Draft a Mutual NDA in Your Browser, Free

A one-way (unilateral) NDA protects one party's information. A mutual (bilateral) NDA protects both. The choice is not politeness — it changes which obligations you are accepting.

Use a mutual NDA when both sides will actually disclose: partnership discussions, merger or acquisition talks, technical integrations, most vendor relationships where you must describe your own systems to receive a useful proposal.

Use a one-way NDA when disclosure genuinely runs in one direction: engaging a contractor who will see your systems but reveal nothing of their own, or briefing an agency on an unannounced launch.

The practical reason mutual agreements are often preferred is symmetry of incentive. When both parties bear the same obligations, terms tend to settle at something reasonable — because each clause you push will also bind you. A one-way NDA drafted by the disclosing party's counsel frequently contains obligations that would be rejected instantly if reciprocal.

One caution that catches people out: signing a one-way NDA as the *receiving* party while intending to describe your own approach means your disclosures are unprotected. If you expect to say anything sensitive in the meeting, the agreement needs to be mutual before the meeting, not after.

This article explains common drafting practice. It is not legal advice, and an agreement with material commercial consequences should be reviewed by a qualified lawyer in the relevant jurisdiction.

The definition clause is where most NDAs are won or lost.

Too narrow — limiting protection to material stamped "Confidential" — fails because real conversations are not labelled. The most valuable disclosure in a meeting is usually spoken, and a marking requirement excludes it entirely. Where a marking requirement is imposed, it should be paired with a provision that orally disclosed information is protected if confirmed in writing within a stated window, commonly 15 or 30 days.

Too broad — "all information disclosed by either party" — fails differently. Courts in several jurisdictions have declined to enforce definitions so sweeping that the receiving party could not reasonably know what was restricted, and an unworkably broad definition makes the whole agreement harder to enforce rather than easier.

The workable middle ground describes categories with enough specificity to be recognisable: technical data, source code, business plans, customer lists, pricing, unreleased product information, and information a reasonable person would understand to be confidential given its nature and the circumstances of disclosure.

Equally important are the standard exclusions, which nearly every enforceable NDA contains. Information is not confidential if it:

• was already public, or becomes public through no fault of the receiving party;
• was already known to the receiving party without a duty of confidence;
• is independently developed without reference to the disclosed information;
• is lawfully received from a third party free to disclose it.

Omitting these makes an agreement more likely to be read down or struck. They protect the receiving party from being held liable for knowing something they were entitled to know.

Two different clocks run in an NDA, and conflating them is a common drafting error.

The term is how long disclosures made under the agreement are covered — the window during which new information becomes protected. Typically one to three years.

Survival is how long the confidentiality obligation persists *after* the agreement ends. This is frequently longer than the term, and for good reason: information disclosed in month eleven should not lose protection in month thirteen.

A common structure is a two-year term with a three to five year survival for general confidential information, and indefinite survival for trade secrets specifically. That last distinction matters: in jurisdictions with trade-secret statutes, protection can last as long as the information remains secret and reasonable steps are taken to keep it so. A fixed expiry on trade secrets can actively undermine that status, because it suggests the owner did not intend to protect it indefinitely.

Watch for perpetual obligations on everything. A blanket "in perpetuity" on all confidential information is common in first drafts and is a heavy obligation to accept, since it requires indefinite record-keeping and indefinite exposure. Negotiating a finite period for general information while leaving trade secrets indefinite is standard and usually accepted.

Beyond the definition, a small number of clauses do most of the work.

Permitted disclosure. The receiving party will need to share information with employees, professional advisers and sometimes affiliates. The clause should permit disclosure on a need-to-know basis to people bound by equivalent obligations, and make the receiving party responsible for their compliance.

Compelled disclosure. If a court or regulator orders disclosure, the agreement should permit it while requiring prompt notice to the disclosing party — so they can seek a protective order — and limiting disclosure to what is legally required. Without this, a party can be caught between a court order and a contract.

Return or destruction. On termination, confidential material should be returned or destroyed. Two carve-outs are now standard and reasonable: copies retained in automated backup systems, and one archival copy retained for legal compliance. Both remain subject to the confidentiality obligation.

Governing law and jurisdiction. Name a specific law and a specific forum. An NDA without them invites a dispute about where the dispute happens, which is expensive and decided before anyone reaches the substance.

No licence granted. Disclosure creates no ownership or licence in intellectual property. Worth stating explicitly.

Remedies. Damages are often an inadequate remedy for disclosed confidential information, because the harm cannot be undone. Agreements commonly acknowledge that injunctive relief is appropriate. Note that such an acknowledgement does not bind a court, which decides on the facts.

A few practical points determine whether the document is usable when it is needed.

Sign as the correct entity. An agreement signed in a personal name when the business is a limited company may bind the individual rather than the company, or may not bind the intended party at all. Use the full registered name.

Date it, and state an effective date if disclosures began before signature. Backdating a signature is improper; an explicit "effective from" clause achieves the same result honestly.

Initial the schedules. Where an annexe lists specific materials, initialled pages reduce later argument about what was attached.

Keep both the signed copy and the negotiation record. Which clauses were amended, and when, is often the evidence that matters.

On generating the document: an NDA draft contains both parties' legal names, the nature of the transaction, and frequently the subject matter of the confidential information itself. Preparing it in a tool that uploads the content transmits precisely the facts the agreement exists to protect — including, often, that two named companies are in discussions at all, which is itself market-sensitive.

The OpenTools NDA generator assembles the document in the browser, so the parties, the subject matter and the terms are not transmitted. A generated template is a starting point for review by a qualified lawyer, not a substitute for one.