5 Red Flags to Check Before You Sign an NDA

1. An overbroad definition of "Confidential Information"

The definition clause decides how much of your life the NDA reaches, so read it first. A fair definition covers information that is actually marked confidential or that a reasonable person would understand to be secret: product plans, customer lists, pricing, source code. A risky one says something like "any information disclosed in any form, whether or not marked confidential." Under language that broad, a hallway comment or a casual email thread counts, and you can breach the agreement without ever realizing the information was protected.

The fix is narrowing. Ask for a requirement that written material be marked confidential, and that anything shared orally be summarized in writing within 30 days to keep its protected status. Companies use this language all the time; a counterparty who refuses any narrowing is telling you they want the ambiguity.

2. Missing standard exclusions

Every professionally drafted NDA excludes four categories: information that is already public, information you knew before the disclosure, information you develop independently without using theirs, and information you receive lawfully from a third party. These exclusions exist because you cannot realistically keep a secret that is not one.

When they are missing, the practical effect is ugly. Suppose the other side "discloses" a marketing tactic that is described in a dozen trade publications. Without the public-information carve-out, they can argue you learned it from them and are now restricted from using it. A fifth exclusion worth adding: disclosure required by law or court order, with notice to the other party so they can seek protection. If any of the four standard exclusions is absent, add it before you sign, and treat the omission itself as a signal about how the relationship will go.

3. Perpetual duration

Some NDAs never expire. For genuine trade secrets, indefinite protection is legitimate, a secret formula stays a secret for as long as it is one. For ordinary business information, courts in many states are skeptical of perpetual confidentiality, and some have refused to enforce it, reasoning that stale business information eventually loses any value worth protecting.

The market standard for ordinary confidential information is a defined term, most commonly 2 to 5 years from disclosure or from the end of the relationship. A clean structure many lawyers use: a fixed term for general confidential information, plus a carve-out saying trade secrets remain protected for as long as they qualify as trade secrets under applicable law. That gives the discloser what they legitimately need without binding you forever.

4. A residuals clause

A residuals clause says the receiving party may freely use "residuals," meaning information retained in the unaided memory of people who had access to your confidential information. Read that again: anything their engineers remember after reading your materials, they can use. No photocopying required.

For the party disclosing valuable know-how, this is close to a confidentiality exception that swallows the agreement, and it is why sophisticated companies fight hard over it. Large acquirers and platform companies often insist on residuals clauses precisely because they review hundreds of pitches and cannot quarantine every idea. If you are the smaller party sharing your core innovation, a residuals clause converts your NDA into a polite formality. Strike it if you can; if you cannot, share less, and keep your most sensitive details out of the room.

5. One-sided obligations

Check whether the NDA runs one way or both ways. If you will each share sensitive information, obligations should be mutual. Then look for three quieter asymmetries. First, a missing return-or-destruction clause: on request or at termination, they should have to return or destroy your materials and certify it. Second, a waiver of your right to contest an injunction, sometimes phrased as an agreement that any breach "will cause irreparable harm" entitling them to an injunction without proof or bond. Courts decide irreparable harm; you should not concede it in advance.

Third, venue. If you live in Texas and the NDA sets exclusive venue in Delaware or New York, every dispute starts with plane tickets and out-of-state counsel. That cost asymmetry is leverage: it makes defending yourself expensive enough that many people fold regardless of the merits. Ask for venue where you live or work, or at least a neutral forum.

Red flag 6: remedies that assume the worst

Some NDAs say any breach causes irreparable harm, entitles the other side to an injunction without posting a bond, or triggers a fixed liquidated damages payment. Injunction language is common and usually acceptable, but waiving the bond requirement and large fixed penalties are worth pushing back on. A liquidated damages figure should be a reasonable estimate of likely loss, not a penalty.

Red flag 7: hidden restrictions

NDAs are a common place to slip in non-solicit, no-hire or non-compete wording, often near the end under headings like "Additional Covenants." Search the document for "solicit," "hire," "compete" and "interfere." A confidentiality agreement should protect information, not restrict who you can work with.

Red flag 8: no carve-out for protected disclosures

You cannot lawfully be prevented from reporting possible violations of law to government agencies. Agreements covering trade secrets should include the Defend Trade Secrets Act whistleblower immunity notice. Its absence is not fatal to you, but it signals a template that has not been reviewed.

A worked example

A designer signs a client's NDA before a pitch. It defines confidential information as "all information disclosed," has no exclusions, lasts forever and includes a residuals clause for the client only. Months later, the designer pitches a similar concept to another company, built from their own earlier work. The client claims breach. With standard exclusions for independently developed and previously known information, the designer would have had a clear defense.

What federal and state laws apply to NDAs?

An NDA is a contract, so a claim that someone broke it is usually decided under ordinary state contract law. On top of that, trade secret law applies whether or not anyone signed anything. The federal Defend Trade Secrets Act, 18 U.S.C. § 1836, lets the owner of a trade secret sue in federal court for misappropriation. Nearly every state has also adopted a version of the Uniform Trade Secrets Act, including California (Cal. Civ. Code § 3426 and following). New York is the main exception and relies on rules developed by its courts instead.

The federal remedies are already strong. A court can order an injunction, award damages for actual loss and for unjust enrichment, or award a reasonable royalty instead. If the misappropriation was willful and malicious, it can add exemplary damages of up to two times the damages award and order the losing side to pay reasonable attorney's fees (18 U.S.C. § 1836(b)(3)). This is useful context when an NDA asks you to agree in advance to fixed penalties or to waive the usual bond for an injunction. For genuine trade secrets, the law already gives the discloser serious tools, so extra one-sided remedy language is asking for more than the baseline.

State law can also limit how far an NDA reaches. California voids contracts that restrain anyone from engaging in a lawful profession, trade or business (Cal. Bus. & Prof. Code § 16600). In Brown v. TGS Management Co. (2020) 57 Cal.App.5th 303, a California appeals court refused to enforce an employee confidentiality clause whose definition of confidential information was so sweeping that it effectively kept the employee out of the securities industry, treating it as a disguised non-compete. Other states are less strict, so a broad definition will not automatically fail where you live.

The practical point is that the red flags above are not just drafting preferences. The definition, the exclusions and the remedies are exactly where courts and statutes draw lines, which is why they are worth fixing before you sign rather than arguing about later.

What NDA wording should you ask for?

"Confidential Information does not include information that is or becomes public through no fault of the Recipient, was known to the Recipient before disclosure, is independently developed without use of the Confidential Information, or is received from a third party without restriction. The Recipient's obligations last three years from disclosure, except for trade secrets, which are protected while they remain trade secrets."

Quick checklist

• Is the definition limited to non-public information that is marked or identified?
• Are all five standard exclusions present?
• Is the duration fixed for ordinary information?
• Is there a residuals clause, and does it favor the other side?
• Are obligations mutual where both sides share information?
• Are there hidden non-solicit or non-compete terms?

What should you do before signing an NDA?

One more piece of context: since the federal Defend Trade Secrets Act of 2016, trade-secret owners already have national legal protection with real teeth. An NDA that goes far beyond DTSA baselines is asking for more than the law thinks necessary, which is worth naming in negotiation.

• Confirm the four standard exclusions are present.
• Push perpetual terms down to a 2–5 year fixed term (trade secrets excepted).
• Strike or narrow any residuals clause.
• Add a return/destruction obligation and keep venue somewhere you can afford to litigate.
• If the deal is significant, have the specific language checked, an NDA is short enough that review is cheap.