NDA

What it means

An NDA is a confidentiality agreement: the parties define which information is confidential, for what purpose it may be used, who it may be shared with, and how long the protection lasts. It can be one-way or mutual.

The exceptions matter - information that is public, that the recipient already held, or that must be disclosed by law is not protected. Without them the agreement is unenforceable.

An NDA is not the same as a trade secret under the Commercial Code. The law protects a trade secret only while its owner actively keeps it secret, and a confidentiality agreement is one piece of evidence that they do. An NDA can, however, also cover information that does not meet the trade secret definition, such as what was said in negotiations or the mere fact that the parties work together.

How it works in practice

It is signed before due diligence, before sending material into a tender, before investment talks, and when working with suppliers who will see internal data. It usually comes first, ahead of the letter of intent.

Where personal data is processed in the cooperation, an NDA is not enough: a data processing agreement under GDPR goes with it, and it addresses something quite different from trade secrets.

When a client switches accounting firms, we sign the NDA before the handover, so the previous accountant can pass on the records without concern. The agreement states expressly that the confidentiality duty survives the end of the engagement and binds every member of our staff who works with the records.

What to watch out for

An NDA with no stated purpose or term is hard to enforce and proves nothing in a dispute. And no agreement prevents a leak: protection is completed by access control and by handing over only the data the other side actually needs.

An NDA without a contractual penalty leaves the injured party with a damages claim, and in a dispute damages have to be proved both as to their existence and their amount, which after a leak is almost impossible. A court can reduce an excessive penalty, so it should reflect the value of the protected information, not the fear of a leak.