Non-Disclosure Agreements (NDAs) in the UK: A Complete Guide | LegalDocuments.co.uk

At a glance

• What it is: a contract (sometimes combined with the general equitable duty of confidence) that restricts how specified information can be used or shared.
• Legal basis: ordinary contract law, plus the equitable duty of confidence recognised in Coco v A N Clark (Engineers) Ltd [1969] RPC 41 (see below) — not a standalone statute.
• Two main types: unilateral (one party discloses, one party is bound) and mutual (both parties disclose and both are bound).
• What it can never validly stop: reporting a crime to the police (common law), making a protected disclosure under whistleblowing law — s.43J Employment Rights Act 1996 — or, for NDAs signed on or after 1 October 2025, a victim of crime disclosing to specified people under s.17 Victims and Prisoners Act 2024.
• Coming, not yet law: the Employment Rights Act 2025 will void NDAs that block workers speaking out about workplace harassment or discrimination, but this measure has no commencement date at the time of writing.
• Trade secrets: get an additional statutory layer of protection under the Trade Secrets (Enforcement, etc.) Regulations 2018, on top of contract and equity.
• Typical duration: commonly two to five years in commercial practice, though this is a drafting choice, not a fixed rule — courts expect the term to be reasonable for the interest being protected.

What is a Non-Disclosure Agreement?

A Non-Disclosure Agreement, sometimes called a confidentiality agreement, is a legally binding contract between two or more parties who need to share information that should not be made public or passed on to competitors. The agreement defines what counts as confidential, sets limits on how that information can be used, and creates a remedy if those limits are breached.

NDAs tend to appear at the start of a commercial relationship: before a deal is signed, before employees start work on a sensitive project, or before two businesses begin exploring whether to work together. They can stand alone as a single document, or they can be built into a wider contract such as an employment agreement, a shareholders' agreement, a settlement agreement, or a supplier contract.

Under the law of England and Wales, NDAs are enforceable in the same way as any other commercial contract, provided they are drafted reasonably and protect a genuine interest. But an NDA does not sit in a legal vacuum — several specific legal limits, described below, exist regardless of how the agreement is worded.

The legal basis: contract and the duty of confidence

An NDA is enforced as a contract, so it needs the usual ingredients to be valid: an offer and acceptance, consideration (something of value passing between the parties, which can simply be the mutual promise to keep information confidential), certainty of terms, and an intention to create legal relations.

Separately, English law recognises an equitable duty of confidence that can arise even without a signed agreement. The leading authority is Coco v A N Clark (Engineers) Ltd [1969] RPC 41, which set out three elements needed to establish a breach of confidence: first, the information must have the necessary quality of confidence about it (it isn't already public); second, it must have been shared in circumstances importing an obligation of confidence (the recipient knew, or ought to have known, it was meant to stay private); and third, there must be unauthorised use of the information to the discloser's detriment.

In practice, this means confidential information can sometimes be protected even without a written NDA. But relying on the general law alone is risky — it leaves the scope of what's protected, the duration of the obligation, and the available remedies to be argued about after the fact. A properly drafted NDA removes that uncertainty by spelling out all three elements in advance and adding contractual remedies on top.

Unilateral vs mutual NDAs

Most NDAs fall into one of two categories:

• Unilateral (one-way) NDA. Only one party is disclosing sensitive information, and only that party's information is protected. This is typical where a business is sharing product plans, financial data, or trade secrets with a contractor, supplier, or potential investor who isn't sharing anything comparably sensitive in return.
• Mutual (bilateral) NDA. Both parties will be sharing confidential information, so both sides owe obligations to each other. This is the right structure for merger and acquisition discussions, joint ventures, and product collaborations, where each business is opening up its own sensitive information to the other.

Using a unilateral NDA when both sides are genuinely exchanging sensitive information is a common drafting mistake — it leaves the party who signed as the "receiving party" with no protection for what they disclose in return.

What an NDA can and cannot lawfully restrict

This is the part of NDA law that generates the most confusion, and the part where getting it wrong is expensive. An NDA can validly protect genuine commercial and confidential information. It cannot validly be used to silence certain categories of disclosure, no matter how broadly it is drafted.

It cannot stop someone reporting a crime to the police

Under the common law, a person cannot be validly prevented from reporting a crime to the police, or from making disclosures to other bodies with statutory investigative or regulatory functions. This applies to everyone — not just employees — and to every NDA, regardless of when it was signed.

It cannot stop a worker blowing the whistle

Under section 43J of the Employment Rights Act 1996, any provision in an agreement between a worker and their employer is void so far as it purports to preclude the worker from making a protected disclosure under the UK's whistleblowing framework — for example, disclosing a criminal offence, a breach of a legal obligation, a miscarriage of justice, danger to health and safety, or environmental damage, where the worker reasonably believes disclosure is in the public interest. This applies to any agreement, whether or not it is called an NDA, and it doesn't matter how the clause is worded — a clause that has this effect is simply unenforceable to that extent. More detail on the framework is on GOV.UK's whistleblowing guidance.

