NDA Clause Checklist for Legal Teams in England and Wales

An NDA clause checklist should let a reviewer answer three questions fast: what information is protected, what the recipient may do with it, and what happens when the relationship ends. It should also show which facts are missing. The same wording does not suit a supplier evaluation, an M&A data room and a settlement with a departing employee.

This guide is for lawyers reviewing NDAs governed by the law of England and Wales. The UK has three separate legal systems: England and Wales, Scotland, and Northern Ireland. If an NDA is governed by Scots or Northern Irish law, or disputes will be heard there, take local advice. If the counterparty is in the US or wants US law, see the US version of this checklist.

What should an NDA clause checklist in England and Wales cover first?

Start with identity and purpose. Confirm the legal names, whether group companies are meant to take part, which side discloses, and the project the information is for. A mutual NDA is not balanced just because it says "mutual". One side may disclose source code while the other shares a price list.

Then work through this table:

How should confidential information be defined?

A workable definition lets a reasonable recipient spot protected material. Check whether it covers oral disclosures, site visits, demonstrations, notes, analyses and derived materials, and information shared before signing. If marking is required, ask whether the disclosing team will really mark things. If marking is not required, ask how the recipient will tell confidential material apart in daily work.

Many NDAs also protect trade secrets, so the statutory definition is a useful test. Under regulation 2 of the Trade Secrets (Enforcement, etc.) Regulations 2018, a trade secret is information that is secret, has commercial value because it is secret, and "has been subject to reasonable steps under the circumstances" by the person lawfully in control of it to keep it secret. An NDA can be one of those steps, but it is not the only one. If the discloser shares material freely outside the NDA, the clause will not fix that.

The Regulations do not replace the law of confidence. Regulation 3 says acquisition, use or disclosure of a trade secret is unlawful where it constitutes a breach of confidence in confidential information, and lets a court grant breach of confidence remedies that give wider protection than the Regulations. So an NDA claim, a breach of confidence claim and a trade secrets claim can sit side by side.

Keep confidentiality and intellectual property apart. An NDA usually controls use and disclosure. It should not assign inventions, grant broad licences or decide who owns feedback unless the deal calls for it. Read any "residuals" clause closely, because it can let the recipient use what its people remember.

Which exclusions should the NDA contain?

Standard exclusions only help if the team can prove them.

Add an express permission for disclosures required by law, court order or a regulator. Then link it to the compelled disclosure process below.

What disclosures can an NDA not stop?

Some statutory rights override confidentiality clauses. A reviewer should check the NDA against each one, and the drafter should say plainly what the signer may still disclose.

The section 17 list is specific. It covers disclosures to a person with law enforcement functions, to a qualified lawyer for legal advice, to a regulated professional for professional support, to a victim support service, to a regulator of a regulated profession, to the Criminal Injuries Compensation Authority, and to a child, parent or partner for support. It does not protect a disclosure made for the primary purpose of releasing the information into the public domain.

Be precise about section 202A. Section 24 of the 2025 Act was not in force at Royal Assent. When we checked legislation.gov.uk on 4 October 2026, section 202A had been brought into force only for specified purposes, including the making of regulations from 6 January 2026. Regulations will also define "excepted agreements" that fall outside the rule. Check the current commencement position before you rely on it, and review employer and worker templates once it applies in full.

The SRA notice applies whenever a solicitor negotiates, drafts, advises on, enforces or is a party to an NDA. It says neither the notice nor the SRA's Standards and Regulations prohibit NDAs. But NDAs would be improperly used if they were used to prevent or deter someone from, for example, reporting an offence to a law enforcement agency, reporting misconduct to a regulator, making a protected disclosure, or making a proper disclosure to professional advisers bound by confidentiality. It also says NDAs must not include clauses known to be unenforceable, and it expects plain English and clarity about what disclosures can and cannot be made, and to whom.

How should compelled disclosure work in practice?

A compelled disclosure clause needs a route that people can follow. The recipient may need to notify the discloser, cooperate with any application to protect the information and disclose only what is required. Each step should be subject to what the law and the request allow, because some requests limit what you may tell the other side.

Use a short playbook:

1. Send every court order, disclosure request or regulator notice to the legal owner the same day.
2. Preserve the request and the material it covers.
3. Check deadlines and any limits on telling the discloser.
4. Decide who contacts the discloser and who negotiates scope.
5. Record what was produced, on what basis and when.

Keep this separate from the protected disclosures above. A notice-and-cooperate duty should not apply to a protected report to a regulator or the police.

What term, survival and return language works?

Separate the period during which disclosures are made from the period during which confidentiality duties last. A two or three year survival period may suit price lists. It may not suit source code or a formula the discloser wants to protect as a trade secret for as long as it stays secret. Ask counsel whether a fixed end date fits each category.

