Before signing a Non-Disclosure Agreement (NDA), a business should check exactly what information is protected, how it can be used, who can receive it, how long confidentiality lasts, who indemnifies who, which jurisdiction will apply in the event of a dispute and what happens if the agreement is breached.

In India, there is no separate statute called an “NDA Act”. An NDA is principally enforced as a contract under the Indian Contract Act, 1872, while confidentiality and trade-secret disputes may also involve equitable principles, intellectual-property law and other applicable statutes. Section 10 of the Contract Act sets out the basic requirements of a valid contract.
Indian Contract Act, 1872 — India Code

India also does not presently have a standalone Trade Secrets Act. This makes the wording of the NDA—and the steps a business actually takes to keep information secret—particularly important.

Here are the 10 clauses that deserve careful attention before a business signs an NDA.

1. Does the NDA Clearly Identify the Parties and Its Purpose?

An NDA should first make it clear who is disclosing information, who is receiving it, what information is being shared and the purpose for which it is being shared.

This sounds basic, but it affects almost everything that follows.

For example, information may be disclosed for:

• evaluating a proposed investment;
• discussing a distributorship;
• negotiating a joint venture;
• appointing a manufacturer or vendor;
• engaging an employee or consultant; or
• carrying out due diligence before a transaction.

The agreement should define this commercial purpose instead of simply saying that information may be used for “business purposes”.

If only one business will disclose confidential information, a one-way NDA may be appropriate. If both sides will disclose sensitive information, a mutual NDA is generally more suitable.

Also check that the correct legal entity is signing. The brand name used in emails may not necessarily be the company, LLP or proprietorship that should actually become a party to the agreement.

For a wider review of commercial agreements, see 10 Contract Clauses Every MSME Should Review Before Supplying Goods.

2. How Does the NDA Define “Confidential Information”?

This is usually the most important clause in the agreement.

An NDA should define confidential information broadly enough to protect genuine business secrets, but precisely enough that the receiving party can understand what must remain confidential.

Depending on the business, this may include:

customer information, pricing, margins, product specifications, source code, formulas, manufacturing processes, prototypes, drawings, supplier terms, financial information, marketing plans, business strategies and unpublished technical information.

A clause saying that “everything disclosed by the company is confidential forever” can create unnecessary uncertainty.

The Delhi High Court’s litigation in Navigators Logistics Ltd. v. Kashif Qureshi & Ors. illustrates why businesses should be capable of identifying the confidential information they claim has been misused. In its 20 November 2024 decision, the Division Bench held that the confidentiality allegations in that case required examination at trial while separately recognising the settled rule relating to post-employment non-compete restrictions.
Delhi High Court — Navigators Logistics judgment listing

The practical lesson is simple: do not rely only on the words “confidential information”. Describe the categories of information that actually matter to your business.

A Business Should Also Protect Confidentiality in Practice

An NDA becomes much more useful when the company’s conduct matches the document.

Restrict sensitive folders, control access, mark important documents confidential where appropriate, maintain access logs, withdraw access when employees or vendors leave, and avoid distributing genuinely sensitive information to people who do not need it.

3. What Information Is Excluded From Confidentiality?

A balanced NDA should explain what is not confidential.

Typical exclusions include information that:

was already lawfully known to the recipient;

is already publicly available through no breach of the NDA;

is lawfully received from another person who is entitled to disclose it; or

is independently developed without using the disclosing party’s confidential information.

These exclusions are important because an NDA should protect genuine confidential information—not information that everybody in the industry already knows.

Businesses should also pay attention to the burden of proof. If the receiving party says that information was already in its possession or independently developed, the agreement may require contemporaneous records supporting that position.

The clause should also deal with disclosures required by law, a regulator or a court. It can require advance notice to the disclosing party where giving such notice is legally permitted, provided that the disclosure is limited to the information legally required to be disclosed, rather than all the confidential information, instead of attempting to prohibit a legally mandatory disclosure. 

4. What Is the Recipient Actually Allowed to Do With the Information?

Preventing disclosure is only half the job.

