How to Write a Non-Disclosure Agreement (NDA) under English Law

Mutual or one-way?

A one-way (unilateral) NDA imposes obligations of confidence on the recipient only — typical when you pitch an idea to an investor or hand specifications to a supplier. In a one-way agreement the first party is the discloser and the second party is the recipient.

A mutual NDA protects both sides and is standard when two businesses explore a partnership and each will share sensitive information, so either party may act as discloser or recipient. Pick the direction that matches reality: a one-way NDA signed by a party that will itself disclose information leaves that party unprotected.

Define confidential information carefully

The definition is the heart of the NDA. Under English law it is standard to cover all information, however recorded or preserved, disclosed in connection with an agreed Purpose that is marked as confidential or that would reasonably be regarded as confidential — including business plans, financial information, customer data, technical information, and trade secrets.

Always pair the definition with exclusions. The duty should not apply to information that is or becomes public other than through breach, was lawfully in the recipient's possession before disclosure, is lawfully obtained from a third party free of restriction, or is required to be disclosed by law or a regulatory authority. Tying disclosure to a clearly stated Purpose also limits how the recipient may use what it receives.

Protect trade secrets beyond the fixed term

Most commercial NDAs run for a fixed period — commonly one to five years. But a fixed term can accidentally weaken protection, because genuine trade secrets can retain value long after the term expires.

A well-drafted English-law NDA carves trade secrets out of the fixed term: in respect of information that qualifies as a trade secret under the Trade Secrets (Enforcement, etc.) Regulations 2018 or at common law, the obligations continue for as long as that information remains a trade secret. That way the contract does not contractually shorten protection the law would otherwise give.

Set the term and materials handling

State clearly how long the confidentiality obligations last — the template offers one, two, three, or five years running from the date of the agreement — with the trade-secret carve-out layered on top where selected.

Decide what happens to materials when discussions end. On the discloser's written request the recipient should either return or destroy (with written confirmation) all documents and materials containing Confidential Information, including copies, notes, and extracts, subject to a limited right to retain copies required to be kept by law or regulation, which remain subject to the agreement. If disclosure to group companies is permitted, the recipient stays responsible for compliance by each group member (holding company and subsidiaries as defined in section 1159 of the Companies Act 2006).

Handle required disclosure

A subpoena, court order, or regulatory demand should not turn compliance with the law into a breach of the NDA. Include a required-disclosure clause that permits disclosure compelled by law, regulation, or a judicial or regulatory authority.

Best practice is to require the recipient, to the extent lawfully permitted, to give the disclosing party prompt written notice before disclosing, to disclose only the part of the Confidential Information it is legally required to disclose, and to use reasonable endeavours to obtain assurances that the disclosed information will be treated confidentially.

Remember UK GDPR where personal data is shared

An NDA is a confidentiality contract, not a data-protection agreement. Where the Confidential Information includes personal data — customer lists, employee records, contact details — the UK GDPR and the Data Protection Act 2018 apply independently of whatever the NDA says.

The confidentiality obligation does not by itself satisfy those duties. Depending on the relationship you may still need a lawful basis for sharing, appropriate security measures, and, where one party processes personal data on behalf of the other, a separate controller-to-processor agreement meeting the requirements of Article 28 UK GDPR. Treat the NDA as a floor for confidentiality, and layer data-protection terms on top when personal data is in scope.

1. 1.Choose mutual or one-way based on who actually discloses.
2. 2.State the Purpose and draft a clear definition of Confidential Information with standard exclusions.
3. 3.Set a term (1–5 years) and carve out trade secrets so their protection is not shortened.
4. 4.Add required-disclosure and return-or-destruction clauses, and decide on group-company disclosure.
5. 5.Choose the governing law and courts (England and Wales, Scotland, or Northern Ireland) and add a remedies clause allowing injunctive relief.
6. 6.Layer UK GDPR / Article 28 terms on top where personal data is shared, then have both parties sign and date.