NDA review: what would you agree to keep confidential?

Clause 7 requires the Recipient to indemnify the Discloser against "all losses of any kind arising from any disclosure, without a financial limit and regardless of fault". Read with clause 3 (prior written consent required for advisers, contractors and cloud providers) and clause 5 (indefinite confidentiality), even an innocent or lawfully compelled disclosure could trigger unlimited liability. There is no cap, no exclusion of indirect or consequential loss and no fault qualifier. The clause also reserves injunctive relief and other remedies, and it does not state whether it limits the Recipient's other obligations; that interpretation point should be recorded rather than assumed. Clause 4 imposes a reasonable-care standard but clause 7 does not link liability to breach of that standard.

Negotiation guidance: Alder Signal will want a strong remedy for sensitive information. The Recipient can accept a robust injunction right and a meaningful damages cap, but an unlimited, fault-neutral indemnity is disproportionate for a pre-award evaluation and should be traded against acceptance of the standard exclusions and permitted-recipient language.

The combination of "all losses", "without a financial limit" and "regardless of fault" turns any disclosure, including one occurring despite reasonable care, into an unlimited financial exposure. Nothing later in the document offsets it: clause 4's reasonable-care standard is not linked to clause 7, and clause 5's indefinite survival means the exposure does not expire when the two-year term ends.

Preferred position: A breach-based liability provision limited to direct losses up to a negotiated cap, excluding indirect and consequential loss, with injunctive relief preserved for actual or threatened misuse.

Fallback position: If the Discloser insists on retaining an indemnity, add fault and causation wording, cap it at the greater of the fees actually payable and a fixed negotiated sum, and exclude indirect and consequential loss.

Financial impact: Unlimited on its face. For illustration only, the Recipient might propose a cap at the greater of the fees actually payable for the project and a fixed sum such as GBP 250,000, but the clause as written sets no ceiling.

Clause 2 captures all information disclosed in any form, whether marked or not, and expressly states that "No exceptions apply for information that becomes public, was already known to Recipient or is developed independently." Read with the indefinite survival in clause 5 and the uncapped indemnity in clause 7, the Recipient would carry perpetual obligations over public material, information it already held, and information it independently developed. This is particularly acute for an independent market research firm, which may already possess industry data or develop comparable methodology and could be accused of misuse for relying on its own prior or independently created knowledge. The clause also makes no exception for information lawfully received from a third party.

Negotiation guidance: The exclusions do not weaken protection of genuinely confidential material; they only prevent the Discloser from claiming confidentiality over what is already public or already the Recipient's. Alder Signal should have little difficulty accepting them.

The second sentence deliberately removes the protections that make an NDA workable, so the Recipient cannot use its own pre-existing know-how or public information and has no contractual defence to a misuse claim. This is an express allocation of risk, not a boilerplate gap, and it feeds directly into the uncapped indemnity.

Preferred position: A definition of Confidential Information subject to exclusions for public domain, prior lawful possession, independent development and lawful third-party receipt.

Fallback position: If the Discloser will not accept all four exclusions, prioritise prior possession and independent development, which a research firm most needs, and at minimum remove the express statement that no exceptions apply.

Financial impact: Not directly quantifiable; exposure flows through the uncapped indemnity in clause 7.

Clause 5 provides that the agreement lasts two years but that the Recipient's confidentiality and use obligations continue indefinitely for all Confidential Information, including material that is no longer commercially sensitive. Read with clauses 2 and 7, the Recipient carries a perpetual obligation over anything ever disclosed, even after the information has lost value or become public, and there is no point at which the Recipient can safely assume it is free of the restriction.

Negotiation guidance: The real concern is the absence of any end date, not the length of a reasonable term. A seven-year outer limit for genuine trade secrets should be acceptable and keeps the arrangement manageable for the Recipient.

Perpetual obligations over all information, including information that is no longer commercially sensitive, are disproportionate and create an open-ended compliance burden. The absence of any end date, rather than the length of a reasonable term, is the core problem.

Preferred position: Confidentiality for a fixed term, typically three to five years, with a longer finite term only for identified trade secrets while they remain trade secrets.

Fallback position: If the Discloser wants longer protection, accept a five-year general term with a seven-year term for information expressly marked as a trade secret at disclosure, retaining the public-domain and independent-development exclusions.