The agreement should also restrict unauthorised use.

Suppose Company A gives Company B confidential manufacturing data solely so Company B can quote for a manufacturing contract. Company B may not publish the information anywhere, but it could still misuse it internally to create a competing product.

A stronger NDA therefore says that confidential information may be used only for the identified purpose.

It should also answer practical questions such as whether information can be shared with employees, directors, accountants, advocates, consultants, affiliates or subcontractors.

Where disclosure to representatives is permitted, access should generally be limited to persons who genuinely need the information and who are subject to appropriate confidentiality obligations.

The wording should also allocate responsibility for breaches by employees or representatives rather than leaving the issue uncertain.

5. Does the NDA Require Appropriate Security for Confidential Information?

Confidentiality is not merely a promise not to forward a document.

Modern NDAs should consider how information will actually be stored and accessed.

Depending upon the sensitivity of the transaction, reasonable protections may include access controls, password protection, restrictions on copying, secure file-transfer systems, limits on downloading information to personal devices, and prompt reporting of suspected unauthorised access.

This becomes particularly important where confidential information contains personal data.

The Digital Personal Data Protection Act, 2023 has been enacted, with its provisions subject to phased commencement under Section 1. Businesses dealing with personal data should therefore review the applicable data-protection position separately instead of assuming that an NDA alone satisfies privacy obligations.
Digital Personal Data Protection Act, 2023 — India Code

An NDA protects confidentiality between contracting parties. It is not a substitute for compliance with applicable data-protection law.

Where personal data or other sensitive information is involved, the NDA should set out some basic security expectations and require the receiving party to promptly inform the disclosing party if the information is lost, accessed without authorisation or disclosed improperly. Depending on the nature of the arrangement, the parties may also need separate data-protection terms or a data-processing agreement. An NDA can help protect the confidentiality of personal data, but it does not by itself cover all the obligations that may apply under data-protection laws.

6. How Long Does the Confidentiality Obligation Last?

There is no universal Indian rule saying that every NDA must last two years, three years or five years.

The appropriate period depends upon the information.

A pricing proposal for a particular tender may lose commercial sensitivity relatively quickly. A proprietary manufacturing formula or technical process may remain commercially sensitive for much longer.

The NDA should distinguish between:

the term of the agreement—the period during which information may be exchanged; and

the survival period—the period during which confidentiality obligations continue after the commercial relationship ends.

For genuine trade-secret information, parties sometimes draft confidentiality obligations to continue for so long as the information remains genuinely confidential. Whether particular wording is enforceable will depend on the facts, the information involved and the nature of the restriction.

Businesses should be wary of blindly inserting “confidential forever” into every NDA without considering what information genuinely requires long-term protection.

7. What Happens to the Information When Discussions End?

The NDA should say what happens when:

the proposed transaction does not go ahead;

the business relationship ends; or

the disclosing party asks for its information back.

Usually, the agreement provides for the return or destruction of confidential materials.

But a clause saying “delete every copy immediately” may be unrealistic where information exists in routine system backups or must be retained because of legal, regulatory, audit or professional obligations.

A practical clause can therefore require return or deletion of actively held copies while recognising tightly drafted exceptions for legally required retention and inaccessible routine backups.

Any information retained under an exception should remain subject to the confidentiality obligation.

8. Does the NDA Accidentally Transfer Intellectual-Property Rights?

Receiving confidential information should not automatically mean acquiring ownership of it.

The NDA should state whether disclosure grants any licence or other right in patents, copyright, designs, trademarks, software, technology or other intellectual property.

A typical commercial position is that disclosure itself does not transfer ownership or grant an IP licence unless the agreement expressly says otherwise.

Businesses should also check provisions dealing with:

reverse engineering;

analysis of prototypes;

feedback and suggestions;

improvements;

derivative material; and

“residual knowledge” retained in a person’s unaided memory.

A broadly drafted residual-knowledge clause can significantly weaken confidentiality protection because it may allow a recipient to use information remembered by its employees.

