How to Structure an NDA for Your Business

Almost every growing business signs nondisclosure agreements. You sign one before a manufacturer sees your design, before a buyer opens your books, and every time you hire someone who will touch your customer list. Most are downloaded, lightly edited, and signed in minutes, and most owners don’t discover what’s wrong with theirs until the day they need it.

We ran businesses before we practiced law, and we have been on both sides of the NDA. The lesson from both seats is the same: an NDA is not a formality. It decides what you can stop, what you can recover, and what the other side can do with what it learned.

This guide explains how a business NDA is structured, what the key provisions do, where federal law now limits confidentiality clauses, how NDAs work in deals and investor conversations, and the Oklahoma rules that shape all of it.

Table of Contents

• What an NDA Does and Does Not Do
• When Your Business Needs an NDA
• Unilateral, Mutual, and Embedded Agreements
• Key Provisions in a Business NDA
• Where Federal Law Limits Confidentiality
• NDAs in Acquisitions, Investor Pitches, and Vendor Deals
• Protecting Confidential Information Beyond the Contract
• Common NDA Mistakes
• Oklahoma Specific Considerations
• How Cantrell Law Firm Helps
• Frequently Asked Questions
• Structure First, Then Sign

What an NDA Does and Does Not Do

A nondisclosure agreement, also called a confidentiality agreement, is a contract in which one or both parties promise to keep certain information secret and to use it only for an agreed purpose. That second promise matters as much as the first. A recipient who never tells anyone your pricing model but quietly uses it to undercut you hasn’t “disclosed” anything, and an NDA that only prohibits disclosure leaves you with little to enforce.

An NDA does three practical jobs for a business:

• It sets expectations. Both sides know in writing what’s confidential and how it may be used, which prevents most disputes.
• It creates a contract claim. If the recipient misuses the information, you can sue for breach of contract rather than relying only on trade secret law, which carries a heavier burden of proof.
• It supports your trade secret position. Trade secret law protects information only when the owner takes reasonable steps to keep it secret. The USPTO’s trade secret overview describes those reasonable measures as part of what makes information a trade secret at all, and a consistent NDA practice is one of the first things a court looks for.

An NDA also has limits. It can’t make public information secret again or stop someone who developed the same idea independently. It doesn’t prevent competition, and in Oklahoma it cannot lawfully be used as a disguised noncompete. It’s only as good as your ability to prove a breach, which depends on how it’s structured and how your business behaves after signing.

When Your Business Needs an NDA

The right time to sign an NDA is before any confidential information is exchanged, not after the first meeting where the important details already came out. Common situations include:

• Hiring employees, consultants, or independent contractors who will see customer lists, pricing, processes, or code
• Outsourcing manufacturing, software development, or marketing work
• Exploring a joint venture, distribution deal, licensing arrangement, or co marketing partnership
• Selling a business or buying one, where financials and customer data change hands during due diligence
• Talking with lenders, strategic investors, or potential partners about the business
• Bidding on contracts that require you to submit pricing or technical approaches

Some of these call for a standalone NDA, others for confidentiality terms inside a larger agreement, and a few for no NDA at all because asking for one costs more than it protects. Which applies is a judgment call about the information, the relationship, and the leverage on each side.

Unilateral, Mutual, and Embedded Agreements

Unilateral NDAs

A unilateral, or one way, NDA protects information flowing in one direction. It fits when only one party is disclosing: a business hiring a consultant, a company sharing specifications with a vendor, or a seller sharing financials with a prospective buyer. All of the obligations fall on the recipient.

Mutual NDAs

A mutual NDA protects information flowing both ways under the same terms. It fits joint ventures, technology partnerships, and strategic deals where each side is putting something valuable on the table. Mutual agreements are often easier to get signed because they feel balanced, but that balance can be misleading. If you’re disclosing far more than you’re receiving, identical obligations may give the other side protections it doesn’t need while leaving gaps in yours.

Asymmetric and Tiered Agreements

Some relationships call for different obligations depending on who is disclosing and what’s involved. Customer data or source code may need protection that a marketing plan doesn’t. Tiered structures take more drafting work, but they match the protection to the actual risk.

Confidentiality Terms Inside Larger Agreements

Confidentiality provisions also appear inside employment agreements, master services agreements, operating agreements, letters of intent, and purchase agreements. When they do, they need to fit the rest of the document. A common problem is a stack of agreements with the same party that define confidential information differently and point to different courts, so the dispute becomes an argument about which one controls. Our guide to Oklahoma employment agreements covers how confidentiality terms fit into the broader employment relationship.

