NDA red flags: 10 things to check before you sign

The NDA is the most-signed and least-read document in business. It arrives before the real negotiation starts, it's two or three pages, everyone treats it as a formality, and it gets signed on a phone in a taxi.

That is exactly why it's worth ten minutes. An NDA is short enough that a non-standard term stands out if you know what standard looks like — and long enough to hide a non-solicit, an IP assignment, or a confidentiality obligation with no end date.

Here are the ten things we flag most often.

1. It's one-way when the conversation is two-way

A unilateral NDA protects only the disclosing party. A mutual NDA protects both under the same terms.

The test isn't what the document is called — it's whether you will actually disclose anything. If you're going to walk them through your roadmap, pricing, or architecture in the second meeting, a one-way NDA leaves all of that unprotected while binding you completely.

The ask: make it mutual. This is almost never refused, because refusing it signals that the counterparty expects to receive far more than they give.

2. The definition of Confidential Information has no boundaries

Watch for definitions like "all information disclosed by the Disclosing Party, in any form, whether or not marked confidential."

The problem is not that it's broad. It's that a definition covering everything is unadministrable: two years later nobody can say what was covered, which makes the obligation both hard to comply with and hard to enforce.

The ask: either require written information to be marked confidential and oral disclosures to be confirmed in writing within a reasonable window, or tie the definition to information that a reasonable person would understand to be confidential given its nature and the circumstances of disclosure.

3. The standard exclusions are missing

Nearly every reasonable NDA excludes information that:

• was already publicly known, or becomes public through no fault of the receiving party;
• the receiving party already had before disclosure;
• was rightfully received from a third party without a duty of confidence; or
• the receiving party independently developed without using the disclosed information.

If any of these four is missing, the NDA can be read to restrict information you obtained legitimately elsewhere. That's a real operational problem for a company that talks to multiple vendors in the same category.

Also check: a required-by-law carve-out that lets you comply with a subpoena or regulator, ideally with a duty to give notice first where legally permitted.

4. The confidentiality period never ends

A flat perpetual obligation over all information is common in templates and rarely appropriate. The usual market shape is a defined period — commonly three to five years from disclosure — with trade secrets carved out and protected for as long as they remain trade secrets.

Note the distinction between the term of the agreement (how long you can keep exchanging information under it) and the survival period (how long the confidentiality obligation lasts for information already disclosed). They are different clauses and a template will sometimes set one and leave the other silent.

5. A non-solicit has been added

A non-solicitation clause in a document titled "Non-Disclosure Agreement" is not boilerplate — someone put it there on purpose.

It may well be acceptable. But evaluate it as a separate commercial term: does it cover only employees you actually met through the discussion, or every employee of the company? Does it prohibit soliciting or also hiring? A no-hire clause that catches someone who applied through your careers page independently is much broader than it looks.

The ask: limit it to employees you had contact with in connection with the discussions, exclude responses to general public job postings, and keep the duration to twelve months.

6. IP is being assigned

Some NDAs include a line granting the disclosing party ownership of any improvements, derivatives, or feedback the receiving party develops.

For a genuine confidentiality agreement this is out of scope. It's especially worth catching when you are the one likely to build something — an NDA signed before a pilot should not quietly determine who owns the work if the pilot goes ahead. If ownership needs to be addressed, it belongs in the commercial agreement that follows, where the consideration is actually negotiated. The same present-tense assignment issues apply there; see the IP assignment clause founders get wrong.

7. A residuals clause you haven't read carefully

A residuals clause allows the receiving party to use information retained in the unaided memory of people who saw it. It's common in enterprise software and often reasonable — engineers cannot unlearn things.

It is also a substantial hole in the protection if you're the disclosing party. Whether to accept it depends entirely on which side of the disclosure you're on. Read it and decide deliberately; don't let it through as filler.

8. Remedies run in only one direction

Look for language granting the disclosing party injunctive relief without posting bond, plus attorneys' fees, while offering the receiving party nothing. In a mutual NDA these remedies should be mutual too.

Attorneys' fees provisions in particular deserve a second look: a one-way fee shift materially changes the economics of any dispute, because it makes fighting even a weak claim expensive.

9. Return-and-destroy is impossible as written

Many NDAs require return or destruction of all confidential information on request, with written certification. Fine in principle — except that no company can purge information from routine backups on demand.

The ask: add a standard carve-out permitting retention of copies made by automated backup systems and copies required to be retained by law or regulatory policy, with the confidentiality obligation continuing to apply to anything retained.

10. Governing law and venue somewhere inconvenient

The last paragraph of the NDA usually sets governing law and exclusive venue. It is the clause most likely to be pure copy-paste from the counterparty's own template, and the one most likely to make enforcing your rights uneconomic.

If the venue is a jurisdiction where you have no presence and no counsel, either negotiate it or accept — knowingly — that the confidentiality protection is largely symbolic in practice.

A quick triage order

If you have five minutes rather than fifteen, read in this order:

1. Mutual or one-way?
2. How long does the obligation last?
3. Are the four standard exclusions there?
4. Is there anything in here that isn't about confidentiality?
5. Governing law and venue.

Question 4 catches the non-solicits, the IP grants, and the exclusivity clauses. It's the highest-yield question in the list, because those terms are the ones nobody expects to find in an NDA and therefore nobody looks for.

For the longer agreements that follow the NDA, the same triage logic scales up — the full version is in how to review a contract without a lawyer.

A disclaimer

This is a checklist for self-review, not legal advice, and nothing here creates a lawyer–client relationship. What counts as an enforceable confidentiality term, and what counts as an enforceable non-solicit, varies meaningfully between jurisdictions. Use this to find the questions worth asking, then take the ones that matter to a lawyer.