The most important provision in any NDA. Too narrow and information you share is not protected. Too broad and the agreement may be challenged as unenforceable. The best practice is to define confidential information by category — financial information, technical specifications, customer data, business plans, and so on — rather than using a blanket “all information shared” definition. Mark-as-confidential requirements (requiring the disclosing party to identify confidential information in writing at the time of disclosure) reduce disputes but may cause real information to go unprotected if the marking requirement is not consistently followed.

What the receiving party must do with confidential information (use it only for the specified purpose), what it must not do (disclose it, use it for competitive purposes, allow unauthorized access), and what security measures it must apply (at minimum, the same measures applied to its own confidential information of equal sensitivity — the standard of care requirement). The obligation section should also specify who within the receiving party’s organization is permitted to access the confidential information and under what conditions.

Four standard carve-outs apply in virtually all US NDAs: information already in the public domain through no fault of the receiving party; information independently developed by the receiving party without reference to the disclosing party’s information; information received from a third party without confidentiality obligations; and information required to be disclosed by law, court order, or government authority (with notice to the disclosing party where legally permitted). Without these carve-outs, the NDA may be challenged as overbroad or may inadvertently bind the receiving party to obligations they cannot practically fulfill.

The relationship period (how long the NDA governs the relationship — typically 2 to 5 years) and the confidentiality survival period (how long after the NDA’s termination or expiration the receiving party must maintain confidentiality — typically 2 to 3 years for general confidential information, indefinite for trade secrets). The survival period for trade secrets can be indefinite under the Defend Trade Secrets Act — general confidential information should have a defined survival period for enforceability in most US jurisdictions.

An NDA breach is particularly difficult to remedy with money damages because the harm — disclosure of confidential information — is often not quantifiable and cannot be undone. Most NDAs include an explicit acknowledgment that breach would cause irreparable harm and that the disclosing party is entitled to seek injunctive relief (a court order requiring the receiving party to stop the disclosure) without proving actual damages and without posting a bond. Without this provision, the disclosing party must prove irreparable harm at the time of the injunction application — a higher and more uncertain burden.

The choice of governing law determines which state’s law applies to interpretation and enforcement. For most commercial NDAs, Delaware or New York are preferred governing law states because of their well-developed case law and business-friendly courts. However, for California-based parties, California law may apply regardless of the governing law clause if the NDA’s enforcement would violate California public policy. This is particularly relevant for employee NDAs where California Labor Code protections override contractual choice of law.