Similarly, a blanket prohibition on reverse engineering may have significant commercial consequences and should be reviewed in the context of the actual product and transaction.

9. Is a “Confidentiality” Clause Really a Non-Compete Clause?

This is one of the most important Indian-law checks.

Section 27 of the Indian Contract Act provides that an agreement restraining a person from exercising a lawful profession, trade or business is void to that extent, subject to the statutory exception relating to sale of goodwill.

The Supreme Court has repeatedly distinguished between legitimate obligations operating during a contractual relationship and restrictions that improperly restrain future trade.

In Percept D’Mark (India) Pvt. Ltd. v. Zaheer Khan, (2006) 4 SCC 227, the Supreme Court treated the post-contractual restrictive covenant before it as a restraint hit by Section 27.
Percept D’Mark v. Zaheer Khan — judgment text

The Supreme Court revisited the distinction in Vijaya Bank & Anr. v. Prashant B. Narnaware, 2025 INSC 691, observing in the employment context that restrictions operating during the subsistence of the contract stand on a different footing from restrictions on future employment.

Therefore, an NDA should not casually say:

“After termination, the recipient shall not work with any competitor of the disclosing party.”

That is not merely confidentiality.

A properly targeted confidentiality clause instead focuses on preventing the use or disclosure of genuinely confidential information.

Non-solicitation and similar restrictions also require separate, fact-specific examination. They should not be assumed enforceable simply because they appear inside a document titled “NDA”.

The key question is whether the restriction is actually protecting confidential information or is simply preventing the other party from carrying on its business. An NDA can reasonably restrict the recipient from using confidential information to compete with the disclosing party, but it should not go so far as to prevent the recipient from working in the same industry or dealing with competitors merely because it received confidential information. Any restriction should therefore be closely connected to the confidential information being protected and limited to what is reasonably necessary for that purpose. 

10. What Remedies, Damages and Dispute-Resolution Terms Apply?

An NDA should explain what happens if confidential information is misused.

Sections 73 and 74 of the Indian Contract Act are relevant to contractual damages. Section 73 deals with compensation for loss caused by breach, while Section 74 deals with contracts that specify a sum payable upon breach or otherwise contain a penalty stipulation.

A clause saying:

“Any breach will result in damages of ₹1 crore”

does not automatically guarantee an award of ₹1 crore.

The statutory rules governing compensation still apply.

Similarly, an NDA may say that the disclosing party can seek an injunction, but contractual wording cannot force a court to grant one automatically. Injunctive relief remains subject to applicable law and judicial requirements. The Specific Relief Act, 1963 contains the statutory framework for permanent injunctions, including Section 38.
Specific Relief Act, 1963 — India Code

The dispute clause should also clearly identify whether disputes will be resolved through courts or arbitration.

If arbitration is chosen, businesses should check the seat of arbitration, number and method of appointment of arbitrators, language, applicable institutional rules if any, and the courts that will have supervisory jurisdiction. Section 7 of the Arbitration and Conciliation Act, 1996 governs arbitration agreements.

Do not treat “governing law”, “jurisdiction” and “seat of arbitration” as interchangeable concepts.

For NDAs sitting inside larger MSME or supply arrangements, businesses may also find it useful to review How Should Businesses Draft Payment Terms With MSME Suppliers in India?.

Before Signing: Also Check Execution, Stamp Duty and Electronic Records

The best NDA can still create avoidable procedural problems if execution is neglected.

The authorised signatory should sign for the correct legal entity, and the business should preserve the final executed version rather than relying on multiple email drafts.

Electronic contracting is legally recognised in India. Section 10A of the Information Technology Act, 2000 provides that a contract is not unenforceable merely because electronic records were used in its formation.
Information Technology Act, 2000 — India Code

Stamp duty requires more care.

The applicable duty can depend upon the State or Union Territory and the nature of the instrument. Businesses should therefore check the applicable stamp legislation rather than assuming that every NDA attracts the same ₹100, ₹500 or other fixed duty throughout India.

Section 35 of the Indian Stamp Act, 1899 addresses the evidentiary consequences of an instrument that is chargeable with duty but is not duly stamped, subject to its provisions and applicable State amendments.

