NDA: what should it contain, and what does it not protect?

Before due diligence, a collaboration or a tender, one of the parties almost always asks for a non-disclosure agreement. It is often signed quickly because it is seen as a formality. That is a mistake. An NDA determines what the other party can do with your information, and what you yourself risk breaching.

What is a non-disclosure agreement (NDA)?

A non-disclosure agreement is a contract under which the recipient of confidential information undertakes to keep it secret and to use it only for an agreed purpose. It is also called a confidentiality agreement.

The agreement may be one-way, where only one party discloses information, or mutual, where both parties do. In negotiations on a collaboration or an acquisition, a mutual agreement is usually the right choice, because both parties often share more than they expect.

What should an NDA contain?

A good NDA answers six questions. What is confidential, what can the information be used for, who may receive it, what is excluded, how long does the obligation last, and what happens in the event of a breach.

The most common problem is a definition that is either too wide or too narrow. A definition covering “all information” becomes difficult to comply with and to enforce. A definition covering only information marked “confidential” leaves oral and unmarked information unprotected.

The clause on AI tools is new in most templates, but increasingly important. Otherwise the recipient may argue that using a cloud service or a language model is not the same as passing the information on. Read more about the risk in the article on trade secrets and the use of ChatGPT.

How long should the confidentiality obligation last?

There is no statutory duration. The parties agree how long the obligation should apply, and a time limit of a few years is common for ordinary business information. For information that constitutes trade secrets, such as source code, recipes or technical solutions, the obligation should last for as long as the information remains secret.

An agreement that says nothing about duration creates uncertainty. It is then unclear whether the obligation applies forever, or whether it lapses when the collaboration ends. Spell it out expressly.

What does an NDA not protect?

An NDA has clear limits, and it is important to know them before relying on it.

• It binds only the parties. A third party who obtains the information is not bound by the agreement. Protection against third parties must instead rest on the Trade Secrets Act (forretningshemmelighetsloven), which also applies to anyone who knew or ought to have known that the information had been unlawfully disclosed, see Trade Secrets Act § 3(3).
• It does not protect what is already known. Information that is publicly available, or that the other party develops itself, cannot be locked away by contract.
• It cannot prevent whistleblowing. Employees have the right to report wrongdoing under the Working Environment Act (arbeidsmiljøloven), see Working Environment Act § 2 A-1, and that right cannot be contracted out of to the employee’s detriment, see Working Environment Act § 1-9.
• It is not a non-compete. A confidentiality obligation that in reality prevents an employee from working for a competitor may be assessed under the rules on non-compete, non-dealing and non-solicitation clauses in Chapter 14 A of the Working Environment Act.
• It does not protect general know-how. General experience and skills an employee has acquired are not trade secrets under Trade Secrets Act § 2(2), and it is difficult to contract out of that.

How does an NDA relate to the Trade Secrets Act?

They complement each other. The NDA is a contract that applies between the parties and may cover any information the parties wish to protect. The Trade Secrets Act provides statutory protection that applies against everyone, but only for information that meets the conditions in the Act.

The NDA also matters for protection under the Act. Under Trade Secrets Act § 2, information only qualifies as a trade secret if the holder has taken reasonable steps to keep it secret. A signed NDA is one of the clearest measures a business can document. Misuse of information received in a business relationship is also caught directly by Trade Secrets Act § 3(2).

Should the NDA include a contractual penalty?

Often yes, if the information is valuable. A contractual penalty (konvensjonalbot) is an agreed sum that falls due on breach, without any need to prove financial loss. The advantage is considerable, because the loss caused by a leak of confidential information is often hard to document.

The penalty should be proportionate to the value being protected. A disproportionately high amount may be reduced under the Contracts Act (avtaleloven), see Contracts Act § 36, if it would be unreasonable to enforce it. The agreement should also state whether the penalty comes in addition to damages for documented loss, or whether it is the only remedy.

An NDA is not a formality. It decides what the other party can do with the most valuable thing you have.

Which country’s law governs the NDA?

The law of the country the agreement refers to. Many NDAs from foreign counterparties are governed by US state law or English law, with dispute resolution abroad. That can make enforcement costly and unpredictable for a Norwegian business. Read more in the article on choice of law and jurisdiction in contracts.

Be careful, too, about drafting NDAs with AI without legal review. Such drafts often rely on foreign concepts and liability rules that do not work under Norwegian law, see the article on vibe lawyering.

What should the business do? An NDA checklist

1. Use your own template. Keep a well-drafted, mutual template under Norwegian law and use it as the starting point.
2. Define what is confidential precisely. Include oral and unmarked information, but avoid a definition that cannot be complied with.
3. Limit the purpose. The information should only be usable for the specific purpose.
4. Regulate AI tools and cloud services. Clarify whether the information may be entered into such services, and on what terms.
5. Agree the duration. Consider distinguishing between ordinary information and trade secrets.
6. Consider a contractual penalty. Set an amount proportionate to the value at stake.
7. Read the other party’s template critically. Look for foreign governing law, one-sided obligations and embedded non-compete or non-solicitation clauses.
8. Follow up the agreement. Keep a record of which NDAs the business has entered into, what has been shared and when the obligations expire.

More articles on contracts and SaaS can be found on the topic page on contracts.

Questions and answers

Next legal review: 1 October 2027