NDA template Ireland: what a confidentiality agreement can and cannot do

There is no Irish statute governing commercial non-disclosure agreements. An NDA is an ordinary contract, enforced in equity by the action for breach of confidence, and its real value is the injunction rather than damages. But two statutes cut holes in it that no drafting closes: section 23 of the Protected Disclosures Act 2014, and section 14B of the Employment Equality Act 1998 where the parties are employer and employee.

The four things that decide enforceability

A stated purpose. The obligation an NDA creates is an obligation not to use the information for anything other than the purpose. Without a purpose there is nothing to measure a misuse against, and a court asked for an interlocutory injunction will want to see it. "In connection with discussions between the parties" is not a purpose; "evaluating whether to enter into a data-processing arrangement for the recipient's claims platform" is.

A definition you can point at. List the categories — source code, pricing and margins, customer lists, unpublished financials, the existence of the discussions themselves. Then set out the standard exceptions: information already lawfully held without an obligation of confidence, information that becomes public otherwise than through breach, information lawfully received from a third party free to disclose it, and information independently developed without reference to the disclosure. Put the burden of proving an exception on the receiving party.

A permitted-recipient clause that is actually limited. "Group companies and such subcontractors as the receiving party may appoint" is an unlimited permission dressed as a limited one. Name them, or confine disclosure to employees, officers and professional advisers who need to know, with an obligation to inform them and to procure equivalent obligations, and with the receiving party responsible for their acts as if its own.

A term that matches the information. An indefinite obligation is right for a genuine trade secret, and mirrors the equitable duty in any event. Across a broad category of ordinary commercial information it is much harder to defend, because a court asked to restrain a use years later will ask whether the information still has the necessary quality of confidence. A fixed three or five years, with an indefinite carve-out for named trade secrets, is the more enforceable structure.

The carve-outs that are void if you omit them

Section 23 of the Protected Disclosures Act 2014 makes void any provision in an agreement so far as it purports to prohibit or restrict the making of protected disclosures, to exclude or limit the operation of any provision of that Act, to preclude a person from bringing proceedings under it, or to preclude proceedings for breach of contract in respect of anything done in consequence of a protected disclosure. Note the words "so far as" — it strikes down the offending part, not the agreement.

Section 14B of the Employment Equality Act 1998, inserted by section 5(a) of the Maternity Protection, Employment Equality and Preservation of Certain Records Act 2024 and in force since 20 November 2024, goes further: where an employer enters into an agreement, or a provision of one, that purports to preclude a disclosure about discrimination, victimisation, harassment or sexual harassment, that agreement is null and void. "Employee" in section 14B(9) includes a prospective or former employee, so it reaches job applicants and exit agreements. See the Irish NDA ban and how to draft around it.

A well-drafted Irish NDA states both carve-outs on its face, together with the right to report to An Garda Síochána, the Workplace Relations Commission, the Data Protection Commission, the Revenue Commissioners or any other statutory body, and to obtain legal or medical advice. A clause that pretends otherwise does not become enforceable by staying silent about it.

An NDA is not a data-processing agreement

If personal data changes hands, confidentiality is not a lawful basis for processing. Where one party processes on the other's instructions, Article 28(3) of the General Data Protection Regulation requires a written contract covering the subject matter and duration, the nature and purpose, the types of data and categories of data subject, and the processor's obligations on security, sub-processors, assistance, deletion and audit. Where both are controllers, each needs its own lawful basis and its own transparency notice. Put that in place separately; the Data Protection Commission is the supervisory authority in the State.

Return, destruction, and the archival copy

Requiring the receiving party to return or irretrievably destroy everything on request, and to certify it in writing, is the standard. In practice most organisations cannot comply literally — backups, e-discovery holds, statutory retention. Either accept a carve-out for one archival copy that remains subject to the agreement for as long as it is retained, or expect the certificate to be inaccurate.

Remedies

Say expressly that damages would not be an adequate remedy and that the disclosing party may seek injunctive relief. It does not bind the court, but it is the acknowledgement the court expects to see on an interlocutory application. And keep a record of what was disclosed and when — an obligation over information you cannot identify is very hard to enforce.

Governing law and forum

Irish law, Irish courts. If you prefer arbitration under the Arbitration Act 2010, carve out the right to apply to a court for interim and protective relief, or you lose the injunction that was the point of the agreement.

Our non-disclosure agreement drafts the mutual and one-way versions, prints both statutory carve-outs, and blocks an employer-employee agreement that section 14B would make null and void.