Key Provisions in a Business NDA

Every NDA is built from the same core provisions. Below is what each one does and where the judgment calls are. The right choices depend on what you’re sharing and with whom, which is why the language itself is best drafted with counsel.

1. Definition of Confidential Information

This is the most important provision in the agreement, and it’s where most form NDAs fail. Define the information too narrowly and valuable material falls outside it. Define it as “all information of any kind” and you risk a court finding the clause unenforceable, or treating it as a restraint on trade. The best definitions describe the categories that actually matter to your business, address information shared orally or by observation as well as in writing, and deal with whether material must be marked confidential to be covered.

Marking requirements are a classic trap. Many forms protect only documents stamped “confidential” and oral disclosures later confirmed in writing. In practice nobody does that consistently, and the information you care about most ends up unprotected.

2. Exclusions

Standard exclusions remove information that’s already public, already known to the recipient, independently developed, or received from a third party without restriction. The issues are who must prove an exclusion applies and whether the exclusions are broad enough to swallow the rule.

3. Permitted Use

The permitted use clause limits what the recipient can do with your information, usually to evaluating or carrying out a specific transaction. A vague purpose clause gives the recipient room to argue that its use was permitted.

4. Who May Receive the Information

Most NDAs let the recipient share information with employees, advisors, and affiliates who need to know it. The questions are who counts, whether they must be bound by their own obligations, and whether the recipient answers for their breaches.

5. Standard of Care

Recipients typically must protect your information with the care they use for their own, and no less than reasonable care. That’s thin protection against a recipient with poor security habits, so sensitive data may need a more specific standard.

6. Compelled Disclosure

A recipient may be subpoenaed or legally required to disclose information. The NDA should give you notice and a chance to seek a protective order, and limit disclosure to what’s required.

7. Term and Survival

How long the obligations last is a business decision with legal consequences. Ordinary confidential information is often protected for a fixed number of years after disclosure or after the relationship ends. Trade secrets are different. If the NDA lets confidentiality expire, a recipient may argue you stopped treating the information as secret, which can undercut trade secret protection altogether. Many agreements therefore protect trade secrets for as long as they remain trade secrets, with a fixed term for everything else.

8. Return or Destruction

The agreement should address returning or destroying confidential material at the end of the relationship, including electronic copies, cloud storage, and backups. Recipients often negotiate exceptions for backups and legal holds, and those exceptions need limits.

9. Residuals Clauses

Some recipients, particularly larger technology companies, ask for a residuals clause allowing them to use information retained in their people’s unaided memory. A broad one can effectively license your know how to the recipient, so it deserves careful review.

10. Remedies

Money damages are often hard to prove in confidentiality cases, so most NDAs acknowledge that a breach would cause irreparable harm and allow the disclosing party to seek an injunction. Attorney fee provisions can change the economics of enforcement significantly. Liquidated damages clauses are risky if the number looks like a penalty rather than a reasonable estimate.

11. No License, No Warranty, No Obligation

These clauses confirm that sharing information grants no intellectual property rights or warranties and does not obligate either side to complete a deal. The no license provision ties directly into your broader intellectual property strategy.

12. Governing Law, Venue, and Assignment

Which state’s law applies and where disputes are heard can decide whether enforcement is practical. Assignment terms decide whether the NDA follows the business if it’s sold, which matters for owners planning an exit.

Where Federal Law Limits Confidentiality

A confidentiality clause that was standard ten years ago can be unenforceable, or illegal to use, today. Several federal rules now restrict what an NDA can cover, particularly in employment and severance agreements.

The Speak Out Act

Signed in December 2022, the Speak Out Act makes predispute nondisclosure and nondisparagement clauses unenforceable with respect to sexual assault and sexual harassment disputes. As SHRM explains, the law applies to agreements signed before a dispute arises, such as onboarding NDAs and employment agreements, and it does not by its terms reach confidentiality provisions in settlements negotiated after a claim is made. Broad confidentiality clauses in existing employee agreements should be reviewed with that in mind.

