Non-Disclosure Agreement (NDA)

An NDA is often the first legal document signed before a business conversation goes deep — before you share your product roadmap with a potential investor, before you bring a vendor inside your supply chain, before an M&A data room opens. Get it right, and your confidential information stays protected throughout. Get it wrong — vague definitions, missing carve-outs, no remedy clause — and you hold a document that looks protective but will not survive scrutiny when it matters most.

India's Specific Relief (Amendment) Act 2018 made injunctions significantly easier to obtain for contractual breach, so a well-drafted NDA today is genuinely enforceable, not just a paper deterrent. Add the Digital Personal Data Protection Act 2023 (DPDP Act) now in active compliance phase for FY 2026-27, and NDAs that touch personal data carry obligations most off-the-shelf templates still miss entirely. For FY 2026-27, a properly calibrated NDA is both a business tool and a compliance checkpoint.

At a Glance

• Who needs it: Any party disclosing confidential information — founders, companies, employers, investors, JV partners, vendors, and technology licensors
• Forms available: Unilateral (one-way) or bilateral (mutual); standalone for a single transaction or a master NDA covering multiple engagements between the same parties over time
• Governing law: Indian Contract Act 1872; Specific Relief (Amendment) Act 2018 for remedies; DPDP Act 2023 where personal data is involved in the disclosure
• Turnaround: Standard template — same day; bespoke drafted NDA — 2–5 working days; with counter-party negotiation rounds — 3–7 working days
• Enforcement options: Injunction, actual damages, liquidated damages, and criminal action under BNS 2023 or IT Act 2000 for egregious cases
• Stamping: Nominal stamp duty (₹100–₹500 in most states); e-signed NDAs valid under IT Act 2000 Section 5

What's New for FY 2026-27

Several developments this financial year change what a sound NDA should contain — particularly around personal data, digital execution, and criminal remedy references.

• DPDP Act 2023 in active compliance: NDAs involving personal data — customer records, employee information, patient data — now need an integrated data-sharing clause or addendum covering purpose limitation, data minimisation, and deletion obligations. Treating such disclosures purely as a confidentiality matter is no longer sufficient under the current regulatory framework.
• 'Independent development' carve-out tightened: Recent High Court decisions have required parties to define what 'independent development' means in their specific context. Generic boilerplate language creates an easily exploited gap; your NDA should specify the standard of proof expected from the receiving party.
• Cross-border liquidated damages: RBI's updated FEMA position means USD-denominated liquidated damages clauses between Indian parties need RBI-compliant drafting — otherwise the clause may be unenforceable as written, particularly for amounts exceeding repatriation thresholds.
• E-signature method now specified: MCA's updated guidance confirms Aadhaar e-sign, DSC, and recognised platforms such as DocuSign and SignDesk are all valid under IT Act 2000 Section 5. NDAs should now specify which signature method is accepted to prevent execution disputes.
• BNS 2023 replaces IPC: NDAs that cited IPC provisions for criminal breach of trust (old Sections 405–409) should be updated to reference the corresponding BNS 2023 sections — outdated IPC references weaken the criminal-route argument before courts and prosecutors.

Who Needs an NDA Before Sharing Information

An NDA protects confidential information at the moment of maximum risk — when you are deciding whether to do business together but neither party has fully committed.

• Founders & investors: Before you share financials, cap table, or product roadmap with an angel investor or VC, an NDA sets the rules of engagement. Not every investor will sign before a first conversation, but when they will, the document should be precise about what is protected and how long the obligation runs.
• M&A due diligence: Both buy-side and sell-side parties need NDAs before the data room opens. Clean-team arrangements — restricting access to competitively sensitive HR or pricing data to a designated sub-group — sit inside the M&A NDA as a separate schedule or addendum.
• Employment & contractors: Anyone with access to customer lists, source code, pricing strategy, or trade secrets — from senior executives to freelance developers — needs a confidentiality clause in their engagement contract or a standalone NDA before their access begins.
• Vendor & supplier relationships: Vendors who see your production processes, cost structures, or customer data carry confidentiality risk from day one of onboarding. A vendor NDA signed before work begins, not after a problem surfaces, is the correct sequence.
• Technology partners & integrations: API documentation, architecture diagrams, and integration specifications should be covered by an NDA before technical discussions go into detail. This is especially important in SaaS, fintech, and health-tech contexts where the architecture is the product.
• Pharma, biotech & IP-heavy sectors: Clinical data, formulation records, and regulatory filings are the kind of confidential information that is genuinely difficult to put back once disclosed. Sector-specific NDAs for these areas require careful definition of what constitutes a permitted use versus a material breach.

