You have a pitch deck, a customer list or a prototype, and someone who wants to see it: a prospective investor, a manufacturer, a distributor or a contractor. Before the file is sent or the meeting happens, the other side produces an NDA, sometimes their own and sometimes yours, and asks you to sign. This is the moment most owners skim the document and sign, because the relationship feels more important than the fine print. The fine print is where the protection lives.
A non-disclosure agreement (NDA) is a contract that makes the recipient's duty to keep your information confidential express and enforceable. Australian law already protects confidential information in some situations through the equitable duty of confidence, which applies where the information has the necessary quality of confidence, is imparted in circumstances that import an obligation of confidence and is then used, or threatened to be used, without authority. That test comes from Coco v AN Clark (Engineers) Ltd [1969] RPC 41 and has been applied in Australia in cases such as Leica Geosystems Pty Ltd v Koudstaal [2012] FCA 1337. An NDA does not replace that duty. It converts it into a written contract with defined terms, defined carve-outs and contractual remedies, and it gives the disclosing party a clearer path to enforcement than relying on the equitable duty alone.
The clauses that actually protect your information
An NDA is only as strong as a handful of clauses. These are the ones to read carefully, whether you are sending your own agreement or reviewing one that arrived in your inbox.
What counts as confidential information
The definition clause is the foundation. Everything else hangs off it: if information falls outside the definition, the NDA does not protect it, whatever the rest of the agreement says. Draft it broadly, by category rather than by list, and make sure it covers:
- Form: cover information disclosed in any form, including written documents, emails, conversations, prototypes, samples, equipment, software and data.
- Marking: state that information is confidential whether or not it is labelled "confidential" or "private", because recipients will not mark everything they receive.
- Timing: cover information disclosed before the NDA is signed as well as after, since discussions often begin before the paperwork is finalised.
The confidentiality clause in the employment agreement considered in Leica Geosystems defined the protected information to include information "whether oral, written or recorded electronically", the breadth that closes the gaps a narrow list leaves open. The variant the other side pushes for is a definition tied to a schedule of documents. Information that is not on the list is unprotected, so a schedule-based definition should be resisted.
What the recipient can use it for
The purpose clause states why the information is being disclosed and limits the recipient to using it for that purpose. If the agreement has no purpose clause, the recipient may argue it can use the information for any purpose consistent with the relationship, including building a competing product. Describe the purpose as narrowly as you can without making the task impossible: "for the purpose of evaluating a potential investment" leaves less room than "for business purposes", and naming the transaction narrows it further. The drafting choice that matters is precision with workability. A purpose so restrictive that the recipient cannot perform its role will be negotiated away anyway.
What is not confidential
Exclusions are exceptions to the definition. Standard exclusions are:
- Public domain: information that is or becomes publicly available, other than through a breach of the NDA by the recipient.
- Independent development: information the recipient developed itself without using your confidential information.
- Third-party receipt: information the recipient received from a third party who was lawfully entitled to disclose it.
The agreement in Leica Geosystems contained the common carve-out for information "freely available to the public". Every exclusion is a door, and the fewer there are, the fewer arguments the recipient can run later. Watch for additions such as "information already known to the recipient" without any requirement that it was known independently, or "information disclosed by the recipient's advisers" without conditions. Make sure the public domain exclusion is qualified, so information does not lose protection simply because the recipient put it there in breach of the agreement.
Who owns the information
A clause stating that disclosing the information does not grant the recipient any ownership interest or licence in it. Without it, a recipient could argue that handing over documents or showing a prototype implied permission to use it. The clause should confirm that all intellectual property in the information stays with the disclosing party and that the NDA is not a licence, assignment or transfer of any rights. This matters most where the recipient is a manufacturer or developer who will work with the information and could otherwise claim a right to keep using it after the relationship ends.
Who the recipient can tell
Realistically, the recipient will need to share the information with its employees, directors, contractors and professional advisers such as lawyers and accountants. The permitted disclosure clause should:
- Limit the circle: allow disclosure only to people who need the information to perform the purpose.
- Bind the circle: require those people to be told of, and bound by, equivalent confidentiality obligations.
- Keep the recipient responsible: make the recipient liable if its people breach.
The trap is an unqualified permission. A clause that lets the recipient disclose to "its related entities and their officers and employees" without a need-to-know requirement means your information can circulate through a group of companies. Tie every permitted disclosure back to the purpose.
Disclosure the law requires
No NDA can stop a recipient who is legally compelled to disclose information: a court order, a subpoena, or a notice from a regulator such as ASIC or the ATO. What the clause should do instead is manage that disclosure:
- Notice: require the recipient to tell you promptly if it is required to disclose, so you can apply for an injunction or other order to protect the information. Australian courts do grant injunctions to restrain disclosure of confidential information, as in J W Mailing Services Pty Ltd v Fulton [2008] NSWSC 1421, where an interlocutory injunction was granted.
