NDA Clause Checklist for US Legal Teams

An NDA clause checklist should let a US reviewer answer three questions fast: what information is protected, what the recipient may do with it, and what happens when the relationship ends. It should also show which facts are missing. The same wording does not suit a vendor evaluation, an M&A data room and an employee onboarding pack.

In the US, an NDA is mostly a matter of state contract law, so the governing law clause matters from the first read. A few federal rules cut across every state, though. Some decide what an employee or contractor NDA must say, and others decide what no NDA can stop. This checklist covers both. It is written for in-house and law firm reviewers. If the deal involves a UK counterparty or English law, see the UK version of this checklist.

What should a US NDA clause checklist cover first?

Start with identity and purpose. Confirm the legal names, whether affiliates are meant to take part, which side discloses, and the project the information is for. A mutual NDA is not balanced just because it says "mutual". One side may disclose source code while the other shares a price list.

Then work through this table:

How should confidential information and trade secrets be defined?

A workable definition lets a reasonable recipient spot protected material. Check whether it covers oral disclosures, site visits, demos, notes, analyses and derived materials, and information shared before signing. If marking is required, ask whether the disclosing team will really mark things. If marking is not required, ask how the recipient will tell confidential material apart in daily work.

Many NDAs also protect trade secrets, so the federal definition is a useful test. Under 18 U.S.C. § 1839(3), information is a trade secret only if the owner "has taken reasonable measures to keep such information secret" and the information derives independent economic value from not being generally known or readily ascertainable through proper means. The NDA is one control, but it is not the only one. If the discloser shares material freely outside the NDA, the clause will not fix that.

Keep confidentiality and intellectual property apart. An NDA usually controls use and disclosure. It should not assign inventions, grant broad licenses or decide who owns feedback unless the deal calls for it. Read any "residuals" clause closely, because it can let the recipient use what its people remember.

Which exclusions should the NDA contain?

Standard exclusions only help if the team can prove them. The usual four are information that is or becomes public through no fault of the recipient, information the recipient already knew, information received from a third party without a duty of confidence, and information developed independently.

Watch reverse engineering. Under § 1839(6), "improper means" does not include "reverse engineering, independent derivation, or any other lawful means of acquisition." If the discloser is sharing prototypes or software, decide whether the NDA should deal with reverse engineering expressly.

What carve-outs must an employee or contractor NDA include?

This is where federal law matters most. These rules apply on top of whatever the state contract law says.

Two details are easy to miss. First, the DTSA notice has teeth. If an employer does not give it, the employer may not be awarded exemplary damages or attorney fees under 18 U.S.C. § 1836(b)(3)(C) or (D) against the employee who did not get notice. The notice rule applies to contracts entered into or updated after the DTSA was enacted on May 11, 2016.

Second, the Speak Out Act is narrower than it is often described. 42 U.S.C. § 19404 applies it to claims filed on or after December 7, 2022. It covers clauses agreed before the dispute arises, not settlement terms. Section 19403(b) keeps state laws that are at least as protective, and section 19403(d) says employers and employees may still protect trade secrets and proprietary information. State law may give more protection, so check the law of the state that applies.

Rule 21F-17 applies to any person, so it is not limited to employment agreements. Its one exception covers agreements about information that the SEC's rules treat as related to the legal representation of a client.

How should compelled disclosure work in practice?

A compelled disclosure clause needs a route that people can follow. The recipient may need to notify the discloser, cooperate with a protective order request and disclose only what is required. Each step should be subject to what the law and the request allow, because some requests come with confidentiality limits of their own.

Use a short playbook:

1. Send every subpoena, court order or agency request to the legal owner the same day.
2. Preserve the request and the material it covers.
3. Check deadlines and any limits on telling the discloser.
4. Decide who contacts the discloser and who negotiates scope.
5. Record what was produced, on what basis and when.

Keep this separate from the whistleblower carve-outs above. A notice-and-cooperate duty should not apply to a protected report to a government agency.

What term, survival and return language works?

Separate the period during which disclosures are made from the period during which confidentiality duties last. A two or three year survival period may suit price lists. It may not suit source code or a formula that the discloser wants to protect as a trade secret for as long as it stays secret. Ask counsel whether a fixed end date fits each category.

Return and destruction wording must match real systems. Ask IT and records owners about backups, email archives, disaster recovery copies, legal holds and copies kept by outside advisers. A promise to destroy every copy at once may be impossible. A broad right to keep everything can defeat the point of the NDA. A common middle position allows retained copies in backups and for legal or regulatory compliance, still subject to confidentiality.

Use an exit list:

• identify repositories and custodians at intake;
• trigger return or destruction at the end of the project or on request;
• pause destruction where a litigation hold applies;
• record retained copies and why they were kept;
• keep retained copies out of ordinary business use; and
• get a written certificate of destruction if the NDA calls for one.

How should remedies be reviewed?

