Every business holds information that is worth more kept private than shared: a customer list, a pricing model, a manufacturing process, an unlaunched product design. Sharing that information is often unavoidable. A founder pitching an app to a developer, a manufacturer briefing a potential supplier, or a business walking a prospect through proprietary technology all have to reveal something valuable before any formal deal exists. A non-disclosure agreement (NDA) is the standard tool Australian businesses use to make that moment safe. The party handing over the information, the discloser, receives a promise from the other party, the receiver, not to disclose it to anyone else or use it beyond the purpose of the discussion.
An NDA is a contract, and like any contract its effectiveness depends on what it says, who signs it and what a court will do if it is broken. It does not lock the information away on its own. This article explains how an NDA works in practice: when one is used, the clauses that do the real work, what happens when it is breached, and the limits that make an NDA less effective than most people assume.
When an NDA comes into play
NDAs are most useful before a formal relationship exists. They are common at the start of negotiations for a joint venture, a licensing deal, a manufacturing arrangement or an acquisition, and whenever a business has to show its hand to be evaluated: pitching an idea to a developer, sharing financials with an investor, or giving a prospective partner access to operations during due diligence. They are also used inside an existing relationship, for example in employment contracts, where the concern is that a departing employee will take client lists, pricing or know-how to a competitor.
Two parties sit on opposite sides of the agreement, and their interests pull in different directions. The discloser wants the receiver bound tightly, so that nothing said in the room can be repeated or reused. The receiver wants to be free to do its own job, which often means evaluating the information, comparing it with what it already knows, and developing its own competing ideas, without being sued for it. The two interests can be reconciled, which is why NDAs get signed at all, but the drafting has to strike the balance. A clause that binds the receiver too loosely protects nothing. One that binds too tightly will be resisted at the signature stage, and some parties, particularly institutional investors, routinely decline to sign NDAs at all.
What an NDA actually does
A well-drafted NDA does four jobs. It identifies what is confidential, it states what the receiver may and may not do with the information, it sets out the exceptions, and it gives the discloser practical remedies if the promises are broken. Each job is done by a specific part of the document.
The definition of confidential information
This is the clause the whole agreement turns on. If the definition is vague, the receiver can argue that what it did was outside the scope of the promise. Good definitions describe the categories of information covered, such as technical, commercial, financial and customer-related information, require the discloser to mark or identify information as confidential where practicable, and make clear that information is protected only while it retains the quality of confidence.
The courts enforce the definition as written, which is why it matters. In Optus Networks Pty Ltd v Telstra Corporation Ltd [2010] FCAFC 21, the parties' access agreement defined "Confidential Information" as all information of a confidential nature relating to the business of a party, and the dispute turned on whether particular traffic information fell within that definition and whether Telstra's use of it for marketing breached the agreement. The Full Federal Court confirmed that the contractual definition and the equitable duty of confidence operate side by side, so a discloser can rely on both at once.
The receiver's obligations
The obligations clause states what the receiver can and cannot do with the information:
- Non-disclosure: the receiver must not reveal the information to anyone outside the people who genuinely need it for the agreed purpose.
- Limited use: the information can only be used for the stated purpose, not for the receiver's own benefit or a competing project.
- Security: the receiver must hold the information securely and restrict access to it within its own business.
- Notification: the receiver must tell the discloser if the information is lost, or if it is used in a way that is not authorised.
- Return or destruction: when the purpose ends or the discloser asks, the receiver must return or destroy the material and confirm it has done so.
The exceptions
The exceptions clause lists what the receiver is allowed to do with the information despite the promises. It typically covers information already in the public domain, information the receiver independently developed, information received from a third party free of obligation, and disclosures required by law, such as a court order or a regulator's demand. A well-drafted clause goes further and requires the receiver to notify the discloser before making a compelled disclosure, so the discloser has a chance to protect its position. This is also the point at which a realistic NDA keeps the receiver honest: the document cannot override a genuine legal obligation, so pretending it can only creates a false sense of security.
The term and the remedies
The term clause fixes how long the obligations last. A fixed period of two to five years is common for commercial information, while genuine trade secrets may warrant obligations that last as long as the information remains confidential. The remedies clause preserves the discloser's right to seek an injunction, damages or an account of profits, and sometimes includes an indemnity for losses caused by a breach.
One-way or two-way
Before drafting anything, the parties need to decide who is actually disclosing. If only one side will hand over information, a one-way NDA is enough: the receiver owes the obligations and the discloser owes none. If both sides will exchange information, a mutual or two-way NDA is appropriate, with each party owing the same obligations in respect of the other's information.
The choice is easy to get wrong. Signing a one-way NDA when you are actually going to receive information too leaves your own material unprotected, and insisting on a mutual NDA when only you are disclosing gives the other side rights they do not need. The right answer follows from a simple question: who will leave the room knowing something they did not know before?
The protection that exists even without an NDA
An NDA is not the only source of protection for confidential information in Australian law. Equity has long recognised an action for breach of confidence, which applies even where no contract was signed. The action has three elements: the information must have the necessary quality of confidence, it must be imparted in circumstances importing an obligation of confidence, and it must be used without authorisation. The leading Australian statement of these elements is Smith Kline & French Laboratories (Aust) Ltd v Secretary, Department of Community Services and Health (1990) 22 FCR 73, which was applied in Optus Networks Pty Ltd v Telstra Corporation Ltd [2010] FCAFC 21.
