A non-disclosure agreement (NDA) is a contract in which one party promises to keep information it receives secret, and to use that information only for a purpose the other party has agreed to. It is one of the cheapest ways for an Australian small business to share ideas, pricing, customer lists or prototypes without giving away its competitive edge.
This guide explains what an NDA actually is, the kind of information it protects, the clauses that make it work, and the limits of what it can do for you.
What an NDA is
An NDA, also called a confidentiality agreement in Australia, is a contract between a discloser and a recipient. The discloser hands over information, and the recipient promises not to reveal it to anyone else and not to use it for anything other than the agreed purpose. If the recipient breaks those promises, the discloser can sue for breach of contract and seek damages or a court order stopping the misuse.
NDAs come in two forms. A one-way (unilateral) NDA protects only the party doing the disclosing. A mutual NDA protects both parties, and is the cleaner choice when you and the other side are both sharing information, for example while exploring a joint venture or a partnership.
An NDA does not replace your main contract. It sets the ground rules for information shared during early discussions, before you sign a services, supply or investment agreement. Once the deal proceeds, the main contract usually carries confidentiality obligations of its own, and the two documents should line up.
What counts as confidential information
The whole concept turns on the idea of confidential information. Not everything you share is protected, even with a signed NDA. Australian courts recognise that information only attracts protection when it has certain features. The High Court confirmed this in Smith Kline & French Laboratories (Aust) Ltd v Secretary, Department of Community Services and Health [1991] HCA 13, where a pharmaceutical company's drug registration data, supplied to a government department for a limited purpose, was held to attract an equitable obligation of confidence.
Three features matter. First, the information must have the necessary quality of confidence: it must not be public knowledge, and it must not be trivial or commonplace. Second, it must have been imparted in circumstances importing an obligation of confidence, such as a meeting where both sides know the material is sensitive. Third, there must be an actual or threatened misuse of the information, such as disclosure to a competitor or use beyond the agreed purpose.
A critical point follows. Equity protects confidential information even without a signed NDA. In the Smith Kline case, the obligation arose from the circumstances of the disclosure alone. What an NDA adds is clarity and contract: it pins down exactly what information is protected, who may see it, and what happens if the promises are broken. It turns a vague expectation of secrecy into a document a court can enforce.
For a typical Australian small business, confidential information includes technical material (source code, product designs, manufacturing methods), commercial material (pricing models, customer lists, supplier rates, marketing strategies) and business plans. It also includes information marked as confidential, provided it is identified and treated as secret in practice.
The core clauses of an NDA
A well-drafted NDA is short and practical. Its job is to answer three questions: what is protected, what may the recipient do with it, and what happens if things go wrong. The clauses that answer those questions are:
- Definition of confidential information: the agreement should identify the categories of information protected, covering material disclosed in writing and verbally, with a sensible process for confirming verbal disclosures in writing within a short period.
- Permitted purpose: state precisely why the information is being shared, such as to evaluate a potential investment, and restrict the recipient to that purpose unless you give prior written consent.
- Access within the recipient's team: limit use to the recipient's employees, officers and professional advisers who genuinely need to know, and require the recipient to bind its subcontractors to equivalent obligations in writing.
- Exclusions: it is standard to carve out information that is already public through no fault of the recipient, already known to the recipient, independently developed without using your information, or required to be disclosed by law with notice to you where possible.
- Return or destruction: require the recipient to return or destroy the information, including copies, notes and backups, when the purpose ends or you ask.
- Term and survival: set a sensible confidentiality period, commonly two to five years, while recognising that trade secrets may need longer protection. Confirm that the obligations survive the end of the NDA.
- Remedies: confirm the discloser's right to seek an injunction, a court order stopping disclosure or misuse, as well as damages for any loss caused by a breach.
- Governing law and jurisdiction: nominate the Australian state or territory law that applies, so a dispute is heard in a predictable forum.
Execution matters too. A company can sign an NDA under s 127 of the Corporations Act 2001 (Cth), for example by two directors, or a director and the company secretary, and a proprietary company with a sole director can execute with that director's signature alone. Electronic signatures are generally valid in Australia: under s 10 of the Electronic Transactions Act 1999 (Cth), a signature requirement is met where a reliable method identifies the signer and indicates their intention. NDAs are usually simple agreements, but a deed may be preferable where there is no consideration, since a deed does not require consideration to be enforceable.
