it had independent knowledge of disclosed information.

The stronger approach requires the receiving party to identify in writing, prior to or contemporaneously with the disclosure, any information it claims prior knowledge of. This requirement shifts the documentation burden to the moment of disclosure rather than the moment of dispute, when the incentive to claim prior knowledge is highest.