How to Review an NDA: An 8-Step Checklist
A non-disclosure agreement may look simple, but its wording can determine what information is protected, who may receive it, how long confidentiality lasts, and what happens after the business discussion ends.
An effective NDA review should answer three questions: What information is protected? What may the recipient do with it? Are the obligations practical, proportionate, and legally appropriate?
If you need a foundation first, read What Is an NDA? before working through this review process.
This article provides general educational information and is not legal advice. NDA requirements and enforceability vary by jurisdiction and circumstances.
What Is an NDA Review?
An NDA review is the process of examining a non-disclosure agreement to determine whether its confidentiality obligations match the proposed relationship and can be followed in practice.
The reviewer should evaluate more than the definition of confidential information. The parties, permitted purpose, recipients, exclusions, disclosure procedures, duration, remedies, governing law, and operational requirements must work together.
A well-reviewed NDA protects legitimate confidential information without creating vague, excessive, or impossible obligations.
How to Review an NDA in 8 Steps
1. Confirm the Parties and Type of NDA
Begin by verifying the full legal name of every party. A company representative should normally sign on behalf of the legal entity rather than in an individual capacity.
Next, determine whether the NDA is unilateral or mutual.
• A unilateral NDA protects information disclosed by only one party.
• A mutual NDA protects confidential information exchanged by both parties.
A unilateral agreement may be appropriate when only one side will disclose sensitive information. If both parties expect to share business plans, technical materials, customer information, or other proprietary information, a mutual NDA may better reflect the transaction.
Also check whether affiliates are included. A broad definition of " affiliate" could extend rights or obligations to entities that are not directly involved in the proposed relationship.
2. Define the Purpose of the Disclosure
The NDA should explain why confidential information will be exchanged. This is often called the " Purpose," " Permitted Purpose," or " Proposed Transaction." or " Proposed Transaction."
The purpose should be specific enough to control how the information may be used but broad enough to support the intended discussions.
For example, " evaluating a potential commercial relationship" may be appropriate for preliminary negotiations. A narrower purpose may be needed when information is shared for a particular project, acquisition, investment, or technical integration.
Check whether the agreement prohibits both unauthorized disclosure and unauthorized use. An NDA that restricts disclosure but does not restrict use may leave an important gap.
Ask:
• What transaction or relationship is being evaluated?
• Who needs access to the information?
• Which activities are permitted?
• Could the wording interfere with legitimate internal evaluation?
3. Examine the Definition of Confidential Information
The definition determines the scope of the agreement. It should cover the information that genuinely requires protection without treating every communication as confidential indefinitely.
Confidential information may include:
• Business plans and financial information
• Customer and supplier information
• Product designs, prototypes, and source code
• Pricing, forecasts, and commercial strategies
• Research, processes, and technical know-how
• Information received from customers or other third parties
Consider how information becomes protected. Some NDAs protect everything disclosed in connection with the relationship. Others require written information to be marked " confidential" and oral disclosures to be confirmed in writing.
From the recipient's perspective, an unlimited definition may be difficult to administer. From the discloser's perspective, strict marking requirements may accidentally exclude valuable information.
A practical formulation may protect information that is marked confidential or that a reasonable person would understand to be confidential given its nature and the circumstances of disclosure.
4. Check the Standard Exclusions
A balanced NDA normally excludes information that should not remain subject to confidentiality restrictions.
Common exclusions include information that:
• Is or becomes publicly available without a breach of the NDA
• Was lawfully known to the recipient before disclosure
• Is received lawfully from a third party without a confidentiality obligation
• Is independently developed without using the protected information
• Is approved for release in writing by the disclosing party
Review who must prove that an exclusion applies and what evidence may be required. A recipient may need dated records, development files, emails, or other documentation to demonstrate prior knowledge or independent development.
The exclusions should also work with the main definition. A useful exclusion can be weakened if another provision creates an inconsistent or broader obligation.
5. Review Use, Protection, and Representative Obligations
The NDA should state how the recipient must protect and use confidential information.
A common standard requires the recipient to exercise reasonable care or at least the same care used to protect its own similar information. Be cautious with absolute language such as " ensure complete security" or " prevent every unauthorized disclosure," because perfect security may be impossible to guarantee.
The recipient may need to disclose information to:
• Employees
• Directors and officers
• Lawyers and accountants
• Financial advisers
• Contractors and consultants
• Affiliates or financing sources
The NDA should permit necessary disclosure to representatives who need the information for the stated purpose. It should also explain whether those representatives must be subject to written confidentiality obligations and whether the recipient is responsible for their conduct.
Check the agreement against actual operations. If information will be stored in cloud systems, reviewed by external counsel, or processed by approved technology providers, the contractual language should not accidentally prohibit those necessary activities.
6. Review Required Disclosures and Protected Reporting
An NDA should address disclosures required by law, regulation, subpoena, court order, or governmental request.
These provisions commonly require the recipient to provide notice and reasonable assistance so the disclosing party can seek a protective order. However, notice should only be required when legally permitted, and the recipient should generally disclose only the information legally required.
Employment-related and contractor NDAs require additional care. Under the U.S. Defend Trade Secrets Act, certain confidential disclosures made to government officials or attorneys for reporting or investigating suspected legal violations may receive immunity. The statute also contains a notice requirement for agreements governing employees' use of trade secrets or confidential information. See 18 U.S.C. § 1833.
An NDA must not improperly interfere with protected reporting. The SEC explains that Rule 21F-17 prohibits actions that impede an individual from communicating directly with SEC staff about possible securities-law violations, including certain restrictions in confidentiality agreements. See the SEC's whistleblower-protection guidance.
Review notification, consent, cooperation, and confidentiality language together. A general statement allowing legal reporting may not cure another provision that imposes advance approval or restrictive notification requirements.
