Reference for the standard clauses found in commercial non-disclosure agreements (mutual and one-way) — what each clause does, the surface forms it appears in, and how to recognise it in unfamiliar drafting. Use when reviewing, comparing, or extracting provisions from any confidentiality / NDA / mutual NDA / standstill-and-confidentiality agreement.
Reference for the standard clauses found in commercial non-disclosure agreements (mutual and one-way) — what each clause does, the surface forms it appears in, and how to recognise it in unfamiliar drafting. Use when reviewing, comparing, or extracting provisions from any confidentiality / NDA / mutual NDA / standstill-and-confidentiality agreement.
NDA clause taxonomy
A working reference for someone reviewing a commercial NDA. Every NDA reuses the same handful of clauses; the wording varies. Use this to recognise which provision is which when the section headings don't match the clause function.
M&A NDA vs. ordinary-evaluation NDA
Before applying any review rule, identify which kind of NDA you're looking at, because conventions differ:
M&A / transactional NDA (executed in connection with diligence on a possible acquisition or business combination). Standstills are standard — Eastland's 2018 EDGAR survey of 143 transactional NDAs found standstills in 80%, modal duration 12 months. Definition of CI typically pulls in "the existence of negotiations" (which is itself something the acquirer side often pushes back on, because it restricts the acquirer's ordinary-course communications). Survival caps tend to be longer (3-5 years) than ordinary NDAs. Residuals carve-outs are typically refused by the disclosing target, especially in pharma and biotech (Farrer & Co.).
Ordinary business-evaluation NDA (vendor evaluation, partnership discussion, technical exchange). Standstills are unusual and a red flag. Term and survival are shorter (1-2 years term, 2-3 years survival). Residuals carve-outs more frequent on the recipient side (especially tech).
Apply rules in their proper context — a "must_be_absent" rule for standstills is appropriate for ordinary NDAs but not for M&A NDAs.
Each entry below is "what it does", "names you'll see", "what to look for when reviewing".
Definition of Confidential Information
What it does — sets the scope of what counts as protected. Usually written broadly ("all information disclosed... in oral, written, graphic, electronic or other form"), often with an illustrative list.
Names — "Confidential Information", "Proprietary Information", "Information".
Things to notice — does it cover oral disclosures? Are summaries/derivatives included? Does it pull the existence of the agreement and negotiations into the protected set (common in M&A)? Does it require markings like "Confidential" to attach (a "marking requirement")?
Exceptions / carve-outs from the definition
What it does — pulls four standard categories out of the definition, so the recipient is not on the hook for them.
Names — "Exceptions", "Limitations on Confidential Information", "Confidential Information shall not include..."
The four standard exceptions — (a) public domain through no fault of recipient, (b) prior knowledge evidenced by written records, (c) third-party received without restriction, (d) independent development without reference to the disclosed CI. A fifth — residuals (information unintentionally retained in the unaided memory of personnel) — is sometimes added, mostly by tech-company recipients; it is contentious and the disclosing side often resists it.
Use and disclosure obligations
What it does — the operative restriction. Recipient must use CI only for the "Authorized Purpose" and not disclose except to permitted recipients.
Names — "Non-Use and Non-Disclosure Obligations", "Confidentiality Obligations", "Use Restrictions".
Things to notice — what is the standard of care ("same as own confidential information of like importance" vs. "reasonable care" vs. "best efforts")? Is non-use as tightly drawn as non-disclosure?
Permitted recipients / Representatives
What it does — lets the recipient share with employees, advisors, affiliates who need to know.
Names — "Representatives", "Authorized Recipients", embedded inside the use clause.
Things to notice — does the recipient have to "advise" representatives, or "ensure" they comply, or "be responsible for breach by" them? "Be responsible for" is the strongest formulation and is what most playbooks want.
Compelled-disclosure exception
What it does — allows disclosure if required by court order, subpoena, regulatory request, or law.
Names — "Required Disclosure", "Authorized Disclosure", "Disclosure Required by Law".