The National Labor Relations Act

In its 2023 McLaren Macomb decision, the National Labor Relations Board held that employers may not offer severance agreements with broad confidentiality and nondisparagement terms that restrict nonsupervisory employees from discussing wages, working conditions, or the agreement itself. The rule applies whether or not the workplace is unionized. The Board’s General Counsel rescinded the prior enforcement guidance in 2025 and the current Board has signaled interest in revisiting the decision, but as of this writing McLaren Macomb remains Board law. Employers using severance or separation agreements should not assume the issue has gone away.

Whistleblower Protections

The SEC prohibits any person from taking action to impede someone from communicating directly with the Commission about a possible securities law violation, and that includes confidentiality agreements. In September 2024, the agency charged seven public companies whose employment, separation, and other agreements impeded whistleblowing, with combined penalties of roughly $3 million. Private companies raising capital or planning an exit should treat this as a drafting standard too.

Defend Trade Secrets Act Notice

The federal Defend Trade Secrets Act gives employees, contractors, and consultants immunity for confidentially disclosing trade secrets to government officials or an attorney to report a suspected violation of law. It also requires employers to give notice of that immunity in agreements governing confidential information. As CIO reported when the law passed, an employer that leaves the notice out of agreements signed or updated after May 2016 loses the ability to recover exemplary damages and attorney fees against that individual under the Act.

The Federal Noncompete Rule

The FTC’s 2024 rule banning most noncompetes never took effect. In September 2025, the agency accepted the court decision vacating the rule and said it would pursue restrictive covenants case by case instead. The rule treated overly broad NDAs that function as noncompetes as noncompetes, an idea that also shapes how courts analyze confidentiality clauses that reach too far.

NDAs in Acquisitions, Investor Pitches, and Vendor Deals

Selling or Buying a Business

An NDA is usually the first document signed in an acquisition, often before the letter of intent. For a seller, it governs who sees financials, customer lists, employee data, and contracts during due diligence, and it should keep the buyer from using what it learns to compete or recruit if the deal falls through. Many acquisition NDAs add limited nonsolicitation and no contact provisions protecting your employees and customers.

For a buyer, the NDA needs to allow the advisors, lenders, and investors who will help evaluate the deal to see what they need. Our guide to buying a business in Oklahoma walks through how confidentiality fits into the full acquisition timeline, and our discussion of asset versus stock purchases explains what happens to existing confidentiality obligations when ownership changes.

Pitching Investors

Founders are often surprised that most venture capital investors won’t sign an NDA to hear a pitch. The reasons are practical. Investors see many similar companies, and signing NDAs would expose them to claims every time they funded a business in the same space. DocSend’s explanation covers the investor side, and Entrepreneur’s take makes the founder’s point: insisting on an NDA in an early pitch can end the conversation.

That doesn’t leave founders unprotected. Early materials usually focus on the problem, market, team, and traction, with proprietary technical details saved for later diligence, when confidentiality agreements are customary. How much to share and when turns on what makes your company valuable. Our startup legal checklist covers where confidentiality fits among the other early protections founders need.

Vendors, Manufacturers, and Developers

Vendor relationships are where many businesses lose the most. A manufacturer that sees your design or a developer that writes your platform holds information valuable to your competitors. An NDA protects secrecy, but it does not decide who owns the work product. That takes intellectual property assignment terms in the services agreement.

Protecting Confidential Information Beyond the Contract

An NDA is one layer of protection. Courts deciding trade secret cases look at what the business actually did to keep information secret, not just what its contracts said.

Know What You Are Protecting

Confidential information may be customer lists and pricing, supplier terms, processes, formulas, source code, financial records, or acquisition plans. Protection starts with knowing what you have and where it lives. The FTC’s guide to protecting sensitive information frames the same idea for customer data: take stock, keep only what you need, lock it down, dispose of it properly, and plan ahead.

Internal Policies and Coordination

Effective programs combine agreements at onboarding, data access policies, training, and a consistent exit process. Legal, IT, and leadership need to work together, because a policy nobody enforces can be used as evidence that the information was not treated as secret.

Third Party Information You Hold

Your business probably holds confidential information belonging to customers, suppliers, and partners under NDAs you signed, and mishandling it creates liability for you. Access limits, obligations that flow down to subcontractors, and secure storage matter as much for information you received as for information you own.

Security, Insider Risk, and Incident Response

Most confidential information is lost through people with legitimate access, whether through carelessness or intent. The Cybersecurity and Infrastructure Security Agency’s insider threat guidance treats both accidental and intentional misuse as part of the same risk, and Verizon’s annual Data Breach Investigations Report consistently finds that the human element is involved in a large share of breaches. Access controls, monitoring, and a response plan for suspected leaks are what make an NDA enforceable in practice, because they create the evidence you’ll need if something goes wrong.

