Document Automation
Product features
By practice area
By company size
Contract Review
PRODUCT FEATURES
Resources
LearN
Case Studies
Pricing
Gavel Exec reviews and redlines contracts inside Microsoft Word, checked against your own playbook. Start with 25 free queries, no credit card required.
An NDA playbook is a clause-by-clause set of positions for reviewing a nondisclosure agreement (NDA): what you ask for, what you accept as a fallback, and when a reviewer must escalate or walk away. This playbook covers mutual and one-way NDAs from the side sharing the more sensitive information, with sample language and a pre-signature checklist.
Last reviewed November 13, 2026. This playbook is general information for lawyers, not legal advice for a specific matter. Gavel publishes it and makes Gavel Exec.
The positions below are written for a company that expects to disclose the more valuable information under a mutual NDA, such as a software company showing a channel partner its roadmap. It also receives information, so every preferred position has to be one it can perform as a recipient.
A mutual NDA imposes the same duties on both parties. Before pushing for a broad definition or a five-year period, ask whether your own sales and engineering staff could honor that duty for everything the other side tells them.
Vendors in security reviews, buyers in diligence and investors usually receive more than they disclose. Flip the table: ask for marking or written identification, hold the period to two years, keep independent development with a workable proof standard, retain backups, and strike non-solicitation. If your engineers will see a competitor's technology, the narrow residuals fallback becomes your opening request.
Use a one-way NDA when information moves in one direction, such as a seller's diligence materials in an acquisition. Take the broadest preferred positions, since none of them binds you: no marking, an open-ended trade secret tail, certified destruction and no residuals. If the counterparty asks for a mutual form and will share something real, agree, and reread each broad position as a duty you will now owe.
Some forms carry a mutual title and one-sided terms: a residuals right, non-solicitation covenant or affiliate access running to one party only, or a marking rule that applies to one side's information. Escalate each, because the mutual label invites a quick signature.
The positions assume a commercial NDA between two U.S. companies exploring a deal. Escalate means route to the playbook owner; walk away means no signature until an accountable business owner accepts the risk in writing.
| Issue | Preferred position | Acceptable fallback | Escalate or walk away if | Why it matters |
|---|---|---|---|---|
| Mutual or one-way form | Mutual when both parties will share anything worth protecting; one-way in your favor when only you disclose. | One-way protecting the counterparty only, if you will disclose nothing beyond your interest in the deal. | You will share pricing, roadmaps, code or customer lists under a one-way form protecting only the other side. | Anything disclosed under the wrong one-way form has no contractual protection. |
| Definition of confidential information | All nonpublic information disclosed for the Purpose, marked or unmarked, plus the existence and terms of the discussions. | Marked written material, plus oral or visual disclosures identified when made and summarized in writing within 30 days. | Only marked documents are protected, with no route for demos, site visits or calls. | Fish & Richardson notes that marking rules burden the discloser. |
| Exclusions | Four only: public without recipient fault, known before receipt, received from a third party without restriction, independently developed without use. Recipient proves each with documents. | Same four, proved by any competent evidence. | A fifth exclusion appears, or independent development lacks the no-use condition. | Burden of proof often decides these disputes. Common Paper's form puts it on the recipient. |
| Purpose and use | Use solely for a named transaction described in one sentence, with no less than reasonable care. | A broader description of the relationship, with competing product development expressly barred. | Purpose is blank, reads "any business purpose," or allows product development. | A vague purpose works as a license to use. |
| Representatives and affiliates | Need-to-know employees, contractors and advisors bound by equally protective duties; recipient liable for their breaches. | Controlled affiliates and financing sources added, recipient responsible for each. | Affiliates or portfolio companies may receive information with no recipient liability. | It is the practical route to enforce against people who never signed. |
| Compelled disclosure | Prompt prior notice where lawful, cooperation at the discloser's expense, disclosure of only what counsel advises is required. | Notice where lawful and practicable; none for routine examinations by the recipient's own regulator. | Disclosure on any government "request" without notice or narrowing. | Notice lets the discloser seek a protective order in time. |
| Regulator and whistleblower carve-outs | Nothing prevents reports to any government agency. DTSA immunity notice when the counterparty is an individual contractor or consultant. | General carve-out plus cross-reference to a reporting policy, which 18 U.S.C. 1833(b)(3)(B) accepts. | Notice to, or consent from, the other party before contacting a regulator. | 17 C.F.R. 240.21F-17(a) bars enforcing, or threatening to enforce, a confidentiality agreement to impede contact with Securities and Exchange Commission (SEC) staff about a possible securities law violation. A missing DTSA notice forfeits exemplary damages and fees against that individual. |