How It Actually Works

NDA drafting follows a structured sequence covering both the initial document and the ongoing obligations it creates between the parties.

Step 1: Brief & Relationship Mapping

Before drafting begins, we map the relationship: who discloses, who receives, the purpose of sharing, the categories of information involved, and the risk profile of the engagement. Unilateral versus bilateral is decided at this stage. We also determine whether personal data will be shared — that triggers DPDP Act addendum drafting from the outset, rather than as an afterthought.

Step 2: Choosing the Right NDA Structure

Standalone NDAs cover a single transaction or relationship. Master NDAs cover ongoing disclosures between the same parties across multiple engagements over a set period — useful for long-term vendor relationships or advisory retainers. For M&A, a separate clean-team NDA is layered over the main agreement to control which individuals on each side can access competitively sensitive material. We recommend the right structure based on your specific use case and the likely volume of future disclosures.

Step 3: Drafting the Core Clauses

The NDA is built around six clauses that carry the real protective weight: the definition of confidential information (specific categories listed, not just 'all information shared'), permitted use (the exact purpose for which information can be used), permitted recipients (who inside the receiving party can see the information and what obligations bind them), term (how long confidentiality survives after the agreement ends), return and destruction (what happens to the information at the end of the engagement), and remedies (what the disclosing party can actually do if there is a breach). Each clause is drafted with enough specificity to hold up in enforcement proceedings.

Step 4: Counter-Party Negotiation

Counter-parties typically push back on the scope of the confidential-information definition, the breadth of carve-outs, and the term length. We review each mark-up and advise what to accept, what to resist, and what to counter. Changes that look minor — broadening the independent-development carve-out, removing liquidated damages, softening the permitted-recipients clause — can significantly weaken your protection. We flag every such concession before you agree to it.

Step 5: Execution & Stamping

NDAs are executed by the authorised signatories of each party. Stamp duty is nominal in most Indian states — typically ₹100–₹500. E-signed NDAs are valid under IT Act 2000 Section 5, and we guide you on the right signature method — Aadhaar e-sign, DSC, or a recognised e-signature platform — and the counterpart-exchange process where both parties sign separate copies that together form the binding agreement.

Step 6: Post-Signature Compliance

The NDA's practical value after signing depends on the receiving party honouring its obligations internally. We provide a post-signature compliance note covering who within the receiving organisation can access the disclosed information, how to track and document what was shared and when, and how to respond if you suspect a breach. This documentation is your evidence base if enforcement becomes necessary later.

Step 7: Breach Response

If a violation occurs, the response is calibrated to severity. A formal legal notice citing the specific clause and the information disclosed is typically the first step. Ongoing or threatened disclosure calls for an injunction application under the Specific Relief (Amendment) Act 2018 — the 2018 amendments substantially strengthened the court's power to enforce negative covenants. Egregious cases — deliberate trade-secret theft or criminal data misuse — may warrant a complaint under BNS 2023 or the IT Act 2000 in addition to civil proceedings.

A Real Example: SaaS Company, M&A Due Diligence, Mumbai PE Firm

A Pune-based SaaS company was in early acquisition discussions with a Mumbai PE firm that wanted to examine product architecture, customer contracts, and revenue data before making an offer. Here is how the NDA was structured.

• NDA type: Bilateral mutual NDA — both the SaaS company and the PE firm were sharing sensitive strategic material during the process, making a unilateral structure the wrong call
• Confidential information defined: Source code and architecture documentation; customer contracts and customer personal data; revenue data and pricing; employee headcount and compensation — each category listed as a separate line item, not grouped under a catch-all phrase
• Clean-team clause: Only four named individuals on the PE side were permitted to access HR and compensation data; this was structured as a separate schedule to the main NDA with its own signature block
• DPDP addendum: Customer personal data in the data room triggered a data-sharing addendum specifying that the PE firm could use it only for acquisition-evaluation purposes and must delete or certify destruction within 30 days of discussion termination
• Term: Three years post-termination for commercial information; source code and trade secrets protected indefinitely with no sunset date
• Remedies: Injunction plus ₹75 lakh liquidated damages per breach, with actual damages recoverable in addition to the LD amount — not as an alternative to it

The NDA was signed, countersigned, and stamped before the data room was shared. The PE firm's mark-ups required two rounds of negotiation; the clean-team clause scope and the liquidated-damages quantum were the primary sticking points. Final execution took seven working days from the initial brief to a signed, stamped, execution-ready document.

What Makes Each NDA Clause Actually Enforceable

An NDA clause only performs when it is backed by specificity and, where relevant, documentation. Courts enforce what is clear and provable — not what was intended.