Financial impact: Not directly quantifiable; linked to the uncapped indemnity in clause 7 for as long as the obligation lasts.

Clause 6 requires the Recipient, within two business days of a request, to permanently delete all Confidential Information including every backup, archive and record required by law, and to certify that no copy remains. This is operationally impossible for standard backup systems and would require deletion of records the Recipient may be legally obliged to retain. The absolute certification compounds the problem because the Recipient could not honestly certify that no copy remains while backups persist. The clause is also one-sided and contains no retention right for the Recipient's own compliance purposes.

Negotiation guidance: The Discloser's aim is to stop continued use, not to force destruction of legally required records or an active backup. A documented retention exception with continuing confidentiality achieves the same protection.

The clause forces the Recipient to choose between breaching the contract and breaching legal or regulatory retention duties, and the two-business-day deadline is unrealistic for backup and archive systems. Retaining regulatory copies while keeping them confidential preserves the Discloser's protection without creating an unavoidable breach.

Preferred position: Return or deletion of Confidential Information within a reasonable period, with retained copies limited to legal and regulatory requirements and backups, all subject to continuing confidentiality.

Fallback position: If the Discloser insists on a short period, accept 15 days for active systems while agreeing a longer period for backup overwrite and a carve-out for legally required records.

Financial impact: Not directly quantifiable; breach of this clause would feed into the liability and indemnity position in clause 7.

Clause 3 allows disclosure to employees on a need-to-know basis but requires the Discloser's prior written consent "in each case" for any disclosure to professional advisers, contractors or cloud service providers. This conflicts with the way research firms operate, using external advisers, sub-contractors and cloud storage, and interacts with clause 7 because a disclosure made without consent would be a breach and, on the current wording, could trigger unlimited fault-neutral liability. The consent requirement is not tied to any sensitivity assessment and so constrains routine administrative handling.

Negotiation guidance: The protection Alder Signal needs is flow-down confidentiality, not control over every vendor engagement. A notice-and-objection mechanism gives it that without freezing the Recipient's operations.

A per-instance written-consent requirement creates an operational bottleneck and a continual breach risk on every engagement, especially where cloud providers change over time, without any link to the sensitivity of the information.

Preferred position: Disclosure permitted to employees, professional advisers and contractors under equivalent confidentiality obligations, with the Recipient liable for those recipients.

Fallback position: Keep prior written notice for named categories of service providers, with consent deemed given if the Discloser does not object within five business days.

Financial impact: Indirectly, through the uncapped indemnity in clause 7 if a consent is missed.

The document is headed "NON-DISCLOSURE AGREEMENT — FICTIONAL DEMONSTRATION" and states that all organisations and transaction details are fictional. It names Alder Signal Ltd. as Discloser and Cedar Research Ltd. as Recipient but does not identify individuals, contact addresses or signatories, and clause 9 states that there are no attachments. Before use as a binding agreement, the parties' correct legal names, registered numbers, notice contacts and the proposed market research project must be confirmed and the demonstration language removed.

Negotiation guidance: This is an administrative point but it should be resolved before signature rather than left to interpretation later.

A demonstrative draft with fictional details cannot be relied on as a binding agreement, and the illustrative identities and purpose may not match the transaction the parties actually intend to document.

Preferred position: Executable agreement with the parties' correct legal details and a specific defined Purpose.

Clause 8 provides that a notice takes effect only when acknowledged by the recipient, excluding automated acknowledgements, and that if no acknowledgement is received within two business days the sender must arrange delivery by hand. No deemed-receipt rule exists. Read with clause 6, a time-critical deletion request could fail to take effect if the Recipient's contact does not acknowledge it, and a party could rely on non-acknowledgement to defeat notice in a dispute. The two-business-day hand-delivery fallback is slow and impractical for routine requests.

Negotiation guidance: The Discloser's concern is being able to prove notice. A deemed-receipt rule with a delivery-failure exception is easier to administer than an acknowledgement condition and reduces disputes about timing.

Making effectiveness depend on the recipient's acknowledgement transfers control of notice timing to the recipient, which is inappropriate where notice may trigger a compliance deadline, and the hand-delivery workaround is slow for routine requests.

Preferred position: Deemed receipt one business day after email sent on a business day, absent a delivery-failure notification.

Fallback position: Two business days after sending if a one-business-day rule is resisted, with a defined contact address that either party may update in writing.