| Term and confidentiality period | Two-year disclosure period; duties last three years after it ends; trade secrets protected while they qualify. | Two years after the last disclosure, trade secret tail kept. | A fixed end date for trade secrets, or under one year for technical information. As recipient: perpetual duties for everything. | Trade secret status requires reasonable secrecy measures, 18 U.S.C. 1839(3)(A). |
| Return or destruction | Return or destroy within 30 days of request or the end of talks; officer's certificate on request. | Copies kept in automatic backups and where law requires, still confidential. | Unlimited working copies in active systems, or no destruction duty for technical files. | oneNDA dropped return on request as impractical for digital sharing; oneNDA and Common Paper both allow backup copies. |
| Residuals | No residuals clause. | Unaided memory only, no deliberate memorization, excluding trade secrets, code, pricing, customer and personal data, with no patent or copyright license. | Any residuals clause when you disclose code, formulas or designs, or one favoring only the counterparty. | oneNDA left residuals out for their potential for abuse. Knobbe Martens rates them highest for future disputes if not addressed. |
| Artificial intelligence (AI) tools and model training | No training, fine-tuning or evaluating AI models. AI services only under no-training, limited-retention and confidentiality terms. | Enterprise AI tools whose contracts bar training on inputs; training ban kept. | Any right to train models on your information, or to use consumer AI services. | Information absorbed into a model cannot reliably be returned or destroyed. |
| No license, warranty or obligation | No implied license; information as is; no duty to disclose or proceed. | Warranty only that the discloser may lawfully share what it shares. | Accuracy warranties, exclusivity or a duty to negotiate in good faith. | Accuracy warranties belong in the definitive agreement, where they can be capped. |
| Non-solicitation and other covenants | None. State that neither party is restricted from hiring or competing without using the other's information. | Mutual, 12 months, employees met through the Purpose only, general advertisements excepted. | No-hire, over 12 months, all employees, a non-compete or standstill, or any restraint with a California party. | Knobbe Martens describes one year as standard. Cal. Bus. & Prof. Code 16600(a) voids restraints of trade to that extent. |
| Remedies | Breach may cause irreparable harm; either party may seek an injunction plus damages. | Same, with any bond left to the court. | Liquidated damages, indemnity, one-way fee shifting, or injunctions as of right. | oneNDA left out penalties as unlikely to be relevant, and indemnities because a discloser can already sue for its losses. |
| Governing law and forum | Your home state's law and courts, with injunctions available in any competent court. | Delaware or New York law and courts. | A forum unconnected to either party, or arbitration abroad with no injunction carve-out. | Injunctions need a quick, convenient court. Common Paper's cover page shows Delaware as a fill-in example. |
| Assignment and change of control | No assignment without consent, except to a successor to the whole business that assumes the NDA, with notice and a right for the discloser to demand return or destruction. | Free assignment to affiliates, assignor still liable. | Free assignment to anyone, including a competitor acquirer, without notice. | A merger could otherwise carry your information to a competitor with no chance to recall it. |
A residuals clause lets the recipient use information its people remember once the discussions end. The oneNDA drafters left residuals out because of "the potential for abuse by the Receiver," and Common Paper's Mutual NDA standard terms do not include one. Attorneys at Knobbe Martens describe residuals as having the "highest potential for future disputes if not addressed."
Preferred: Nothing in this Agreement permits either party to use Confidential Information because a Representative remembers it. Information retained in memory remains Confidential Information for the full period stated in Section [X].
Fallback: Either party may use Residuals, meaning general know-how retained in the unaided memory of a Representative with authorized access who did not study the information to retain it. Residuals exclude source code, formulas, product designs, pricing, customer data, personal data and trade secrets. This Section grants no license under any patent, copyright or trade secret and permits no disclosure to third parties.
Large technology companies answer that they cannot police what thousands of engineers remember. Offer the fallback, limit the right to named teams, or move technical disclosures to a clean room. The DTSA already bars an injunction that conditions a person's new job "merely on the information the person knows," 18 U.S.C. 1836(b)(3)(A)(i); a residuals clause goes further and licenses the recipient company itself.
Most NDAs run two clocks: the period for exchanging information and the period for protecting it. Common Paper's Mutual NDA defaults to a one-year term of confidentiality, lists perpetual protection as the alternative, and protects trade secrets until they no longer qualify. Michael Kevin Henry of Fish & Richardson writes "a term of three to five years seems to be fairly typical in some industries."
The tail matters because federal law protects information as a trade secret only if "the owner thereof has taken reasonable measures to keep such information secret," 18 U.S.C. 1839(3)(A). A contract that frees the recipient on a fixed date invites the argument that you stopped taking those measures.