Return and destruction wording must match real systems. Ask IT and records owners about backups, email archives, disaster recovery copies, litigation holds and copies kept by external advisers. A promise to destroy every copy at once may be impossible. A broad right to keep everything can defeat the point of the NDA. A common middle position allows retained copies in backups and for legal or regulatory compliance, still subject to confidentiality.

Use an exit list:

• identify repositories and custodians at intake;
• trigger return or destruction at the end of the project or on request;
• pause destruction where a preservation duty or hold applies;
• record retained copies and why they were kept;
• keep retained copies out of ordinary business use; and
• get written confirmation of destruction if the NDA calls for one.

How should remedies be reviewed?

Most NDAs say that damages would not be an adequate remedy and that the discloser may seek an injunction. Treat that clause as a statement of the parties' position. Whether to grant an injunction is still for the court. Check costs, indemnities, liquidated damages and liability caps, and route one-sided terms to counsel. Where trade secrets are involved, regulation 3 of the 2018 Regulations lets the court draw on breach of confidence remedies as well as those in the Regulations.

Are non-solicit and non-compete add-ons enforceable?

NDAs often carry extra restrictive covenants: no poaching staff, no soliciting customers, or no competing. These are restraints of trade and need their own review, separate from confidentiality.

Drafting width matters. In Tillman v Egon Zehnder Ltd [2019] UKSC 32, the Supreme Court restored an injunction enforcing a restraint, subject only to removing the words "or interested". It discussed the first of three criteria for severing an unenforceable provision: whether "the unenforceable provision is capable of being removed without the necessity of adding to or modifying the wording of what remains". Do not rely on the court to rescue a covenant that is wider than it needs to be. Ask for each covenant in a separate clause with its own scope and duration.

What should the final review cover?

Boilerplate decides how the NDA works in practice. Check governing law, jurisdiction, notices, assignment, variation, entire agreement and counterparts. Make sure the NDA does not conflict with a later definitive agreement. Record who may approve deviations; a contract approval matrix helps.

• Parties, signatories and group company treatment are confirmed.
• The purpose matches the approved activity.
• The definition, marking rules and exclusions can be applied.
• Recipients and their duties match real access.
• The NDA does not purport to stop protected disclosures, victim disclosures or reports to regulators.
• The NDA says clearly what the signer may still disclose, and to whom.
• The section 202A commencement position has been checked for worker agreements.
• Compelled disclosure has a named owner and route.
• Term, survival, return, destruction, backups and holds are aligned.
• Remedies and liability were reviewed at the right level.
• Any non-solicit or non-compete was reviewed as a restrictive covenant.
• Deviations, approvals and reasons are recorded with the signed text.

How can a legal team run this checklist at scale?

Start with one NDA type and a sample of signed agreements. Turn repeat questions into intake fields. Link each issue to your preferred wording, a fallback and a named approver. Test the checklist on your own template, counterparty paper, scanned files and amendments. The guide to NDA review automation explains how to add software support without hiding lawyer judgement, and the legal workflows overview shows where specialist approvals fit.

Gotham lets UK legal teams research UK case law and legislation, review contracts at scale and draft in Word, in one workspace, with data for UK customers stored in the United Kingdom. Every answer cites the passage it relies on, and you can talk to Gotham about building an NDA review workflow around your own playbook.

Questions about reviewing NDAs in England and Wales

What should I check in an NDA before signing it in England and Wales?

Check the parties, the definition of confidential information, the exclusions, the permitted purpose, who may receive the information, compelled disclosure steps, the term and survival period, return and destruction, remedies, any non-solicit or non-compete add-ons, and governing law and jurisdiction. If the NDA is with a worker or could touch on crime or misconduct, also check that it does not purport to stop disclosures the law protects.

Can an NDA stop an employee from whistleblowing?

No. Section 43J of the Employment Rights Act 1996 makes any provision in an agreement between a worker and their employer void in so far as it purports to preclude the worker from making a protected disclosure. This applies whether or not the agreement is a worker's contract, and includes an agreement to refrain from instituting or continuing proceedings under the 1996 Act or for breach of contract.

Can an NDA stop a victim of crime from reporting it?

No. Section 17 of the Victims and Prisoners Act 2024 has been fully in force since 1 October 2025. It makes a provision in an agreement void in so far as it purports to stop a victim, or a person who reasonably believes they are a victim, from making certain disclosures, such as to the police, a qualified lawyer, a support service or a regulator. It does not protect a disclosure made for the primary purpose of releasing the information into the public domain.

Are NDAs in harassment and discrimination cases banned in the UK?

The Employment Rights Act 2025 inserts a new section 202A into the Employment Rights Act 1996. It voids provisions in employer and worker agreements in so far as they purport to stop a worker making allegations or disclosures about relevant harassment or discrimination, subject to excepted agreements defined by regulations. On legislation.gov.uk on 4 October 2026, section 202A was in force only for specified purposes, including making regulations, so check its commencement before relying on it.