7. Evaluate the Term, Return Requirements, and Remedies
An NDA may contain two different periods:
• The agreement term, during which information may be exchanged
• The confidentiality period, during which the recipient must protect the information
These periods do not have to be identical. The appropriate duration depends on how quickly the information loses commercial value and whether it qualifies as a trade secret.
Avoid assuming that one standard duration is appropriate for every NDA. Pricing information may become outdated relatively quickly, while source code, formulas, or technical processes may remain sensitive for much longer. Trade-secret obligations are sometimes tied to the period during which the information continues to qualify for protection under applicable law.
The NDA should also explain what happens when discussions end. Review whether the recipient must return or destroy:
• Original documents
• Copies and extracts
• Electronic files
• Notes and analyses
• Backup or archival materials
Absolute deletion requirements may conflict with automated backups, legal holds, professional recordkeeping duties, or regulatory retention requirements. Appropriate exceptions should still require retained information to remain protected.
Finally, examine the remedies. Consider whether the agreement provides for injunctive relief, damages, indemnification, attorney fees, or predetermined damages. Remedies should be reviewed alongside applicable law and the realistic consequences of a breach.
8. Look Beyond Confidentiality Before Signing
An NDA should not quietly become a broader commercial agreement unless the parties deliberately intend that result.
Look for provisions concerning:
• Non-compete restrictions
• Non-solicitation of employees or customers
• Non-circumvention
• Exclusivity
• Residual knowledge
• Intellectual-property ownership or assignment
• Reverse engineering
• Public announcements
• Data protection and cybersecurity
• Governing law, venue, and dispute resolution
• Representations about the accuracy of disclosed information
These provisions can create obligations that go far beyond keeping information confidential. For example, an intellectual-property clause could affect ownership of work developed during discussions, while a residuals clause could permit the recipient to use information retained in unaided memory.
Confirm that the NDA does not obligate either party to complete the proposed transaction. Business commitments, payment obligations, licenses, deliverables, and services normally belong in a separate definitive agreement.
Before approval, perform a final contract review to check defined terms, cross-references, dates, signatures, governing law, and consistency across the document.
NDA Review Checklist
Use this checklist before approving or signing an NDA:
• Confirm the parties'correct legal names
• Determine whether the NDA should be unilateral or mutual
• Define the permitted purpose clearly
• Review the definition of confidential information
• Confirm that customary exclusions are included
• Check the confidentiality and security standard
• Identify permitted representatives and third-party recipients
• Review responsibility for representatives
• Confirm procedures for legally required disclosures
• Preserve applicable whistleblower and protected-reporting rights
• Separate the agreement term from the confidentiality period
• Review return, destruction, backup, and retention requirements
• Identify non-compete, non-solicitation, IP, residuals, or exclusivity terms
• Evaluate remedies, governing law, venue, and dispute procedures
• Verify names, dates, defined terms, cross-references, and signatures
Common NDA Review Mistakes
Treating Every NDA as a Standard Form
The risks of an NDA depend on the information, parties, purpose, industry, and direction of disclosure. A template should be a starting point rather than a substitute for reviewing the actual transaction.
Accepting an Overly Broad Definition
A definition covering every piece of information, regardless of its nature or source, can be difficult to administer and may create unnecessary exposure.
Ignoring the Permitted Purpose
The non-use restriction may matter as much as the non-disclosure restriction. If the purpose is unclear, the recipient may not know which activities are permitted.
Missing Operational Conflicts
Terms requiring immediate deletion, written agreements with every representative, or advance notice of every legal disclosure may be impossible or inappropriate in practice.
Overlooking Hidden Commercial Restrictions
Non-compete, non-solicitation, exclusivity, non-circumvention, and intellectual-property terms should not escape scrutiny merely because they appear inside an NDA.
Reviewing Clauses in Isolation
Definitions, exclusions, use restrictions, disclosure permissions, duration, and remedies operate as a connected system. A reasonable clause can become problematic when another provision contradicts it.
How AI Can Support NDA Review
AI can help legal and business teams compare an NDA against an approved playbook, locate unusual language, summarize obligations, and identify provisions requiring closer attention.
Alloomi AI can support contract review workflows by helping professionals analyze language, surface potential issues, and maintain more consistent review processes. Human reviewers should still verify the legal context, business purpose, facts, and final decisions. High-risk or unfamiliar agreements may require advice from qualified legal counsel.
Frequently Asked Questions
What Is the Most Important Clause to Review in an NDA?
The definition of confidential information is central because it determines what the agreement protects. However, it must be reviewed together with the permitted purpose, exclusions, disclosure rights, duration, and remedies.
How Long Should an NDA Last?
There is no universally correct NDA duration. The appropriate period depends on the nature of the information, how quickly it loses commercial value, the transaction, applicable law, and whether the information remains legally protected as a trade secret.
Should an NDA Be Mutual?
A mutual NDA is generally worth considering when both parties will disclose confidential information. A unilateral NDA may be sufficient when only one party will make protected disclosures.
Can Confidential Information Be Shared With Employees or Advisers?
An NDA commonly permits disclosures to representatives who need the information for the permitted purpose and are subject to appropriate confidentiality obligations. The definition of representatives and the recipient's responsibility for them should be reviewed carefully.
Can an NDA Prevent Someone From Reporting Illegal Conduct?
An NDA should not improperly restrict legally protected reporting. U.S. laws and regulatory rules may protect certain disclosures to government agencies, regulators, or attorneys. The applicable rules depend on the agreement and circumstances.
Should a Lawyer Review an NDA?
Routine NDAs may be reviewed through an approved internal process, but legal advice may be appropriate when the agreement involves valuable trade secrets, employment restrictions, unusual remedies, regulated information, cross-border parties, or other significant risks.