Preferred: Each party may disclose Confidential Information during the two years after the Effective Date (the "Disclosure Period"). The Receiving Party's obligations continue for three years after the Disclosure Period ends, except that for Confidential Information that is a trade secret under applicable law, they continue for as long as it remains a trade secret.
Fallback: The Receiving Party's obligations continue for two years after the date of the last disclosure under this Agreement. Obligations relating to trade secrets continue for as long as the information remains a trade secret under applicable law.
Recipients object that they cannot tell which information is a trade secret, so they cannot know when their duty ends. Offer a schedule of trade secret categories, such as formulas and source code, which gives them certainty and gives you a record of reasonable measures.
Older NDA forms say nothing about whether a recipient may paste your information into an AI tool or use it to train a model, and a representatives clause written for employees and advisors does not clearly reach a software provider. Training is the larger risk, because information absorbed into a model cannot reliably be returned or destroyed.
Preferred: The Receiving Party will not use Confidential Information to train, fine-tune or evaluate any AI model. It may process Confidential Information with an AI service only if the provider is contractually barred from training on inputs, retains inputs only as needed to provide the service, and owes confidentiality at least as protective as this Agreement. The Receiving Party is responsible for the provider as for a Representative.
Fallback: The Receiving Party may use AI services provided under its enterprise agreements that prohibit the provider from training on customer inputs. The Receiving Party will not use Confidential Information to train or fine-tune any model.
Recipients say they cannot inventory every tool their staff use. The fallback relies on their own enterprise contracts while keeping the training ban. Treat refusal of the training ban as a walk-away item.
Non-solicitation, no-hire, non-compete, standstill and exclusivity terms turn up in NDAs, often near the end, and each needs its own approval. In California, "every contract by which anyone is restrained from engaging in a lawful profession, trade, or business of any kind is to that extent void," Cal. Bus. & Prof. Code 16600(a), so a broad covenant with a California counterparty carries enforceability risk for both sides.
Preferred: This Agreement does not restrict either party from hiring any person or from developing, marketing or selling any product or service, provided it does not use the other party's Confidential Information in doing so.
Fallback: For twelve months after the Effective Date, neither party will solicit for employment any employee of the other party whom it first met through the Purpose. General advertisements not directed at the other party's employees, and hiring anyone who responds to them or applies unprompted, are permitted.
The Knobbe Martens presentation describes one year as the standard term for an anti-poaching covenant. Counterparties ask for no-hire language when key engineers will work together. Hold to the solicitation version, because a no-hire clause restrains employees who never agreed to it.
Every NDA needs a path for legally required disclosures and for reports to regulators. The SEC rule is direct: "No person may take any action to impede an individual from communicating directly with the Commission staff about a possible securities law violation," which includes enforcing or threatening to enforce a confidentiality agreement, 17 C.F.R. 240.21F-17(a).
For an individual consultant, add the DTSA immunity notice. The statute counts "any individual performing work as a contractor or consultant" as an employee, and an employer that omits the notice "may not be awarded exemplary damages or attorney fees" against that individual, 18 U.S.C. 1833(b)(3)(C) and (b)(4).
Preferred: If law or court order requires the Receiving Party to disclose Confidential Information, it will give prompt prior notice where legally permitted, cooperate at the Disclosing Party's expense in seeking protective treatment, and disclose only what its counsel advises is required. Nothing in this Agreement prevents any person from reporting a possible violation of law to any government agency, or requires notice of that report.
Fallback: The same clause, with notice where legally permitted and reasonably practicable, and none for routine examinations by a regulator supervising the Receiving Party, if the regulator is told the information is confidential.
Banks and other regulated counterparties ask for the examination carve-out because supervisory examinations are frequent and confidential. Accept it, but refuse no-notice disclosure to litigants or private requesters.
These rows appear only where the law or the information changes the answer; mid-market companies can use the base table as written.