This matters for the effectiveness question in two ways. First, an NDA converts a fact-sensitive equitable argument into a straightforward contractual claim: if the receiver signed, the discloser does not have to prove that the circumstances imported an obligation of confidence, only that the information was within the definition and was misused. Second, the equitable duty remains as a backstop. A recipient who never signed anything can still be liable if it knew the information was confidential and used it without authorisation, though proving that case is harder and the court will look closely at whether the information was truly confidential.
What happens when an NDA is breached
The enforcement sequence starts with detection, which is often the hardest part. A receiver that wants to cheat does not announce it. The breach may surface through a departing employee, a lookalike product from a competitor, or a document that appears in the wrong hands. Once a breach is suspected, the discloser typically has three options: demand that the conduct stop, seek urgent court orders, or sue for compensation.
Because a disclosure cannot be undone, the urgent remedy is usually an interlocutory injunction to restrain further disclosure or use before the case goes to trial. Courts grant these quickly where the information is genuinely confidential and the balance of convenience favours protection. In DXC Connect Pty Ltd v Deibe [2017] NSWSC 1159, the Supreme Court of New South Wales granted an interlocutory injunction restraining a former general manager from disclosing or using the employer's confidential information, and from working for a competitor in the interim, on the usual undertaking as to damages. The point of moving fast is simple: once information is out in the world, no order can put it back.
The springboard doctrine adds a further layer. A recipient who has used confidential information to get a head start in a market can be restrained from exploiting that advantage, even after the information would otherwise have entered the public domain. In DXC Connect, the court considered whether the doctrine justified restraining the former employee from working for a competitor beyond the contractual restraint period. The doctrine stops a wrongdoer from banking the benefit of a breach and then claiming the information had lost its confidential character.
If the matter reaches a final hearing, the remedies are damages or equitable compensation, an account of the profits the receiver made from the misuse, and orders for delivery up or destruction of the material. Two difficulties dominate in practice. Proving the breach can be hard, because internal use of information leaves few traces and the receiver will often have taken steps to hide it. And quantifying the loss is genuinely difficult, especially for a business that has not yet launched or won customers: the value of a leaked idea, a client list or a pricing model can be almost impossible to put a figure on, which directly affects what a court can award.
Where an NDA reaches its limits
An NDA protects information, not everything a business wishes were secret. Its limits are practical as well as legal.
- Information already public: an NDA cannot protect what is already in the public domain. In DXC Connect, the strength of the employer's claim was substantially undermined because a significant amount of the client and revenue information at issue was already public. Before disclosing, ask whether the information is genuinely confidential, and keep in mind that information which has leaked, been published, or become generally known in the industry cannot be made secret again by signing a document.
- Only the parties are bound: an NDA binds the parties to it. The receiver's employees, agents and related companies are not personally bound unless they sign or are otherwise covered, and a stranger who independently obtains the information owes no obligation. This is why employment contracts, and clauses that make the receiver responsible for its personnel, matter: they close the gap between the entity that signed and the individuals who actually handle the information.
- Statutory carve-outs: an NDA cannot override the law. The whistleblower protections in s 1317AB of the Corporations Act 2001 (Cth) provide that no contractual or other remedy may be enforced against a person for making a disclosure that qualifies for protection, and that a contract cannot be terminated because of such a disclosure. A clause that tries to gag a genuine whistleblower is, to that extent, unenforceable. The same principle applies to disclosures the law compels: a confidentiality clause does not excuse a failure to answer a court order or a regulator's lawful demand.
- The other side may refuse to sign: some parties will not sign an NDA at all. Investors who routinely see deal opportunities, and large counterparties with standard processes, often decline, on the basis that they cannot evaluate a proposal while bound by another party's definition of confidentiality. In that situation the NDA is off the table and the discloser must fall back on the equitable duty, which means controlling what is actually revealed, to whom, and in how much detail.
- Disclosure discipline: an NDA does not reduce the risk of disclosing too much. Best practice is to reveal only what the other party needs to evaluate the proposal, to keep sensitive documents marked and controlled, and to record what was shared and with whom. The most effective protection is often not a better clause but a smaller disclosure.
When to get a lawyer involved
A commercial lawyer is most useful at two points in the life of an NDA: before it is signed, and when a breach happens.
Before signing, a lawyer will review the definition of confidential information, the exceptions and the term, and will tell you whether the information you are protecting is actually protectable, which is a legal question about the state of the public domain and the nature of the information. If you are the receiver, a lawyer will check that the obligations do not accidentally stop you from doing ordinary business, such as using general knowledge, hiring staff or developing your own products.
When a breach happens, speed matters and a lawyer is usually the difference between getting an injunction and watching the information spread. A practitioner will assess whether the conduct is actionable, gather and preserve evidence, bring an urgency application where appropriate, and advise on what the claim is realistically worth, including the difficulty of quantifying loss for a business that is still building revenue.
The cost asymmetry is worth noting. A short review of an NDA before you sign, or a tailored NDA drafted for the deal, costs a fraction of what enforcement proceedings cost, and enforcement is the point at which the weaknesses in a badly drafted document become expensive.
The real work happens before the signature
The effectiveness of an NDA is decided at the drafting table and in the way the information is handled, not in the courtroom. Its real value is that it forces you to say, in writing, what is confidential, and it gives you a fast path to an injunction if the promise is broken. The businesses that get this wrong are usually the ones with a definition that protects nothing, a receiver that was never screened, or a disclosure that went further than it needed to. The businesses that get it right treat the NDA as one part of a broader discipline: identify what is confidential, share only what is necessary, choose the other party with care, and have a lawyer check the document before it is signed. If you have a draft NDA in front of you, or one you have signed, a review by an Artificer Legal practitioner can tell you quickly whether it will do the job you assume it does.