Non-Disclosure Agreement (NDA) Template

Names the two parties and states why information is being shared: the pitch, the project discussion, the potential partnership. The purpose matters because it limits use — the receiving party may use the information only for that stated reason, and nothing else. Agency decision: Keep the purpose narrow and project-specific. A clause that reads "exploring a potential business relationship" is so vague it could be stretched to cover almost anything; "evaluating a website redesign engagement commencing Q3 2025" is enforceable.

Once the parties and purpose are locked, the next logical question is what, exactly, counts as the information being protected.

Describes what is protected. A good definition is specific enough to be clear (business strategies, pricing, customer data, methods, designs) but not so broad it becomes unenforceable. The common approach is to cover information that is marked confidential or that a reasonable person would understand to be confidential from its nature.

Watch out on client-supplied NDAs: they often define confidential information to include your agency's own methodologies and pricing, which could restrain you from using your own processes. Redline any definition that captures information you originated before the engagement.

With confidential information defined, you equally need to spell out what falls outside that protection — otherwise the clause has no practical boundary.

States what is not protected, which is as important as what is. Standard carve-outs are information that is already public, was already known to the receiving party, is independently developed without using the disclosed information, or is received legitimately from a third party. Without these, the definition is overbroad and a court may decline to enforce it.

Some client templates omit the "independently developed" carve-out entirely; insist on it. Without it, your agency could be prevented from pursuing work it developed on its own, using no knowledge gained from the client.

Exclusions define the outer limit; the obligations clause defines what the receiving party must actively do with everything inside that limit.

Sets out how the receiving party must handle the information: hold it in confidence, use it only for the stated purpose, and protect it as carefully as their own. This is also where you permit necessary sharing with employees and, critically for an agency, with subcontractors and freelancers who need it to do the work, provided they are bound by the same obligations. Leaving the subcontractor carve-out out is the mistake that turns ordinary agency work into a technical breach.

Name this carve-out explicitly as covering subcontractors and freelancers, not just "employees." Many client templates use "employees" alone, which leaves your delivery model exposed from the moment you brief an outside developer.

Closely related to obligations is the question of whose information those obligations run in both directions to protect.

States whether both parties' information is protected or only one party's. For most agency situations this should be mutual, because you are disclosing as much as you receive. Set it unilateral only when one side alone is sharing and the other is not. Agency decision: Default to mutual in your own template. When a client sends a unilateral NDA that protects only their information, assess whether you will be sharing credentials, internal pricing, or proprietary processes during the engagement — if so, push back and convert it to mutual before signing.

With the scope of protection settled, the next clause determines how long that protection actually runs.

How long the obligation lasts, covering both the period during which information may be shared and how long it must be kept confidential afterward. A fixed, reasonable term (commonly two to five years for ordinary business information) is more enforceable than a perpetual one. Trade secrets can be protected for as long as they remain secret, but applying "forever" to routine information often makes the whole clause harder to enforce.

Client-supplied NDAs frequently say "perpetual" or "indefinitely." Redline that to a defined term, with five years a reasonable and commonly accepted position, and add a carve-out that trade secrets remain protected for as long as they qualify as such under applicable law.

Once the term ends, there needs to be a mechanism to ensure the information does not simply remain in the other party's files indefinitely.

What happens to the confidential materials when the discussion ends or the relationship concludes. Typically the receiving party returns or destroys them on request, which closes the loop so sensitive information does not simply linger indefinitely. Agency decision: Add a written confirmation requirement — the returning party should confirm destruction in writing within a set period, such as ten business days. Without this, "destroy on request" is unverifiable and essentially unenforceable in practice.

Even with return and destruction obligations in place, you need the agreement to specify what happens when a breach occurs despite those protections.

What a breach entitles the wronged party to. Because leaked information often cannot be undone with money alone, this clause usually states that the disclosing party may seek an injunction (a court order to stop further disclosure) in addition to any other legal remedy. It is what gives the agreement real force. Watch out: Some templates limit remedies to damages only and include a clause waiving the right to injunctive relief. That waiver strips the agreement of its most practical enforcement tool. Delete any language that restricts the non-breaching party to monetary remedies alone.

Finally, specifying where those remedies would be pursued is what makes the whole agreement practically actionable.

The jurisdiction whose law applies and where disputes are resolved. Agreeing this up front avoids a fight about venue if the agreement is ever tested. Agency decision: Specify your own jurisdiction as the governing law in your template. When a client's NDA names their jurisdiction instead — particularly a foreign one — factor in the practical cost of litigating there before accepting it unchanged.