| Segment | What changes in the playbook | Why |
|---|---|---|
| Early-stage software startup | Negotiate four rows (definition, residuals, term, non-solicitation) and accept a larger counterparty's mutual form if the rest meets the fallbacks. Give investors only the fallback residuals version, and hold back source code until a term sheet. | Common Paper publishes optional language letting a potential investor use residual information, so expect the request. |
| Enterprise software vendor | As a frequent recipient of customer architecture and security material, provide that the master services agreement (MSA) confidentiality terms replace the NDA on signature, and allow use of product feedback without any license to the customer's other confidential information. Keep personal data out of scope. | Two regimes over the same information conflict. The oneNDA drafters put data protection safeguards in a separate agreement. |
| Biotech and life sciences | Protect formulas, sequences and assay data while they remain trade secrets. Bar patent filings on the discloser's information, require notice of unauthorized disclosure within five business days, and give academic partners publication rights after a 30 to 60 day patent review. | U.S. law gives a one-year grace period for disclosures derived from the inventor, 35 U.S.C. 102(b)(1)(A). The European Patent Convention (EPC) disregards a disclosure caused by "an evident abuse" only if it occurred no earlier than six months before filing, EPC Article 55(1)(a). |
| Healthcare provider or health tech | State that no protected health information (PHI) is disclosed under the NDA. PHI moves only under a signed business associate agreement (BAA); demos use de-identified or synthetic records. | Under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, a covered entity's assurances from a business associate "must be documented through a written contract" meeting 45 C.F.R. 164.504(e), 45 C.F.R. 164.502(e)(2). A standard NDA contains none of those terms. |
| Financial services | An institution sharing customer information with a prospective vendor adds safeguard duties or withholds that data until the services contract. A public company sharing material nonpublic information with an investor or other person covered by Regulation Fair Disclosure should get an express confidentiality promise and a trading acknowledgment. | The Federal Trade Commission's Gramm-Leach-Bliley Act (GLBA) Safeguards Rule, which covers non-bank financial institutions such as mortgage lenders and finance companies under 16 C.F.R. 314.1(b), calls for "Requiring your service providers by contract to implement and maintain such safeguards," 16 C.F.R. 314.4(f)(2). Regulation Fair Disclosure excludes disclosures to a person "who expressly agrees to maintain the disclosed information in confidence," 17 C.F.R. 243.100(b)(2)(ii). |
| Manufacturing or supply chain | Add an export control clause: the discloser flags controlled technical data and the recipient keeps it from foreign persons absent any required license. Extend return duties to drawings, tooling and samples. | Under the Export Administration Regulations (EAR), releasing technology or source code "to a foreign person in the United States" is a deemed export, 15 C.F.R. 734.13(a)(2) and (b). |
| Deals between competitors | Limit current pricing, wages, capacity and customer terms to a named clean team outside sales and pricing roles. | In February 2023 the Department of Justice withdrew its information exchange safety zone, Morgan Lewis reported. |
| Enterprise company (by size) | Keep separate approved forms for mutual, inbound, outbound, acquisition and clean team NDAs, track end dates and destruction duties in a register, and route standstills to corporate development counsel. | At volume, expiry and destruction duties are performed only if recorded. Standstills bind the whole company. |
Gavel Exec is AI contract review and drafting software that works inside Microsoft Word. It generates playbook rules from a checklist, spreadsheet playbook or signed agreements in .docx, Portable Document Format (PDF) or comma-separated values (CSV) form. Copy the table above into a spreadsheet, adjust it to your risk tolerance and upload it as the start of your playbook rules.
On a counterparty's NDA in Word, Gavel Exec applies those rules as priority-ranked tracked changes with its reasoning for each, and lists missing terms such as a regulator carve-out. In the web app, benchmarking labels each provision on-market, off-market or missing, filterable by jurisdiction, industry and company size.
Gavel Exec costs $160 per user per month or $1,740 per user per year. Each user gets 25 free queries, with no credit card required.
What is the difference between a mutual NDA and a one-way NDA?
A mutual NDA binds both parties to protect what they receive. A one-way NDA protects only one party's information and places duties only on the other, so use it only when information flows in one direction.
How long should NDA confidentiality obligations last?
Fish & Richardson describes three to five years as fairly typical in some industries, and Common Paper's standard mutual form defaults to one year. Whatever general period you choose, keep trade secrets protected for as long as they qualify as trade secrets.
Should I accept a residuals clause in an NDA?
Strike it when you will disclose source code, formulas, product designs or other technical information. If the deal requires it, accept only an unaided-memory version that excludes trade secrets and grants no patent or copyright license.
Does an NDA need a whistleblower immunity notice?
The Defend Trade Secrets Act requires the notice in agreements with employees, contractors and consultants that govern confidential information; without it, the employer cannot recover exemplary damages or attorney fees from that individual. NDAs between companies should still carve out reports to regulators.
Can an NDA include a non-solicitation clause?
It can, but the clause is a restraint that needs separate approval. A defensible version is mutual, lasts 12 months and covers only employees met through the deal; California's Business and Professions Code section 16600 makes any version risky with a California party.
What should I check before signing an NDA?
Confirm the direction of information flow, the purpose, the definition and exclusions, who may receive the information, the confidentiality period and trade secret tail, and any residuals or non-solicitation language. Then check regulated data and governing law.
Related reading: how AI NDA review works in Word, how to build and maintain a contract playbook, and reviewing data protection agreements with AI.
AI contract review and redlining in Microsoft Word, checked against your own playbook, with the reasoning behind each change.
