Nda Clause Taxonomy

NDA clause taxonomy

A working reference for someone reviewing a commercial NDA. Every NDA reuses the same handful of clauses; the wording varies. Use this to recognise which provision is which when the section headings don't match the clause function.

M&A NDA vs. ordinary-evaluation NDA

Before applying any review rule, identify which kind of NDA you're looking at, because conventions differ:

• M&A / transactional NDA (executed in connection with diligence on a possible acquisition or business combination). Standstills are standard — Eastland's 2018 EDGAR survey of 143 transactional NDAs found standstills in 80%, modal duration 12 months. Definition of CI typically pulls in "the existence of negotiations" (which is itself something the acquirer side often pushes back on, because it restricts the acquirer's ordinary-course communications). Survival caps tend to be longer (3-5 years) than ordinary NDAs. Residuals carve-outs are typically refused by the disclosing target, especially in pharma and biotech (Farrer & Co.).
• Ordinary business-evaluation NDA (vendor evaluation, partnership discussion, technical exchange). Standstills are unusual and a red flag. Term and survival are shorter (1-2 years term, 2-3 years survival). Residuals carve-outs more frequent on the recipient side (especially tech).

Apply rules in their proper context — a "must_be_absent" rule for standstills is appropriate for ordinary NDAs but not for M&A NDAs.

Reading order

NDAs almost always order clauses this way:

1. Recitals / preamble — parties, effective date, "Authorized Purpose"
2. Definition of Confidential Information
3. Exceptions / carve-outs from the definition
4. Use and disclosure obligations (sometimes split into "non-use" and "non-disclosure")
5. Permitted recipients / Representatives
6. Compelled-disclosure exception (court order, subpoena)
7. Return or destruction on termination
8. No-license statement
9. No-warranty / "as is"
10. Term and survival
11. Equitable / injunctive relief
12. Miscellaneous: governing law, assignment, severability, notice, counterparts, entire-agreement, waiver
13. (M&A context only) Standstill, non-solicit / no-hire

Clause-by-clause guide

Each entry below is "what it does", "names you'll see", "what to look for when reviewing".

Definition of Confidential Information

What it does — sets the scope of what counts as protected. Usually written broadly ("all information disclosed... in oral, written, graphic, electronic or other form"), often with an illustrative list. Names — "Confidential Information", "Proprietary Information", "Information". Things to notice — does it cover oral disclosures? Are summaries/derivatives included? Does it pull the existence of the agreement and negotiations into the protected set (common in M&A)? Does it require markings like "Confidential" to attach (a "marking requirement")?

Exceptions / carve-outs from the definition

What it does — pulls four standard categories out of the definition, so the recipient is not on the hook for them. Names — "Exceptions", "Limitations on Confidential Information", "Confidential Information shall not include..." The four standard exceptions — (a) public domain through no fault of recipient, (b) prior knowledge evidenced by written records, (c) third-party received without restriction, (d) independent development without reference to the disclosed CI. A fifth — residuals (information unintentionally retained in the unaided memory of personnel) — is sometimes added, mostly by tech-company recipients; it is contentious and the disclosing side often resists it.

Use and disclosure obligations

What it does — the operative restriction. Recipient must use CI only for the "Authorized Purpose" and not disclose except to permitted recipients. Names — "Non-Use and Non-Disclosure Obligations", "Confidentiality Obligations", "Use Restrictions". Things to notice — what is the standard of care ("same as own confidential information of like importance" vs. "reasonable care" vs. "best efforts")? Is non-use as tightly drawn as non-disclosure?

Permitted recipients / Representatives

What it does — lets the recipient share with employees, advisors, affiliates who need to know. Names — "Representatives", "Authorized Recipients", embedded inside the use clause. Things to notice — does the recipient have to "advise" representatives, or "ensure" they comply, or "be responsible for breach by" them? "Be responsible for" is the strongest formulation and is what most playbooks want.

Compelled-disclosure exception

What it does — allows disclosure if required by court order, subpoena, regulatory request, or law. Names — "Required Disclosure", "Authorized Disclosure", "Disclosure Required by Law". Things to notice — does the recipient have to give prior written notice (where lawful) and reasonably cooperate with the disclosing party's effort to seek a protective order? Both are standard playbook asks.

Return or destruction

What it does — on termination or request, recipient returns or destroys CI. Names — "Return of Information", "Copies", "Return or Destroy". Things to notice — does the clause allow destruction in lieu of return (it should — physically returning files is impractical)? Is there a back-up carve-out for routine IT-system backups (it should — purging tape/cloud backups is impractical and most playbooks accept retention if access is limited)? Is there a legal/compliance archive carve-out for one secure copy?

No-license

What it does — prevents the disclosure from being construed as a licence to use the underlying IP. Names — "No License", "Reservation of Rights", "Ownership".

No-warranty

What it does — disclaims warranties about the accuracy or completeness of the CI. Names — "No Warranty", "No Representations", "As Is".

Term and survival

What it does — sets when the agreement expires AND how long obligations survive afterwards. Names — "Term", "Term and Termination", "Duration", "Survival". Things to notice — these are two different periods and reviewers regularly conflate them. Term is how long new disclosures may be made (often 1–3 years). Survival is how long the confidentiality obligations continue once the agreement ends (often 3–5 years for general CI; trade secrets are often kept confidential indefinitely or "for as long as the information remains a trade secret"). Combined effective protection = term + survival.