• Definition clause: Must name categories of protected information — 'trade secrets, customer lists, financial projections, source code' — not merely 'all information shared.' Courts read down overbroad definitions to what is genuinely confidential, which may be narrower than you intended when you signed.
• Permitted-use clause: 'Business discussions' is too vague to enforce against a specific set of facts. 'Evaluation of a potential acquisition of [Company Name] by [Acquirer Name] for the period ending [Date]' gives a court something concrete to apply.
• Permitted-recipients clause: The chain of confidentiality must hold all the way down. The recipient organisation's employees and advisors who access the information must be bound by their own written obligations — an unbroken chain from the NDA to the individual who reads the material.
• Term clause: Must explicitly state that confidentiality obligations survive termination of the agreement. Where the NDA is silent, courts imply a reasonable period — which may be shorter than the information's commercial life and is unpredictable.
• Return / destruction clause: Must include a mechanism: written certification of destruction, a specific return deadline, and a data-deletion protocol covering electronic copies including backups. A vague 'shall return or destroy upon request' clause gives you almost nothing to enforce.
• Remedies clause: The clause should state that monetary damages alone are inadequate to compensate for breach and that injunctive relief is an appropriate remedy — this is the trigger language that supports a Specific Relief (Amendment) Act 2018 application in court.

Every NDA is as enforceable as the specificity of its definitions and the unbroken chain of its confidentiality obligations — not as strong as the paper it is printed on.

Common NDA Mistakes That Cost Disclosing Parties Protection

Most NDA failures trace back to drafting shortcuts taken when the relationship felt low-risk and the parties were eager to move on to the substantive conversation.

• Definition too broad: 'All information shared in any form' — courts read this down to genuinely confidential information only. List your categories explicitly; name what matters to you.
• No permitted-recipients clause: The receiving company is bound, but its employees and advisors are not. The chain of confidentiality breaks at the first person who reads the material and is not personally obligated.
• 'Public domain' carve-out without qualification: The carve-out should read 'information that enters the public domain through no act or omission of the recipient.' Without those words, a party who leaks information can argue it is now public and therefore falls outside the NDA's protection.
• No return or destruction obligation: At the end of the relationship, the receiving party retains all copies indefinitely with no contractual obligation to return or delete — defeating the purpose of a time-limited term.
• Governing law defaulted to foreign jurisdiction: An Indian party who signs an NDA governed by English law or Delaware law faces real difficulties enforcing it in Indian courts. Governing law should be India; the dispute-resolution clause should name a specific Indian venue.
• Trade secrets on a short term: Terms of 2–3 years chosen for negotiating convenience expire well before strategic information loses its commercial value. Match the term to the actual risk-tail of what you are protecting.
• DPDP blind spot: Personal data shared under a general confidentiality clause — with no purpose-limitation or retention obligation — creates direct regulatory exposure under the DPDP Act 2023, separate from and in addition to any contractual breach.
• No liquidated damages clause: Without a pre-agreed damages figure, proving actual financial loss from a confidentiality breach in court is expensive, time-consuming, and often uncertain. A proportionate LD clause is the practical fallback.

What You Receive at the End

• Bespoke NDA draft — bilateral or unilateral — tailored to your specific use case, information categories, and risk profile
• DPDP Act 2023 data-sharing addendum where personal data is involved, covering purpose limitation, data minimisation, and deletion obligations
• Clean-team NDA rider for M&A engagements, specifying which named individuals on each side can access sensitive sub-categories of information
• Post-signature compliance checklist covering internal need-to-know protocols, document-tracking practice, and breach escalation steps
• Negotiation support memo marking which counter-party changes to accept, resist, or counter — with the reasoning behind each position
• Stamp duty and execution guidance note for the specific states and signature methods involved
• Master NDA template for clients with ongoing multi-engagement relationships with the same counter-parties
• Breach-response letter template for immediate use if you discover a confidentiality violation after execution

How to Get Started

Share the basics through our intake form: which party is disclosing, which is receiving, what type of information is being shared, the purpose of the disclosure, and whether any personal data is involved. For standard use cases — vendor onboarding, employment, investor deck sharing — a draft NDA is ready the same day. For M&A, JV exploration, or cross-border engagements, plan for three to seven working days depending on complexity and how many rounds of counter-party negotiation are needed.

If the counter-party has already sent their standard NDA, upload it along with any prior agreements between the parties and your own confidentiality classification if you have one. Our team reviews the full picture before drafting starts, so the document we produce addresses your actual risk profile and the specific weaknesses in whatever the other side has proposed. You will have a legally reviewed, execution-ready NDA before any confidential information changes hands.