Things to notice — does the recipient have to give prior written notice (where lawful) and reasonably cooperate with the disclosing party's effort to seek a protective order? Both are standard playbook asks.
Return or destruction
What it does — on termination or request, recipient returns or destroys CI.
Names — "Return of Information", "Copies", "Return or Destroy".
Things to notice — does the clause allow destruction in lieu of return (it should — physically returning files is impractical)? Is there a back-up carve-out for routine IT-system backups (it should — purging tape/cloud backups is impractical and most playbooks accept retention if access is limited)? Is there a legal/compliance archive carve-out for one secure copy?
No-license
What it does — prevents the disclosure from being construed as a licence to use the underlying IP.
Names — "No License", "Reservation of Rights", "Ownership".
No-warranty
What it does — disclaims warranties about the accuracy or completeness of the CI.
Names — "No Warranty", "No Representations", "As Is".
Term and survival
What it does — sets when the agreement expires AND how long obligations survive afterwards.
Names — "Term", "Term and Termination", "Duration", "Survival".
Things to notice — these are two different periods and reviewers regularly conflate them. Term is how long new disclosures may be made (often 1–3 years). Survival is how long the confidentiality obligations continue once the agreement ends (often 3–5 years for general CI; trade secrets are often kept confidential indefinitely or "for as long as the information remains a trade secret"). Combined effective protection = term + survival.
Equitable / injunctive relief
What it does — recipient acknowledges that money damages would be inadequate and the disclosing party may seek an injunction or specific performance.
Names — "Injunctive Relief", "Equitable Relief", "Remedies", "Specific Performance".
Things to notice — best practice clauses include "without bond" (the disclosing party shouldn't have to post a bond to get an injunction). Some say "without prejudice to other remedies" — that's the cumulative-remedies clause and is also good.
Governing law
What it does — picks which state's law governs.
Names — "Governing Law", "Choice of Law", "Applicable Law".
Things to notice — does it say "without regard to conflicts of laws principles" (it should, otherwise renvoi can pull in a different jurisdiction's law)? Is there a forum-selection clause separately? Most US playbooks specify Delaware, New York, or California.
Assignment
What it does — restricts the parties' ability to transfer their rights and obligations.
Names — "Assignment", "Successors and Assigns", "Binding Effect".
Things to notice — most playbooks want a mutual written-consent requirement, often with a carve-out for assignment to affiliates and successors in interest (mergers, asset sales). Bare "no assignment without consent" without an affiliate carve-out is a common review item.
Standstill (M&A context)
What it does — prohibits one party (usually the prospective acquirer) from acquiring securities, soliciting proxies, or otherwise pursuing a change-of-control transaction for some period.
Names — "Standstill", "Standstill Provision", "No Acquisition".
Things to notice — standstills are normal in M&A NDAs (12 months is typical) but inappropriate in an ordinary mutual NDA for vendor evaluation, partnership discussions, or technical diligence. If you see one in a non-M&A context, flag it. Even in M&A, watch for fall-away triggers (does it terminate on the target's announcement of a definitive agreement with a third party? on a public tender offer?).
Non-solicit / no-hire
What it does — restricts hiring of the other party's employees.
Names — "Non-Solicitation", "No-Hire", "Employees".
Things to notice — usual asks: limited duration (≤ 12 months), limited to employees with whom the receiving side actually had contact, carve-outs for general advertising, carve-outs for employees who initiated contact unsolicited.
Miscellaneous
Severability — invalid provision is severed/reformed, rest survives.
Notice — how parties give notice (mail, email, courier).
Counterparts — separate signatures combine into one agreement.
Entire agreement — supersedes prior understandings.
Waiver / non-waiver — failure to enforce is not a waiver.
Interpretation — headings for convenience only, English controls.
Spotting clauses when names don't match
When a draft uses non-standard headings, identify clauses by operative verbs:
"shall not include" / "does not apply to" → exceptions clause
"shall return or destroy" / "promptly return" → return/destruction
