A mutual confidentiality agreement usually arrives in your inbox right before a conversation you actually want to have: a partnership pitch, a joint venture discussion, a supplier evaluation, an acquisition talk. A counterparty has sent you their form to sign, or you are filling in a template you downloaded, and you are about to decide how much of your business to expose while you talk.
That document, often called a mutual NDA, is a contract under which both parties promise to keep each other's non-public information secret and use it only for a stated purpose. It is "mutual" because the obligations run both ways, which is what separates it from a one-way NDA where only one side discloses. It does not replace your obligations under privacy law, employment law or the Australian Consumer Law, and it gives way to your longer commercial contracts once a deal is actually struck. What it does, if drafted properly, is create a safe space for the conversation. What follows is a walk through the clauses you will actually sign, what each one does, and where the drafting usually goes wrong.
The Essential Clauses in a Mutual NDA
The purpose clause
A mutual NDA opens by stating why the information is being shared, usually in a single sentence: "to evaluate a potential distribution agreement between the parties". That sentence does more work than it looks like. It defines the only use either party may make of the other's information, and it is the yardstick a court applies if information later shows up somewhere it should not.
The drafting choice that matters most is how wide the purpose is. Too narrow, and you may technically breach the NDA by having the conversation you actually planned. Too broad, such as "for any purpose relating to the business of the parties", gives little real protection because almost any use fits. A useful middle ground names the transaction and the stage, for example "evaluating a potential joint venture, including due diligence and negotiation".
The definition of confidential information
This is usually the longest clause and the one disputes turn on. A good definition captures two things: information that is marked confidential, and information a reasonable person would understand to be confidential from its nature or the circumstances of disclosure. That second limb matters, because in practice most sensitive information travels in conversations and unmarked emails, not in stamped documents.
Watch for these drafting issues:
- Exclusions: the standard carve-outs for information that is already public, independently developed, or rightfully received from a third party. A definition with no exclusions is almost impossible to comply with, because both parties will keep using things they already knew.
- Over-breadth: "all information of either party" sounds protective but makes breaches hard to prove, because if everything is confidential, nothing stands out.
- Marking requirements: if only marked material is covered, an unmarked slide deck or a hallway conversation may fall outside the protection entirely.
- Oral information: where verbal disclosures are covered, the agreement usually requires them to be confirmed in writing within a set period, a practical discipline many businesses skip.
The standard of care
Each party promises to protect the other's information with at least the same degree of care it uses for its own confidential information. That "at least" comparison is the heart of the clause, because a business with loose internal practices sets a low benchmark for itself. Stronger agreements add specific measures, such as access controls, password protection, and limiting disclosure to people who genuinely need to know.
The variant to watch is a clause that requires only "reasonable care" with no benchmark at all, which is vague and hard to enforce. If the other party asks what concrete steps you take to protect information, that is a fair question, and the clause is where your answer should live.
Who may receive the information
An NDA does not protect information from the people who receive it; it protects it from everyone else. This clause limits disclosure to directors, employees, contractors and advisers who need the information for the purpose, and makes the receiving party responsible for ensuring those people keep it confidential. If your staff or contractors are not already bound by confidentiality obligations in their own employment or contractor agreements, the NDA should require you to impose the same duties on them:
- Flow-down: check that the clause actually obliges the receiving party to pass the obligations on to its people, rather than merely permitting disclosure to them.
- Advisers: lawyers, accountants and other professional advisers are usually allowed, but the clause should require them to be bound by their own professional obligations or a written undertaking.
- Related companies: if the receiving party has subsidiaries, decide whether they count as the same party under the agreement or need to be named.
How long the obligations last
Two timeframes matter. The first is how long the agreement runs for the discussion itself, often 12 to 24 months. The second is how long the confidentiality obligations survive after the agreement ends, commonly two to five years. Trade secrets and other information that stays valuable while secret may need protection that lasts as long as the information remains confidential, which can be indefinite.
The trap is a short survival period applied uniformly. Pricing and marketing plans date quickly, but a manufacturing process or an algorithm does not. Consider whether different categories of information need different durations, or whether the agreement should protect trade secrets without a fixed end date.
Return or destruction of information
At the end of the agreement, or when the other party asks, the recipient must return or securely destroy the confidential materials and confirm in writing that it has done so. In practice that confirmation should cover not just the documents but the copies sitting in emails, laptops, phones and cloud backups:
- Archival copy: a carve-out allowing one secure copy to be kept for legal, regulatory or insurance reasons is standard and sensible.
- Backups: make sure the obligation extends to backup systems, or the return-and-destroy exercise is fiction.
- Personal information: if the material includes personal information, destruction also lines up with the obligation under APP 11 of the Privacy Act 1988 (Cth) to destroy or de-identify personal information once it is no longer needed.
Intellectual property and no licence
The NDA should say plainly that sharing information does not transfer any intellectual property rights and does not grant a licence to use the information beyond the purpose. This stops the other party from arguing that your disclosure of designs, source code or branding gave it a right to use them.
