Should you sign an NDA before sharing your business information

Your developer has asked to see the product architecture. A supplier wants your pricing before they will quote. An investor has replied to your cold email and wants the pitch deck by Friday. These are the moments when a question you have been putting off surfaces: should we ask for an NDA before we share anything?

The options are not as simple as "sign" or "don't sign". There is a timing decision, because an NDA signed after the deck has been emailed protects less than one signed before. There is a direction decision, because a one-way NDA and a mutual NDA create very different obligations. And there is a scope decision, because an NDA only deals with confidentiality, and some of the information you are about to share, such as personal data or work created for you, raises issues an NDA cannot fix. On top of all that, an obligation of confidence can sometimes exist without any signed document at all, which makes the "do we even need one" question more subtle than it looks.

Five questions to weigh before you sign

Work through these factors in order. Together they point to whether an NDA is worth asking for, and what it needs to say if it is.

How much would it hurt if the information got out

Start with the information itself, not the paperwork. If it became public tomorrow, or landed with a competitor, would it damage your ability to compete, reduce the value of your business, or create legal or regulatory exposure? If the answer is no, an NDA is mostly overhead. If the answer is yes, the cost of asking for one is small compared with the damage a leak can do. For most small businesses, the information worth protecting is not a patent-level invention. It is the practical commercial detail that makes the business work:

Supplier pricing and payment terms: often more commercially sensitive than founders realise, because a competitor can undercut you with the same numbers.
Customer lists and sales pipeline: lose value fast if a rival can see who you are pitching, at what price, and where the deals stand.
Source code, algorithms and system architecture: the technical core of a software business, and hard to put back in the box once copied.
Product roadmaps and launch timing: a first-mover advantage can be gone before you ship if the plan is public early.
Internal playbooks and workflows: the "how" behind your delivery is what makes your service hard to replicate.

The other side of the coin is that not every conversation needs an NDA. Overusing them creates friction in negotiations, and it can signal that you have not actually thought through what is confidential. A useful test is whether the information is genuinely not already known, or easily worked out, by others.

Who is on the other side of the table

The counterparty determines both whether an NDA is realistic and what shape it should take. The practical landscape looks like this:

Contractors, developers and agencies: sign before you send documents or share screens. This is the most common early-mistake scenario, because the work feels informal and the information flows freely while the relationship is being built.
Investors: many professional investors will not sign early-stage NDAs, because they see hundreds of deals and want to avoid conflict questions. The workaround is staged disclosure, where you keep early materials high level and hold back the genuinely proprietary detail until there is real mutual interest.
Partners, joint ventures and integration counterparts: both sides usually disclose, so a mutual NDA is the normal shape. Each party wants the other bound to the same standard.
Suppliers and manufacturers: one-way NDAs are a reasonable baseline when your designs, packaging, specifications or process documents flow to them, but they do not remove every risk of copying or onward disclosure.
Buyers in a sale or acquisition: NDAs are standard before due diligence, because financials, contracts, customer details and supplier terms are valuable even if the deal never completes.

If you are the one being asked to sign, the same factor works in reverse. The question is what the other side has that you might end up responsible for, and whether their obligations to you are matched by yours to them.

What the NDA can and cannot do

An NDA creates agreed rules about what information is protected, who can access it, for what purpose, and for how long. It is a confidentiality document, and nothing more. Three limits are worth naming, because each one is a common source of disappointment:

Intellectual property: Under s 35 of the Copyright Act 1968 (Cth), the author of an original work is the first owner of the copyright in it. An exception applies to works made by an employee in the course of their employment under a contract of service, which belong to the employer. A contractor who builds your app, writes your copy or designs your brand owns the copyright in that work unless there is an agreement assigning it to you. An NDA does not assign anything. If someone is creating assets for your business, you need a services agreement with an IP assignment clause, with the NDA sitting alongside it.
Personal information: If your confidential information includes names, email addresses, purchase histories or other personal information, privacy law applies on top of confidentiality. Where an overseas recipient is involved, Australian Privacy Principle 8 of the Privacy Act 1988 (Cth) requires an entity to take reasonable steps to ensure the recipient does not breach the Australian Privacy Principles, and s 16C of that Act can treat the overseas recipient's conduct as a breach by the entity that disclosed the information. An NDA does not answer any of that, and it does not replace the consent and notice obligations that attach to the data itself.
Your own people: An NDA binds the counterparty. It does not, by itself, stop your own staff from walking out with customer lists or process documents. Confidentiality obligations for employees belong in employment contracts and workplace policies, alongside any post-employment restraints that are appropriate.