An NDA in practice: a worked example
Consider Maya, who runs a small logistics software company in Adelaide. She is courting a potential investor and agrees to share her routing algorithm, her customer acquisition costs and her client list under a one-way NDA. The NDA defines the information, limits it to evaluating a possible investment, and requires the investor to destroy everything if no deal proceeds.
The investor passes on the deal. Six months later, Maya learns the investor has launched a competing app using an almost identical routing approach, built with the help of a developer who had access to Maya's material under the NDA.
Maya's position is strong because the NDA does the heavy lifting. She can point to the definition to identify the specific documents and data that were protected. The permitted purpose clause shows the investor was entitled to use the information only to evaluate the deal, not to build a competitor. The access clause shows the developer should have been bound by equivalent obligations. If the investor has not destroyed the material, the return and destruction clause gives Maya a further, straightforward claim.
Her remedies follow the breach. She can seek an interlocutory injunction to stop the investor using her material while the case runs, which is often the most important remedy because it prevents further damage before trial. She can also claim damages for lost business, and she can rely on the equitable action for breach of confidence in Smith Kline [1991] HCA 13 as a backstop. Without the NDA, her claim would depend on proving the information was confidential and was shared in circumstances importing an obligation of confidence, a harder case to run.
Common misconceptions about NDAs
Several misunderstandings cause real problems for small businesses:
- An NDA protects my idea on its own: it does not. An NDA protects information that is confidential. It cannot stop a recipient from independently developing the same idea, or from using general knowledge and skills they already had. If your value lies in an idea that can be reverse engineered once disclosed, an NDA will not stop a determined competitor; secrecy has to be supported by how you actually handle the information.
- No NDA means no protection: wrong, as the High Court confirmed in Smith Kline. Equity can protect confidential information even where no contract exists. But an NDA makes the obligation explicit, easier to prove, and enforceable in contract with remedies that equity alone may not provide. Relying on an unwritten obligation of confidence is risky, not impossible.
- An NDA is the same as privacy compliance: it is not. If the information you share includes personal information about individuals, the Privacy Act 1988 (Cth) and the Australian Privacy Principles in its Schedule 1 impose separate obligations on how that information is collected, used and stored, including a requirement to maintain a current privacy policy. An NDA does not displace privacy law, and privacy law does not protect your trade secrets. The two regimes run in parallel.
- An NDA protects ownership of my IP: it protects secrecy, not ownership. Registering a trade mark, or relying on copyright or patent protection, is what secures ownership of your brand and creations. An NDA can stop someone using your information; it does not by itself stop someone using your brand or copying your product where IP law gives you a remedy.
- Signing is the finish line: signing is the start. To enforce an NDA you must be able to identify what was shared, when, under which terms, and show the recipient used it outside the agreed purpose. Records of disclosure matter, and an NDA with an overseas party raises questions of jurisdiction and enforcement that deserve careful thought before you sign.
How legal counsel can assist with NDAs
A lawyer's value on an NDA is mostly in the tailoring. A solicitor can draft a definition of confidential information that matches the actual data and documents your business handles, review the other side's NDA for clauses that bind you too broadly or too long, and negotiate changes rather than accepting a template that favours the other party. Where a deal is mutual, a lawyer can balance the obligations so both sides carry the same weight. Where the other party is overseas, a lawyer can advise on governing law, jurisdiction and how a judgment would be enforced, and whether a deed is preferable to a simple agreement.
A lawyer also connects the NDA to the rest of your documentation. Confidentiality clauses in employment contracts, contractor agreements and your eventual main contract should align with the NDA so obligations do not drift apart. If you are sharing personal information, a lawyer can check that your privacy compliance, including your privacy policy, sits alongside your confidentiality arrangements.
The question your NDA will be asked
If a dispute ever reaches court, the question will not be whether you had an NDA. It will be whether the information you shared was genuinely confidential, whether you treated it as secret in practice, and whether the recipient's use went beyond what you agreed. An NDA answers those questions in advance. Before you hand over anything sensitive, decide what is confidential, make sure the definition in your NDA captures it, and keep a record of what was shared and under what terms. That habit, more than the document itself, is what makes an NDA work.