If the conversation is heading toward building something together, the NDA is not the place to allocate IP ownership. That belongs in a collaboration or development agreement later, and the NDA should make clear that it does not prejudice such an agreement.
Compelled disclosure
If a party is required by law, a court order or a regulator to disclose confidential information, this clause sets out what must happen: give the other party prompt notice, disclose only what is legally required, and try to preserve confidentiality, for example by seeking a protective order or confidential treatment.
The detail that matters is the notice obligation. Without it, the disclosing party may find out about the disclosure only when it becomes public. The usual drafting requires notice before disclosure where it is lawful to give it, which gives the other side a chance to object or to seek an injunction.
Remedies for breach
An NDA commonly states that damages may be an inadequate remedy and that each party may seek urgent injunctive relief to prevent or stop an unauthorised disclosure. That reflects a practical reality: once information is out, money is cold comfort.
Even without a signed NDA, equity protects confidential information imparted in circumstances importing an obligation of confidence, and Australian courts have granted injunctions to stop the use of confidential information, as in Worth Recycling Pty Ltd v Waste Recycling and Processing Pty Ltd [2009] NSWCA 354. The remedies clause makes that protection explicit and contractual, and it lets you point to a signed document when you ask a court to move quickly.
Governing law and jurisdiction
Pick a governing law, usually the state where the main party is based, and a court or arbitration forum. Australian state laws are broadly similar in this area, but the choice removes an argument about which rules apply if a dispute arises. If you are the party signing someone else's form, this is the clause to check last but not least, because it decides where you would have to fight.
Optional Clauses to Consider
Not every mutual NDA needs these, but each has a trigger that makes it worth raising:
- Residual knowledge carve-out: worth discussing when a consulting or technology firm's staff will carry general knowledge between engagements. If you allow it, limit it to what is retained in unaided memory and carve out source code and customer data.
- Non-solicitation and non-compete restraints: consider adding if the talks could let the other party poach your customers or staff. Restraints are only enforceable to the extent they are reasonable in scope, geography and duration, and badly drafted cascading clauses can raise uncertainty problems courts will not fix for you, as OAMPS Insurance Brokers Ltd v Hanna [2010] NSWSC 781 illustrates.
- Privacy and data-handling schedule: include when personal information will be shared. The NDA cannot override the Privacy Act 1988 (Cth), and APP 11 already requires reasonable steps to protect personal information from unauthorised access or disclosure, so the schedule can set out the specific measures on top of that baseline.
- Specific security standards: for software builds, demos or integrations, where you want minimum technical measures such as encryption, access logs and breach notification rather than a general care standard.
- Publicity and announcement restrictions: useful where either party might want to announce the deal, or where one party is listed and has continuous disclosure obligations.
Getting an Artificer Legal Lawyer to Review Your NDA
A lawyer reviewing a mutual confidentiality agreement on your behalf works through it in a particular order, and the order matters. We would start with the definition of confidential information and the purpose clause, because together they fix what is protected and what it may be used for. We would then check the exclusions, the need-to-know limits and the flow-down obligations, then the survival period, return and destruction mechanics, and the remedies clause. Execution comes last but is not optional: for an Australian company, the document must be signed by the right people.
Under s 127 of the Corporations Act 2001 (Cth), a company executes a document if it is signed by two directors, or a director and a company secretary, or, for a proprietary company with a sole director who is also the sole secretary or where there is no secretary, that director. Electronic signatures are generally valid: the Electronic Transactions Act 1999 (Cth) provides that a transaction is not invalid merely because it took place by electronic communication, and it recognises a signature that identifies the person and indicates their intention.
We would also push back on the clauses that quietly hurt you: definitions that are all breadth and no exclusions, purposes drafted to cover any future use, survival periods that expire while trade secrets are still live, and remedy clauses that mention only damages. And we would flag what sits outside the NDA. If personal information is involved, privacy obligations under the Privacy Act 1988 (Cth) apply alongside the contract, and s 18 of the Australian Consumer Law, which is Schedule 2 of the Competition and Consumer Act 2010 (Cth), means the NDA cannot be used to hide conduct that misleads or deceives anyone.
The Clause Most Mutual NDA Disputes Turn On
If a mutual NDA ever ends up in a dispute, the first question the court asks is whether the leaked information fell within the definition of confidential information. Everything else in the agreement assumes that definition, which is why it is the most misdrafted clause and the one to read first, whether you drafted the document or received it. A definition that only covers marked documents leaves your most valuable conversations unprotected, and a definition with no exclusions is impossible to comply with in practice. The version that works is one that captures everything a reasonable person would understand to be confidential, in any form, with the standard exclusions carved out.
A mutual confidentiality agreement is a short document with real consequences. Get the purpose and the definition right, keep the operational clauses practical, make sure the correct entity signs, and treat the NDA as the first layer of protection rather than the last. When the conversation moves toward a deal, the NDA gives way to your heads of agreement and long-form contracts, and a lawyer can help you make that transition cleanly so the information you shared in good faith stays protected either way.