Confidentiality clause: what it covers and common traps

A confidentiality clause, or a standalone non-disclosure agreement, restricts what a receiving party can do with information the disclosing party shares. It does three jobs: it defines what is protected, it obliges the recipient to keep it secret and use it only for a permitted purpose, and it carves out what is not caught.

A confidentiality clause inside a contract and a standalone NDA do the same work; the clause is the embedded version. Either way, the drafting choices are identical, and identical in where they fail.

Reading a confidentiality clause means checking each of the following elements in turn.

• Definition of Confidential Information: is it broad, covering everything disclosed, or narrow, covering only material marked confidential?
• Permitted purpose: can the recipient use the information only for the deal, or more widely?
• Obligations: keep it secret, limit access to those who need it, and do not copy it beyond need.
• Exclusions: information that is in the public domain, already known, independently developed or lawfully received from a third party.
• Permitted disclosures: to advisers, or when compelled by law or a regulator.
• Duration: how long the obligation lasts after the contract ends.
• Return or destruction: what happens to the information when the relationship ends.

The most-fought element is not the obligation: it is the definition. A clause that protects all information disclosed is easy to breach accidentally and hard to enforce precisely; one that protects only information marked confidential is clean but fails the moment someone forgets to mark something. Which way you draft depends on which risk your client can least afford.

Illustrative only, to show the structure, not a precedent to drop into a live agreement:

"The Receiving Party shall keep the Confidential Information secret and confidential, shall use it solely for the Permitted Purpose, and shall not disclose it to any person except to those of its Representatives who need to know it for the Permitted Purpose and who are bound by equivalent obligations of confidence. This clause does not apply to information that is or becomes public through no breach of this agreement, was lawfully known to the Receiving Party before disclosure, or is independently developed without reference to the Confidential Information."

The exclusions in that second sentence are doing as much work as the obligation in the first.

Five drafting failures recur, and any one of them can leave the clause unable to do its job when it is tested.

• No exclusions. Without carve-outs for public-domain and independently developed information, the recipient is technically in breach for using knowledge it already had or that everyone knows. Courts dislike enforcing that, and its absence signals sloppy drafting.
• A duration that is too short, or perpetual. Trade secrets may warrant an indefinite obligation; ordinary commercial information usually does not, and a perpetual blanket obligation can be commercially unworkable and harder to enforce. Match duration to the sensitivity.
• No permitted-disclosure carve-out for law and regulators. A recipient compelled by a court or regulator to disclose must be allowed to, or the clause forces them to choose between two breaches.
• Silence on advisers. Recipients need to share information with their lawyers, accountants and funders. A clause that forbids all onward disclosure is impractical and gets ignored.
• No return-or-destruction mechanism. When the deal dies, what happens to the copies? Without a clause, they sit on the recipient's systems indefinitely.

If information you care about leaked tomorrow, does this clause let you prove it was covered, that the disclosure was not permitted, and that the obligation was still live? If any of the three is shaky, the clause will not hold.

What is a confidentiality clause? A contractual provision that requires a party receiving information to keep it secret, use it only for an agreed purpose, and not disclose it beyond permitted recipients, with defined exclusions for information that is public or already known.

What is the difference between a confidentiality clause and an NDA? None in substance. An NDA is a standalone agreement dedicated to confidentiality; a confidentiality clause is the same protection embedded within a larger contract. The drafting considerations are identical.

How long should a confidentiality obligation last? It should match the sensitivity of the information: ordinary commercial information for a defined period after the contract ends, genuine trade secrets potentially for longer. Perpetual blanket obligations can be commercially awkward and harder to enforce.

What are typical exclusions from confidentiality? Information that is or becomes public through no breach, was already lawfully known to the recipient, is independently developed without using the confidential information, or is lawfully received from a third party.

A confidentiality clause rarely arrives alone. On a transaction it arrives as thirty NDAs signed with different counterparties over several years, each with its own definition, duration and carve-outs. LegalAI Space's Document Review grid takes those documents as rows and a question as a column, such as how long the confidentiality obligation survives termination, and returns an answer for each document with the passage it was taken from and a link that opens the document at that passage. Reading down the column shows which agreements are perpetual, which expire, and which say nothing.

The grid answers the questions you ask and only those; whether a given definition suits the sensitivity of the information is still the lawyer's call. The Document Review page describes the grid, the playbooks and what each cell contains, and the workflow Review an NDA against the board minutes shows a confidentiality agreement being read against the other documents in the matter. Both are linked below.