NDA vs confidentiality agreement: is there a difference? Plus mutual vs one-way

A non-disclosure agreement and a confidentiality agreement are the same thing. There is no statute that defines one differently from the other, and a court reading either will look at what the clauses say rather than what the title calls them. You will also see confidential disclosure agreement (CDA), common in universities and life sciences, and proprietary information agreement, common in employment. Same contract, different house style.

The names do carry a slight difference in tone. "Confidentiality agreement" sounds more collaborative, which is why some companies use it with partners and keep "NDA" for vendors and candidates. And "confidentiality clause" usually means something narrower: a section inside a larger contract — a services agreement, an employment contract, a contractor agreement — rather than a standalone document. If you already have a contract with somebody, check whether it has one of those before signing a separate NDA that might conflict with it.

So the useful questions are not about the name. They are about direction, scope and time.

Mutual or one-way

This is the real choice, and it is decided by one question: who is going to share something sensitive?

When you are not sure who will disclose more, use a mutual NDA. It costs nothing extra, and it saves a second negotiation the moment the other side mentions their own roadmap. When you are certain the information only flows one way, a one-way NDA is shorter and asks less of the person signing, which matters when you are the one asking a favour.

What every NDA has to say, whatever it is called

• A definition of confidential information. Either anything marked confidential, or anything a reasonable person would understand to be confidential. The second is broader and kinder to the discloser, who will not remember to stamp every slide.
• The exclusions. Information that is already public, that the recipient knew beforehand, that a third party gave them without restriction, or that they developed independently. Without these an NDA can be read as covering things the recipient was always free to use, which is the clause most likely to be struck out.
• What the recipient may do with it. Usually: use it only for the stated purpose, share it only with people who need to know and are bound by similar duties, and protect it with reasonable care.
• Required disclosure. What happens if a court or regulator demands the information — typically, prompt notice so the discloser can object, and disclosing no more than is required.
• Return or destruction. On request or at the end of the relationship, with an allowance for backups and copies the law requires the recipient to keep.
• Term. How long the obligations last. See below.
• Governing law and remedies. Which jurisdiction's law applies, and often an acknowledgement that damages alone would not be enough, so the discloser can ask a court for an injunction.

How long should an NDA last?

Two to five years is the common range for business information, and three is a reasonable default. The logic is that most commercial information — pricing, plans, pipeline — loses its value within a few years, and a recipient will resist an obligation that never ends.

Trade secrets are the exception. A trade secret is protected for as long as it stays secret, and an NDA that releases it after three years can undermine that protection. The usual answer, and the one our templates use, is a fixed term for confidential information generally and no end date for trade secrets for as long as they remain trade secrets under applicable law.

Three US rules worth knowing

• Whistleblower immunity notice. Under the Defend Trade Secrets Act, an agreement with an employee, contractor or consultant that governs the use of trade secrets should include a notice of the immunity for disclosures made to government officials or in sealed court filings. Leave it out and you lose the right to exemplary damages and attorney's fees against that individual under the Act.
• Regulators. An NDA cannot lawfully stop somebody reporting possible violations to a regulator such as the SEC, and the SEC has fined companies for agreements that appeared to. A carve-out for reporting to government agencies is now standard in agreements with staff.
• Harassment claims. The federal Speak Out Act makes pre-dispute non-disclosure clauses unenforceable against sexual assault and sexual harassment claims, and several states go further.

None of these matters much for an NDA between two companies exploring a deal. All of them matter for an NDA you ask a person to sign.

Our two templates

Both are free to read, edit in the browser and send for signature, and both are general-purpose starting points rather than legal advice.

• The mutual NDA template binds both parties, with a reasonable-person definition of confidential information, the four standard exclusions, a three-year term and open-ended protection for trade secrets. Both signature blocks are already in place.
• The one-way NDA template binds only the recipient. It adds a stated purpose, a required-disclosure clause and a return-of-information clause, with the purpose, term and governing state left as bracketed placeholders for you to fill.

If either side is an individual you are engaging, rather than a company, add the whistleblower notice described above before you send it.

An NDA you sign, or an NDA you click

Not every confidentiality promise needs a negotiated, countersigned document. If what you want is for a reader to accept terms before they open a deck or a data room, XDocs can put an NDA before viewing on the share link: the terms are shown, the reader accepts them, and the acceptance is recorded before the first page is served — and, with email verification switched on as well, recorded against an address the reader has proved is theirs. That suits a pitch deck going to twenty people far better than twenty envelopes. We explain how link gates work in a link should carry its own rules.

The short version

Call it whatever your counterparty is used to. Choose mutual when information flows both ways or you cannot tell yet, and one-way when it plainly does not. Make sure it has exclusions, a purpose, a sensible term and open-ended protection for trade secrets. Then send it in a way that leaves a record of who agreed to what, and when.