Non-disclosure agreements (NDAs) are among the most common legal documents small business owners, freelancers, and founders encounter. Before you put pen to paper or add your digital signature, running through a disciplined NDA review checklist protects your intellectual property, prevents unintended liabilities, and ensures you do not sign away your commercial freedom. Knowing exactly what to look for in an NDA turns an opaque legal formality into a manageable business safeguard.
This checklist is general information, not legal advice, and Ergora is not a law firm. Important, high-value or unusual NDAs should be checked by a qualified lawyer before you sign.
Mutual or One-Way: Determine Your Agreement Type
Before reviewing individual clauses, establish the fundamental structure of the agreement. Non-disclosure agreements typically fall into two categories:
- Unilateral (one-way) agreements: Only one party discloses proprietary information, and only the receiving party is bound by confidentiality. If you are sharing your product roadmap or client lists but the contract is drafted as a one-way agreement where only you carry obligations, you have no legal protection for your own data.
- Mutual (bilateral) agreements: Both parties anticipate exchanging proprietary insights, and both parties take on reciprocal confidentiality obligations.
Whenever both sides are exchanging concepts, pricing, or technical details, insist on a mutual structure. If an enterprise partner sends you a one-way agreement that protects only their disclosures, ask to replace it with a mutual version or standardise on a balanced template. You can explore Ergora's legal specialist and contract tools to access a pre-built mutual NDA template designed for balanced exchanges.
The Complete NDA Review Checklist: 12 Clauses to Examine
Every standard non-disclosure agreement contains core operational provisions. When checking NDA clauses, evaluate each section against standard commercial norms to identify potential red flags.
1. Definition of Confidential Information
- What to look for: The definition must be clear, precise, and limited to materials genuinely related to the business discussion. It should ideally require written disclosures to be marked "Confidential" and oral disclosures to be confirmed in writing within a set window (such as 30 days).
- Red flag: Overly broad definitions that classify "all information exchanged between the parties in perpetuity, whether written, oral, or observed" as confidential without qualification.
2. Standard Exclusions from Confidentiality
- What to look for: Ensure the agreement includes the industry-standard carve-outs. Information should not be treated as confidential if it is already public knowledge, was already known to you before disclosure, is independently developed without reference to the discloser's materials, or is lawfully obtained from a third party without breach.
- Red flag: The total absence of standard exclusions, or clauses requiring you to prove independent development only through strict written records that small businesses rarely maintain.
3. Permitted Purpose and Use
- What to look for: The clause should explicitly restrict the use of the confidential material solely to evaluating or carrying out the specific commercial discussion (the "Purpose").
- Red flag: Vague or missing purpose definitions that could be interpreted as granting the other party permission to run internal tests, conduct reverse engineering, or build competing products based on your disclosures.
4. Permitted Disclosures to Staff and Advisers
- What to look for: You must have the explicit right to share the information with your employees, legal advisers, accountants, and contractors on a strict "need-to-know" basis, provided they are bound by equivalent confidentiality obligations.
- Red flag: Provisions requiring you to seek prior written consent before showing the document to your own solicitor, accountant, or core technical subcontractors.
5. Duration of the Confidentiality Obligation
- What to look for: A fixed, reasonable time horizon. For everyday business information, a fixed term of two to five years is common. Genuine trade secrets may warrant longer protection.
- Red flag: Indefinite confidentiality terms for routine commercial discussions, marketing plans, or general pricing proposals.
6. Return or Destruction of Information
- What to look for: At the end of discussions, you should be permitted either to return the materials or destroy them securely. The clause should also include an explicit carve-out permitting you to retain routine automated IT backups and legal archive copies required by compliance rules.
- Red flag: Requirements demanding immediate, complete deletion of automated server backups or forensic proof of digital destruction within 24 hours of notice.
7. No Licence or Intellectual Property Transfer
- What to look for: Clear wording affirming that exchanging information does not grant any patent, copyright, trademark, or commercial licence to the receiving party.
- Red flag: Ambiguous phrasing that suggests joint ownership of any feedback, suggestions, or derivative ideas arising during preliminary discussions.
8. No Obligation to Proceed
- What to look for: Explicit confirmation that signing the NDA merely facilitates exploratory discussions and does not obligate either party to enter into a commercial contract, joint venture, or transaction.
- Red flag: Language implying an exclusive negotiating period or an implied commitment to purchase goods or services upon concluding evaluation.
9. Remedies and Injunctions
- What to look for: Acknowledgement that breach of confidentiality may cause irreparable harm for which monetary damages alone are inadequate, allowing the non-breaching party to seek injunctive relief.
- Red flag: Provisions that predetermine disproportionate liquidated damages or strip you of the ability to dispute whether a breach has actually occurred.
10. Hidden Restrictive Covenants (Non-Solicitation and Non-Compete)
- What to look for: An NDA should focus purely on information confidentiality. If non-solicitation language is present, it must be narrowly confined to direct hiring of key staff introduced during the project.
- Red flag: Hidden non-compete clauses that prohibit you from offering your services to other clients in the same industry, or clauses preventing you from hiring personnel who respond to general public job advertisements.