- Limit the disclosure: allow the recipient to disclose only the information actually required, and require it to cooperate with your efforts to protect the rest.
- Whistleblowers: confidentiality clauses cannot prevent qualifying whistleblower disclosures. Under s 1317AB of the Corporations Act 2001 (Cth), a person who makes a disclosure that qualifies for protection is not subject to civil, criminal or administrative liability for it, and no contractual remedy can be enforced against them on the basis of the disclosure. A well-drafted NDA states that it does not purport to override those protections.
- Personal information: if the material includes personal information about individuals, the recipient's use and disclosure of it is separately regulated by Australian Privacy Principle 6 of the Privacy Act 1988 (Cth), which restricts use or disclosure for a secondary purpose unless the individual consents or an exception applies.
How long the obligations last
The term clause sets how long the confidentiality obligations run. Two traps are common. The first is obligations that end when the agreement or the commercial relationship ends, which is often exactly when the risk is highest, because the recipient holds the most information at that point. The second is a fixed term that is too short for the information involved. For trade secrets, protection should continue while the information retains its confidential character rather than lapsing after a set number of years. The term should also cover the return or destruction of materials, and the obligations should survive termination expressly. In a mutual NDA, where both sides disclose information, the term and the exclusions apply in both directions, and it is worth checking that neither side's carve-outs are broader than the other's.
What happens on breach
The remedies clause sets out what the disclosing party can do if the recipient breaches. It should:
- Damages or profits: allow recovery of the loss caused by the breach, or of profits the recipient made from the information. The clause in Leica Geosystems expressly allowed recovery of "any loss sustained... or profit obtained" from use of the confidential information.
- Injunctions: preserve the right to seek urgent court orders to stop further disclosure and use, because damages alone rarely undo the damage once information is out.
- Costs: deal with recovery of the cost of enforcing the agreement.
Some agreements include an acknowledgment that a breach would cause irreparable harm for which damages are not an adequate remedy. That helps at the injunction stage, although injunctions remain discretionary and a court will weigh the balance of convenience between the parties. If a breach is discovered, the practical steps matter as much as the clause: preserve evidence of what was disclosed, note the date and channel of the disclosure, and get advice promptly, because delay can undermine an application for urgent relief.
Optional clauses worth adding when they fit
Not every NDA needs these, but each earns its place in a particular deal:
- Return and destruction of materials: include when the recipient will hold physical samples, prototypes or hardware, so everything must be handed back or destroyed, with a certificate, when the purpose ends.
- Non-solicitation: include when the recipient will learn the identities of your customers, suppliers or staff, so that information cannot be used to poach them if the deal falls over.
- No reverse engineering: add when you disclose software, equipment or products, to stop the recipient dismantling them to extract your know-how.
- Warranties about the information: when you are the recipient, ask for a warranty that the disclosing party owns the information and is entitled to disclose it.
- Governing law and jurisdiction: name the Australian state or territory whose law governs the agreement, so enforcement is predictable if a dispute arises.
When an Artificer Legal lawyer should look at your NDA
Most NDAs are short, but short agreements still decide who wins if the information leaks. An Artificer Legal practitioner reviewing an NDA would start with the definition and exclusions, because those determine what is actually protected, and would push back on schedule-based definitions and unqualified exclusions. We would check that the purpose clause is narrow but workable, that permitted disclosures are tied to a need to know, and that the legal compulsion carve-out handles court orders, regulators and whistleblower protections correctly. We would also make sure the term and remedies survive the end of the relationship, and that a one-way agreement is not being used where a mutual one is appropriate, such as in a joint venture where both sides disclose. If we were drafting from scratch, we would negotiate the clauses in that order: definition, exclusions, purpose, permitted disclosures, term, remedies, so that every concession is made against a clear picture of what the agreement still protects. A short review before you sign is far cheaper than an injunction application after the information has moved, and it is the point at which the agreement can still be changed.
The definition clause: where NDA disputes are won and lost
The single drafting choice that most often decides whether an NDA works is the definition of confidential information. If it is too narrow, everything downstream is moot: the recipient argues the leaked material falls outside the definition, and the purpose clause, exclusions and remedies never come into play. A broad, category-based definition that covers oral and electronic information, does not require marking, and extends to pre-signing disclosures is the difference between an agreement that protects you and a document that only looks like one.
Before you send information under an NDA, check that the definition is broad, the exclusions are few and qualified, the purpose is precise but workable, permitted disclosures are limited to people who need to know, and the term and remedies survive the relationship. If the agreement is the other side's, read the same clauses as if your business were the recipient, because every exclusion and permission in their draft is a boundary around what you may do with what you learn. An NDA that is signed without reading is not protection at all.