AI Tools and Confidential Information

Generative AI has created a new and fast moving disclosure risk. In 2023, Samsung restricted employee use of generative AI tools after staff uploaded sensitive code to a public chatbot. Pasting customer data, contracts, or code into an AI tool may disclose your information, or information you hold under someone else’s NDA, to a third party. Many older NDAs and policies say nothing about it, so AI use is now part of any confidentiality review.

When an employee leaves with information, the response in the first days often decides the outcome. Our article on protecting trade secrets when an employee leaves covers how Oklahoma employers should approach that situation.

Common NDA Mistakes

The same problems appear again and again in the NDAs we review for Oklahoma businesses:

• Signing after the first meeting. Information shared before the NDA was signed may not be covered.
• Using a mutual form when the disclosure is one sided. You may be accepting obligations you don’t need while getting weaker protection than you do.
• Defining everything as confidential. Overbroad definitions invite enforceability challenges and, in Oklahoma, restraint of trade arguments.
• Letting trade secret protection expire. A fixed term that covers trade secrets can undercut their status.
• Ignoring the federal limits. Missing DTSA notices, whistleblower conflicts, and harassment related gag terms create real exposure.
• Relying on the NDA alone. Without internal controls, a court may find your information was never treated as secret.
• Never revisiting old agreements. The law has changed considerably since many standard forms were written.

Each of these is avoidable, but only if you know which apply to the agreement in front of you. Before you sign someone else’s NDA, or send out one you have used for years, have it reviewed against the deal and current law.

Oklahoma Specific Considerations

Oklahoma law shapes NDAs in ways that differ from many other states, starting with the state’s strong public policy against restraints on trade. Under Oklahoma statute, contracts that restrain someone from engaging in a lawful profession, trade, or business are generally void, with limited exceptions such as the sale of a business and agreements not to directly solicit a former employer’s established customers. An article in the Oklahoma Bar Journal explains how those exceptions work and why Oklahoma covenants should be drafted conservatively. Our labor and employment team drafts confidentiality and nonsolicitation terms built for those limits.

Confidentiality Is Generally Enforceable, Within Limits

Confidentiality agreements are generally enforceable in Oklahoma because protecting legitimate business information is not the same as preventing competition. The risk arises when an NDA’s definitions are so broad that the former employee or business partner can’t work in the industry without violating it. An agreement that functions as a noncompete invites a court to analyze it as one. Our guide to Oklahoma noncompete law explains how those rules work and why Oklahoma employers rely on confidentiality and nonsolicitation provisions instead.

The Oklahoma Uniform Trade Secrets Act

Oklahoma has adopted the Uniform Trade Secrets Act. Information qualifies as a trade secret only if it derives value from not being generally known and is the subject of reasonable efforts to keep it secret, so your NDA practice is part of your proof. Remedies can include injunctions, damages, and in cases of willful and malicious misappropriation, additional damages and attorney fees. Claims must generally be brought within three years after the misappropriation is discovered or reasonably should have been.

The Act also matters for how NDAs are structured. Oklahoma’s version displaces many other tort claims for misappropriating trade secrets, but it does not displace contract claims. That means a well drafted NDA can protect valuable confidential information that doesn’t meet the trade secret definition, and it gives you a breach of contract claim alongside or instead of a trade secret claim.

Doing Business With Oklahoma Public Entities

When you bid on state contracts or work with Oklahoma agencies, school districts, or municipalities, the Oklahoma Open Records Act applies to much of what you submit, and an NDA with a public body does not override it. State purchasing rules require bidders to identify and support any claim of confidentiality in a specific way, and the State Purchasing Director has discretion over whether the claim is honored. Pricing models and technical approaches can become public if those procedures are not followed.

Governing Law and Venue for Oklahoma Businesses

Many NDAs from larger companies specify Delaware, New York, Texas, or California law and courts. Those choices affect interpretation, enforceability, and the cost of enforcement. Keeping Oklahoma law and an Oklahoma forum is often worth negotiating, depending on your leverage.

How Cantrell Law Firm Helps

We’re former entrepreneurs who now practice business law, and we approach NDAs the way an owner would: the goal is to protect what makes the business valuable without slowing down the deal or souring the relationship. We draft and review NDAs for deals, vendors, and partners, update employee confidentiality agreements for current federal limits, and respond when confidential information is misused.

