I Broke an NDA by Accident. What Can Actually Happen?

First, contain it

The most important step is to limit the disclosure straight away. Recall or retract the email where possible. Ask the recipient to delete the information and confirm in writing that they have not kept, forwarded or used it. Remove any shared files and change access permissions. The faster you act, the less harm is likely and the stronger your position if a dispute follows.

Check the NDA's notice clause

Many NDAs require you to notify the disclosing party promptly if you become aware of unauthorised disclosure. Failing to notify can be a separate breach and may look worse than the original accident. Read the clause, follow it, and keep the notice factual: what was disclosed, to whom, when, and what you have done to contain it.

What the other side could claim

Proving damages from a single accidental disclosure is often difficult, particularly if the information was quickly contained, not used and not valuable to the recipient.

• Damages: compensation for loss it can prove was caused by the breach, such as lost business.
• Injunction: a court order stopping further use or disclosure.
• Liquidated damages: a fixed sum set in the NDA, enforceable if it was a reasonable estimate of loss rather than a penalty.
• Attorney's fees, if the NDA provides for them.
• Termination of a related contract or relationship.

Intent usually does not decide breach

Most NDAs impose an obligation to keep information confidential, and many require you to use reasonable care. An accidental disclosure may still be a breach even though you did not intend it. Intent and your response can, however, affect the remedies a court grants and how the other side chooses to respond.

Trade secrets and misappropriation

If the information is a trade secret, the owner may also have claims under trade secret law. Misappropriation generally requires improper acquisition, or disclosure or use without consent by someone who knew or should have known of a duty of confidentiality. An accidental disclosure that is promptly contained, and not used, is far less likely to lead to a successful trade secret claim than deliberate misuse.

Employment consequences

If you are an employee, an accidental disclosure may lead to disciplinary action under company policies, separate from any legal claim. Report it through the proper internal channel, such as your manager, security or legal team. Concealing a mistake is often treated more seriously than the mistake itself.

Insurance

Businesses may have cyber or professional liability insurance that covers some disclosure incidents. Contractors with professional indemnity cover should check whether it applies and whether the insurer must be notified. Many policies require prompt notice and forbid admitting liability without the insurer's consent.

Personal data adds obligations

If the disclosure involved personal data, such as customer or employee information, privacy and breach notification laws may apply to the data owner. That can create regulatory obligations and costs for them, which increases the stakes. Tell the right people promptly so they can assess their notification duties.

A worked example

Kiara, a consultant, accidentally emails a client's pricing spreadsheet to another client with a similar name. She realises within ten minutes, asks the recipient to delete it and receives written confirmation. She notifies the first client the same day, explaining what happened and what she did. The client is annoyed but, seeing no evidence of use or loss, takes no further action beyond asking her to tighten her email process.

Sample notice wording

"I am writing to let you know that on 12 May, a file containing [description] was sent in error to [recipient]. I asked the recipient to delete it, and they confirmed in writing at 3:40 pm that they deleted it without forwarding or using it. I have [steps taken to prevent recurrence]. I am happy to discuss any further steps you would like me to take."

Common mistakes

• Waiting or hoping no one notices.
• Failing to follow the NDA's notice requirement.
• Admitting liability or agreeing to pay without advice.
• Not getting written confirmation of deletion.
• Ignoring insurer notification requirements.

Quick checklist

• Have you contained the disclosure?
• Does the NDA require notice, and have you given it?
• Do you have written confirmation of deletion?
• Did the disclosure include personal data or trade secrets?
• Should you notify your insurer?
• Have you recorded what happened and what you did?

Key terms explained

These terms help explain the risk after an accidental disclosure.

• Breach: failing to meet an obligation in the contract.
• Injunction: a court order requiring someone to do or stop doing something.
• Liquidated damages: a pre-agreed sum payable for a breach.
• Misappropriation: wrongful acquisition, use or disclosure of a trade secret.
• Notice clause: an obligation to tell the other party about a breach or incident.

If the other side sends a demand letter

A demand letter may allege breach, demand payment or require you to sign a declaration or undertaking. Do not sign anything or pay immediately. Read what is being demanded, check what the NDA actually says about remedies, and consider a lawyer's review, especially if the letter mentions liquidated damages, an injunction or trade secret claims. Reply calmly and factually, confirming the steps you took. Many disputes over accidental disclosures end with a written undertaking to delete and not use the information.

Preventing it happening again

Being able to show these measures helps if the other side asks how you will prevent a recurrence.

• Turn off email autocomplete for sensitive recipients, or add a delay before sending.
• Use separate folders and naming conventions for each client.
• Check your screen before sharing it, and close unrelated windows.
• Use access-controlled links rather than attachments for sensitive files.
• Limit who on your team has access to each client's information.

The cost of saying nothing

It can be tempting to stay quiet about a small slip. But if the other side finds out later, the lack of notice can turn a minor incident into a serious breach of trust and a stronger legal claim. Prompt, honest notice with evidence of containment is usually the lowest-risk path.

When the recipient refuses to delete

If the person who received the information refuses to delete it or confirm they have not used it, tell the disclosing party immediately. The owner of the information may have stronger rights against that recipient, including trade secret claims, and acting early improves the chances of an injunction.

Questions to answer before you notify

Record what was disclosed, to whom, when, how you discovered it, what the recipient confirmed, and what you have changed. Clear answers make your notice credible and short.

Act fast, then review your NDAs

Most accidental disclosures are manageable if handled quickly and honestly. If you are unsure what your NDA requires, upload it to see its notice, remedies and liquidated damages terms explained plainly. For a serious incident, speak to a lawyer.