Most NDAs say that breach would cause irreparable harm and that the discloser may seek an injunction. Treat that clause as a statement of the parties' position. Whether to grant an injunction is still for the court. Check fee-shifting, indemnities, liquidated damages and liability caps, and route one-sided terms to counsel.

The Defend Trade Secrets Act sits alongside the contract claim. Under 18 U.S.C. § 1836(b)(3), a court may grant an injunction, award damages for actual loss and unjust enrichment or a reasonable royalty, award exemplary damages of not more than 2 times the damages for willful and malicious misappropriation, and award reasonable attorney's fees in set cases, including bad faith claims. An injunction may not prevent a person from entering into an employment relationship, and it may not conflict with a state law that prohibits restraints on a lawful profession, trade or business. A civil action must be brought within 3 years after the misappropriation is discovered or should have been discovered with reasonable diligence (§ 1836(d)).

Are non-solicit and non-compete add-ons enforceable?

NDAs often carry extra restrictive covenants: no hiring the other side's staff, no soliciting its customers, or no competing. These are state law questions, and the answer differs by state. Do not assume one state's rule applies everywhere.

California is the clearest example. Cal. Bus. & Prof. Code § 16600 says that, except as provided in that chapter, every contract that restrains anyone from engaging in a lawful profession, trade or business is to that extent void. The statute tells courts to read it broadly, in line with Edwards v. Arthur Andersen LLP (2008) 44 Cal.4th 937, to void any noncompete in an employment context that does not fit an exception. Other states take different approaches, so check the state law that governs the covenant and where the people bound by it work.

If a non-solicit or non-compete matters to the deal, ask for it in a separate clause with its own scope, duration and governing law analysis. Do not let it ride inside the confidentiality definition.

What should the final review cover?

Boilerplate decides how the NDA works in practice. Check governing law, forum, jury waiver, notices, assignment, amendment, entire agreement and counterparts. Make sure the NDA does not conflict with a later definitive agreement. Record who may approve deviations; a contract approval matrix helps.

• Parties, signatories and affiliate treatment are confirmed.
• The purpose matches the approved activity.
• The definition, marking rules and exclusions can be applied.
• Recipients and their duties match real access.
• Employee and contractor NDAs include the DTSA notice and government reporting carve-outs.
• Nothing restricts a protected report to the SEC or another agency.
• Compelled disclosure has a named owner and route.
• Term, survival, return, destruction, backups and holds are aligned.
• Remedies and liability were reviewed at the right level.
• Any non-solicit or non-compete was checked under the relevant state's law.
• Deviations, approvals and reasons are recorded with the signed text.

How can a legal team run this checklist at scale?

Start with one NDA type and a sample of signed agreements. Turn repeat questions into intake fields. Link each issue to your preferred wording, a fallback and a named approver. Test the checklist on your own template, counterparty paper, scanned files and amendments. The guide to NDA review automation explains how to add software support without hiding lawyer judgment, and the legal workflows overview shows where specialist approvals fit.

Gotham lets US legal teams research federal and state case law, the U.S. Code and federal regulations, review contracts at scale and draft in Word, in one workspace, with data for US customers stored in the United States. Every answer cites the passage it relies on, and you can talk to Gotham about building an NDA review workflow around your own playbook.

Questions about reviewing NDAs in the US

What should I check in an NDA before signing it in the US?

Check the parties, the definition of confidential information, the exclusions, the permitted purpose, who may receive the information, compelled disclosure steps, the term and survival period, return and destruction, remedies, any non-solicit or non-compete add-ons, and governing law. If the NDA is with an employee or contractor, also check the DTSA immunity notice and the carve-outs for reports to the SEC and other government bodies.

Does an employee NDA need a DTSA whistleblower immunity notice?

Under 18 U.S.C. § 1833(b)(3), an employer must give notice of the trade secret immunity in any contract or agreement with an employee that governs the use of a trade secret or other confidential information. For this purpose, employee includes contractors and consultants. A cross-reference to a policy document that sets out the employer's reporting policy is enough. If notice is not given, the employer may not be awarded exemplary damages or attorney fees under the DTSA against that employee.

Can an NDA stop someone from reporting to the SEC?

No. SEC Rule 21F-17(a) says no person may take any action to impede an individual from communicating directly with Commission staff about a possible securities law violation, including enforcing or threatening to enforce a confidentiality agreement about those communications. There is a narrow exception for certain information related to the legal representation of a client.

Are NDA clauses about sexual harassment enforceable in the US?

The Speak Out Act makes a nondisclosure or nondisparagement clause agreed to before a sexual assault or sexual harassment dispute arises unenforceable in court where the conduct is alleged to have violated federal, tribal or state law. It applies to claims filed on or after December 7, 2022. It does not address clauses agreed after a dispute arises, it keeps state laws that are at least as protective, and it still lets employers and employees protect trade secrets and proprietary information.