11. Governing Law and Jurisdiction
- What to look for: Governing law and courts you know, ideally those of the part of the UK where your business is based (England and Wales, Scotland and Northern Ireland each have their own legal system).
- Red flag: Clauses that subject a small domestic enterprise to dispute resolution in foreign courts or international arbitration panels that impose prohibitive legal costs.
12. Assignment and Successors
- What to look for: Neither party should assign their rights or obligations under the agreement without prior written consent, except in connection with a genuine business sale or corporate restructuring.
- Red flag: One-sided assignment rights that allow the other party to transfer your confidential information to an unvetted third party or competitor during an acquisition without your knowledge.
Summary Checklist: What Good Looks Like vs Red Flags
| Clause | What Good Looks Like | Red Flag |
|---|---|---|
| Agreement Type | Mutual rights and balanced obligations. | One-way agreement when both sides disclose. |
| Definition | Clear, bounded, requires marking or prompt written notice. | Unlimited scope covering every observation indefinitely. |
| Exclusions | Public domain, prior knowledge, independent development. | Missing standard carve-outs entirely. |
| Permitted Use | Strictly limited to evaluating the defined project. | Broad rights allowing internal testing or derivative work. |
| Disclosures | Need-to-know access for staff and professional advisers. | Prior written permission needed to consult your solicitor. |
| Duration | Fixed term, typically two to five years. | Indefinite duration for ordinary commercial data. |
| Return/Destruction | Option to destroy; standard IT backup carve-outs. | Mandatory physical purge of immutable digital archives. |
| Intellectual Property | Explicit retention of all rights; no implied licences. | Clauses assigning feedback or derivatives to the discloser. |
| Commitment | Clear statement of no obligation to do business. | Implied exclusivity or mandatory deal terms. |
| Remedies | Right to seek injunctive relief through proper court process. | Automatic liquidated penalties without proven damages. |
| Restrictions | No non-compete; narrow non-solicit for project staff. | Broad non-compete blocking you from industry clients. |
| Governing Law | Domestic, familiar legal jurisdiction. | Distant foreign courts with high travel and legal expenses. |
| Assignment | No transfer without consent, except on a genuine sale of the business. | One-sided rights to pass your information to a new owner or third party. |
Combining AI Analysis with Professional Legal Judgement
Reviewing third-party NDAs line by line can cause significant administrative drag for lean operations. AI tools can speed up the first pass by scanning the document, pulling out the key definitions and flagging clauses that look unusual, so you know where to focus. For a deeper look at early automated detection, read our guide on how AI flags non-compliant contract clauses.
In practice, a modern contract workflow looks like this:
- Automated scanning: Upload the NDA as a PDF. Ergora's Contract Scanner reads it and flags risky or unusual clauses, such as a non-compete tucked into the confidentiality terms, and Risk Scorer gives the contract an overall risk rating.
- Contextual interrogation: If a clause seems ambiguous, you can use conversational tools like Contract Chat to query the text directly and receive an explanation in plain English.
- Template standardisation: Rather than negotiating every line of an aggressive counterparty agreement, you can reply with your own balanced terms, and Ergora's Legal specialist can draft an NDA from your instructions. To compare the options, see our review of AI NDA software for small businesses.
- Human legal oversight: AI accelerates discovery, but it does not replace legal counsel. If an NDA involves core patent disclosures, company acquisitions, or complex multi-jurisdictional obligations, forward the flagged items directly to your solicitor. To see how these workflows run side by side, review our analysis of legal AI contract review for small businesses.
By combining automated extraction with targeted legal oversight, small teams can sign agreements quickly without accepting unvetted operational risks.
Frequently asked questions
What should I look for in an NDA?
Look for a clear definition of confidential information, standard exclusions such as public knowledge, and a clearly defined permitted purpose. Check that the duration is reasonable, often two to five years for everyday business information, and make sure the contract does not contain hidden non-compete clauses.
What is the difference between a mutual and a one-way NDA?
A one-way NDA protects only the party disclosing information, leaving the receiving party bound by restrictions without reciprocal protection. A mutual NDA binds both parties equally, ensuring that any proprietary ideas, trade secrets, or client figures shared by either side remain protected.
How long should an NDA last?
For standard commercial discussions, partnerships, and supplier negotiations, confidentiality obligations typically last between two and five years. Indefinite terms are uncommon for general commercial information, though genuine trade secrets and software source code may legitimately warrant longer protection.
Can an NDA stop me working with competitors?
A standard NDA should not restrict your commercial freedom to work with competitors. However, some counterparties hide restrictive covenants, such as non-compete or broad non-solicitation clauses, inside the confidentiality text. You should strike out any language that restricts your broader business activities.
Can AI review an NDA?
AI contract analysis tools can quickly scan an uploaded contract to identify deviations from standard industry wording, highlight risky obligations, and extract key dates. While AI speeds up document analysis and flags anomalies, it does not provide legal advice and cannot replace a qualified lawyer for bespoke, high-value deals.
Do I need a lawyer to sign an NDA?
Routine, low-stakes NDAs based on standard mutual templates often do not require direct solicitor intervention if you understand the terms. However, if the agreement governs high-value intellectual property, acquisition talks, or contains non-standard cross-border liabilities, a qualified lawyer should review it before you sign.