A standalone NDA also does not ordinarily require registration merely because it is called an NDA; however, the substance of the document and any underlying transaction should always be checked separately.

What Are the Biggest NDA Red Flags for a Business?

The biggest warning signs are usually not complicated legal expressions.

They are clauses that make the commercial obligation unnecessarily broad.

Watch particularly for language that makes every piece of information confidential regardless of whether it is actually secret, permits unrestricted access by affiliates or subcontractors, imposes unlimited liability on only one party, transfers intellectual property unintentionally, prevents lawful future business activity, selects an impractical foreign dispute forum, or fixes a large “penalty” without considering Indian contract law.

The same principle applies to wider commercial agreements: understanding liability, termination and dispute clauses before signing is usually cheaper than arguing about them afterwards. See 10 Contract Clauses Every MSME Should Review Before Supplying Goods.

Businesses should also preserve the negotiation trail and final electronic record. For an example of why business emails and electronic records can later become important evidence, see Can Email Confirmation Be Used as Proof of Outstanding Payment in India?.

Frequently Asked Questions About NDAs in India

Is an NDA legally enforceable in India?

Yes, an NDA can be legally enforceable as a contract if it satisfies the Indian Contract Act and its particular provisions are lawful. Calling a document an “NDA” does not make every clause enforceable; each restrictive provision must survive the applicable law.

Is there a separate NDA law in India?

No. India does not have a separate statute dedicated solely to NDAs. Contract law, breach-of-confidence principles and other applicable laws provide the legal framework.

Can an NDA stop an employee from joining a competitor?

A confidentiality clause and a non-compete clause are legally different. A post-employment restriction preventing a person from carrying on a lawful profession, trade or business can be void under Section 27. Protection against misuse of genuinely confidential information should be drafted separately from a broad prohibition on future employment.

Can confidentiality continue after the NDA expires?

Yes, the agreement can provide for confidentiality obligations to survive termination. The appropriate duration should reflect the nature of the information. Genuine trade-secret information may justify protection tied to the period during which it remains confidential.

Does an NDA have to be notarised?

A standalone commercial NDA does not ordinarily become valid only because it has been notarised. Execution requirements, applicable stamp duty and the nature of the underlying transaction are more important. Particular transactions may, however, involve separate legal formalities.

Can an NDA be signed electronically?

Yes. Section 10A of the Information Technology Act recognises contracts formed using electronic records, and the Act also contains provisions recognising electronic records and electronic signatures. The business should preserve reliable evidence showing the final terms and who accepted them.

Can a company claim ₹10 lakh or ₹1 crore automatically because the NDA says so?

No. Simply inserting a fixed amount does not mean that the entire figure will automatically be awarded. Sections 73 and 74 of the Indian Contract Act govern compensation for contractual breach and stipulated sums or penalties.

What is the limitation period for suing for breach of an NDA?

For a suit seeking compensation for breach of contract that is not specially provided for elsewhere, Article 55 of the Limitation Act, 1963 generally prescribes three years, running from the breach or according to the rules stated in Article 55 for successive or continuing breaches. The limitation analysis can differ depending upon the relief sought and facts of the breach, so businesses should not assume that every NDA claim has the same starting date.

What should a business do when it discovers an NDA breach?

The business should immediately preserve evidence, identify precisely what confidential information has been compromised, restrict further access where possible, review the NDA and other relevant agreements, and obtain advice on appropriate interim and final remedies. Delay can make urgent injunctive relief more difficult.

Final Takeaway

An NDA should protect information—not create a vague promise that nobody fully understands.

For most businesses, the strongest NDA is one that identifies the information worth protecting, limits its use to a defined commercial purpose, controls who can access it, creates practical security obligations and provides workable remedies if something goes wrong.

It should also respect an important boundary in Indian law: protecting confidential information is different from preventing someone from lawfully carrying on a profession or business.

That distinction can determine whether an NDA protects the company when it matters—or whether an important restriction becomes difficult or impossible to enforce.