Our commercial transactions and business and corporate law practices handle NDAs as part of the larger agreements they protect, and our approach to contract negotiation focuses on getting the terms that matter without losing the deal.

Frequently Asked Questions

• How should I structure an NDA or confidentiality agreement?

  Start with what you’re sharing and why. A properly structured NDA defines confidential information precisely, lists standard exclusions, limits use to a specific purpose, controls who may receive the information, sets a term that matches the information, addresses return or destruction, and provides for injunctive relief. Employee agreements also need to respect federal whistleblower, labor, and harassment limits. The right structure depends on the deal, so it’s worth having an attorney draft or review it.

• Are NDAs enforceable in Oklahoma?

  Generally, yes. Oklahoma courts enforce confidentiality agreements that protect legitimate business information. Problems arise when an NDA is so broad that it effectively prevents someone from working in their field, because Oklahoma voids most restraints on trade. Enforceability depends heavily on how the agreement is drafted.

• How long should an NDA last?

  It depends on the information. Ordinary confidential business information is often protected for a fixed number of years. Trade secrets are commonly protected for as long as they remain trade secrets, because letting confidentiality expire can weaken their legal status. The right term is a business and legal judgment about what you’re sharing.

• Can an NDA stop an employee from reporting harassment or talking to regulators?

  No. The Speak Out Act makes predispute nondisclosure and nondisparagement clauses unenforceable for sexual assault and harassment disputes, SEC rules prohibit impeding reports of securities violations, and the National Labor Relations Act protects many employees’ right to discuss working conditions. Agreements that ignore these limits create legal risk for the employer.

• What is a DTSA notice and does my NDA need one?

  It’s a notice of the immunity the Defend Trade Secrets Act gives employees, contractors, and consultants for confidentially reporting suspected legal violations to the government or an attorney. If an agreement signed or updated after May 2016 omits it, the employer loses exemplary damages and attorney fees under the Act against that individual.

• Should I ask investors to sign an NDA before I pitch?

  Most venture investors won’t sign one for an initial pitch, and insisting can end the conversation. Founders usually save proprietary technical details for later diligence, when confidentiality agreements are customary.

• Do I need an NDA before selling my business?

  Yes. Sign one before a prospective buyer receives financials, customer data, or other sensitive information. Acquisition NDAs often add nonsolicitation and no contact provisions in case the deal doesn’t close, and sellers should have the NDA reviewed before data room access begins.

• Does an NDA give me ownership of work a contractor creates?

  No. Ownership of work product is a separate issue handled by intellectual property assignment terms. If a contractor is creating software, designs, or content for you, address both confidentiality and ownership before work begins.

• What happens if someone breaches an NDA?

  The disclosing party may sue for breach of contract and, where the information qualifies, trade secret misappropriation. Remedies can include an injunction, damages, and sometimes attorney fees. Acting quickly matters, and an Oklahoma business attorney can assess the claim and the right response.

• Do I need an attorney to draft an NDA?

  For low stakes conversations, many businesses use standard agreements. When the information is central to your business, the other side presents its own form, employees are involved, or a deal is on the line, an NDA attorney in Oklahoma can catch the risks a form will miss and fit the agreement to Oklahoma’s restraint of trade rules.

Structure First, Then Sign

An NDA is one of the simplest contracts your business will sign and one of the easiest to get wrong. The provisions that decide whether it works, from the definition of confidential information to the term, the federal limits, and the choice of law, are judgment calls that depend on what you’re sharing and who is on the other side. A form cannot make those calls for you.

If you’re about to share something valuable, have been handed an NDA to sign, or haven’t looked at your employee confidentiality agreements in years, now is the time to get them right. Our Oklahoma commercial transactions attorneys help businesses structure confidentiality agreements that protect what matters and hold up when they’re tested.

Disclaimer: This article provides general information about nondisclosure and confidentiality agreements and is not legal advice. Whether a particular provision is enforceable depends on the specific agreement, the parties, the information involved, and the governing law. Laws change and every situation turns on its own facts. For guidance on your specific situation, consult qualified Oklahoma counsel.

About Cantrell Law Firm: We are Oklahoma business attorneys and former entrepreneurs who help business owners start, protect, and grow their companies. Learn more about our business and corporate law practice. Contact us to discuss your confidentiality agreements.