What the terms actually say

If the other side has sent you an NDA, the details decide whether it protects you or just looks like it does. Before signing, check the following:

One-way or mutual: a one-way NDA protects only the party disclosing; a mutual NDA protects both. Mutual is the norm when both sides will share information, one-way when only you are disclosing. If you are disclosing and the other side is not, a mutual NDA can quietly create obligations for you that you do not need.
The permitted purpose: the clause that defines why the other party can use your information, such as "to evaluate a potential partnership" or "to provide software development services". If it is too broad, the other side can argue almost any use was allowed. If it is too narrow, it becomes impractical and accidental breaches follow.
How long confidentiality lasts: some NDAs fix a term of years from disclosure, others tie it to the information becoming public through no fault of the recipient. Match the duration to the information. A product roadmap goes stale quickly. A manufacturing formula or customer database can stay valuable for years.
What counts as confidential information: the definition should cover the formats you will actually use, written, oral and electronic, and should make clear what happens to information the other side already had. A definition so broad that everything is confidential is unworkable, and so is one that accidentally captures the other side's pre-existing knowledge.
Carve-outs and onward access: standard exceptions for information that is already public, was already known to the recipient, is independently developed, or must be disclosed by law are normal. But "already known" should not be a loophole that can be claimed without evidence. Check whether the recipient can pass your information to subsidiaries, advisers or subcontractors, and whether those people are bound to the same standard.
What happens on breach: the remedies should be practical. An NDA can give you the right to seek urgent court orders, injunctions, to stop a disclosure before it does its damage, plus an obligation on the other side to return or destroy the information. Some NDAs include a pre-agreed damages figure, but a clause that operates as a penalty rather than a genuine pre-estimate of loss can be struck down as unenforceable, as the High Court confirmed in Paciocco v Australia and New Zealand Banking Group Ltd [2016] HCA 28. A large, arbitrary figure can give a false sense of security.

Timing: before or after you disclose

The most common mistake is signing after the key information has already gone out. An NDA signed afterwards can still govern ongoing discussions, but it cannot un-send an email, and your negotiating position is weaker once the other side already has what it wanted. Make the NDA part of your process, not a response to a problem: "happy to share the detail once we have an NDA in place" is a normal, low-friction line in most business conversations.

If you never sign anything, all is not lost. Australian courts recognise an equitable obligation of confidence where information with the necessary quality of confidence is disclosed in circumstances importing an obligation of confidence, as discussed in Corrs Pavey Whiting & Byrne v Collector of Customs (Vic) [1987] FCA 433. But an implied obligation is harder to prove after the fact than a signed document is to point to. You would need to establish what was said, when, by whom, and that the circumstances clearly imported an obligation of confidence. That is why the practical answer is not to rely on the implied duty, but to use it as a backstop while an NDA does the heavy lifting up front.

When an Artificer Legal lawyer should review your NDA

The two situations where a lawyer's input pays for itself are signing someone else's NDA and relying on an NDA as your only protection. When you are the recipient, an Artificer Legal lawyer will read the terms against your actual use of the information, push back on obligations that are stricter than you can practically comply with, and make sure the permitted purpose matches the real conversation rather than something broader. When you are the discloser, a lawyer will check that the definition of confidential information captures what you are actually sharing, that the carve-outs do not swallow the protection, that the duration matches the value of the information, and that any damages clause is enforceable rather than penalty-style. We also draft the documents that sit around the NDA, including services agreements with IP assignment, privacy schedules for personal information, and employment confidentiality clauses, so the confidentiality piece is not standing alone.

The decision that costs the most is not whether to sign an NDA, but when. Once the deck has been emailed and the spreadsheet shared, the document you sign afterwards governs only what happens next. Information that has already left the building cannot be recalled by a signature. So treat the NDA as a pre-disclosure step in your process, agreed before you hand over anything that would genuinely hurt your business if it got out, and not as a cleanup task for conversations that have already happened.

The rest follows from that rule. Weigh what the information is worth, who is on the other side, and what the terms actually say before you commit. Remember that an NDA protects confidentiality only: it does not assign intellectual property, it does not fix privacy compliance when personal information is involved, and a pre-agreed damages figure can be unenforceable if it operates as a penalty. For contractor work, pair the NDA with a services agreement that assigns the IP. When personal information crosses borders, check the obligations under the Privacy Act 1988 (Cth). And when the terms are coming from the other side, have a lawyer look at them before you sign, because the differences between a one-way and a mutual NDA, and between a workable and an unworkable permitted purpose, are where most disputes start.