It cannot stop a victim of crime getting help or reporting — for NDAs signed since 1 October 2025

Since 1 October 2025, section 17 of the Victims and Prisoners Act 2024 makes any NDA signed on or after that date void so far as it purports to preclude a victim of crime — or someone who reasonably believes they are a victim — from disclosing information about the "relevant conduct" to a defined list of people, for defined purposes: the police or other bodies with law-enforcement functions (to help them investigate or prosecute), a qualified lawyer (to get legal advice), a regulated professional such as a doctor (to get professional support), a regulator (to cooperate with an investigation), a recognised victim support service (to get support), and a child, parent or partner (for personal support). Since 12 December 2025, this list also covers disclosures to the Criminal Injuries Compensation Authority and to a tribunal or court when challenging a CICA decision.

This is a narrower right than it might first sound: it does not make the whole NDA void, only the parts that would block a permitted disclosure to a permitted recipient for a permitted purpose. Disclosing for the purpose of putting the information into the public domain — for example, briefing a journalist — is expressly excluded and remains a potential breach. It also only applies to NDAs signed on or after 1 October 2025; agreements signed earlier are governed by the position that applied before the Act, under which the common law crime-reporting protection above still applies, but the wider victim-support disclosures did not have the same statutory backing.

Worked example. Priya signs a broadly worded settlement NDA with her employer in November 2025 after raising a workplace complaint. The conduct she complained about also amounts to a criminal offence. Under section 17, the NDA cannot validly stop her reporting the matter to the police, discussing it with a solicitor to get advice, telling her GP so she can get support, contacting a specialist support charity, or confiding in her partner. It can still validly stop her selling the story to a newspaper, because that disclosure's primary purpose is putting the information into the public domain, which section 17(3) does not protect.

It cannot yet stop NDAs covering workplace harassment or discrimination — but a change is coming

The Employment Rights Act 2025 will insert a new section 202A into the Employment Rights Act 1996, voiding an NDA between an employer and a worker where it seeks to prevent the worker speaking out about "relevant harassment or discrimination" under the Equality Act 2010, or about the employer's response to it. This measure is not yet in force. At the time of writing, the government has not announced a commencement date; it is consulting on the detail, including the conditions for a valid "excepted agreement," and the measure will not apply retrospectively once it is commenced. Until then, existing NDAs covering harassment or discrimination allegations remain governed by the general law described in this guide, not by this specific statutory bar — always check GOV.UK and legislation.gov.uk for the current commencement position before relying on this.

It cannot be used to silence certain higher-education complaints

Separately, from 1 August 2025, higher education providers in England are barred from entering into NDAs with staff, students, members or visiting speakers about complaints of sexual abuse, sexual harassment, sexual misconduct, or other bullying or harassment; an NDA that purports to do this is void. This is a narrow, sector-specific rule and won't apply to most commercial NDAs, but it matters if your NDA involves a university or other registered higher education provider.

Key clauses to get right

1. Identify what actually needs protecting. Before you draft anything, list the specific information you want to keep confidential — product designs, client lists, financial figures, source code, supplier terms, strategic plans. A vague NDA that tries to cover "everything" can be harder to enforce than one that clearly describes the information at stake.
2. Decide whether the agreement is unilateral or mutual. See above — get this wrong and one side may end up with no protection for what they share.
3. Set a sensible duration and scope. NDAs should specify how long the confidentiality obligation lasts and who is covered. Trade secrets and technical know-how may justify indefinite protection; routine commercial data might only need a few years. A court is more likely to enforce a restriction that is proportionate to the legitimate business interest being protected — an indefinite, blanket restriction with no carve-outs is a target for challenge.
4. Include the standard carve-outs. Most NDAs exclude information that is already public, was already known to the receiving party, is independently developed without reference to the confidential information, or must be disclosed by law, regulator, or court order. Missing these carve-outs risks the agreement being seen as unreasonable, and can make a counterparty unwilling to sign at all.
5. Build in the non-negotiable statutory limits. Rather than leaving whistleblowing, crime-reporting, and (where relevant) victim-support disclosures to be worked out later, well-drafted NDAs now state expressly that nothing in the agreement affects a worker's rights under section 43J of the Employment Rights Act 1996 or a victim's rights under section 17 of the Victims and Prisoners Act 2024. This doesn't weaken the NDA — those rights apply regardless of the wording — but it avoids the agreement giving a misleading impression of what it actually restricts.
6. Spell out what happens if it's breached. Set out the consequences of a breach, including the right to seek an injunction to prevent further disclosure and damages for losses suffered. Clear remedies make the NDA easier to enforce and signal that the confidentiality obligations are serious.

Trade secrets and other protections that sit alongside an NDA

Where the information in question qualifies as a trade secret — broadly, information that is genuinely secret, has commercial value because it is secret, and has been subject to reasonable steps to keep it that way — it also benefits from a separate statutory regime under the Trade Secrets (Enforcement, etc.) Regulations 2018 (SI 2018/597). These regulations sit alongside, rather than replace, the common law and equitable protection described above, and they give trade secret owners additional remedies, including orders for delivery up or destruction of material derived from the misused information.

An NDA and trade secret protection are not a substitute for other IP protection. If your project involves inventions, brand names, or creative works, you may also need patents, trade marks, or copyright protection, and — where ownership of IP created during the relationship needs to change hands — a separate assignment agreement. This is especially relevant in joint development or collaborative innovation arrangements, where an NDA protects the conversation but doesn't by itself resolve who owns what gets created.

What happens if an NDA is breached

The innocent party can usually pursue an injunction to stop further disclosure or use of the information, and damages to compensate for losses suffered. Where the information is a trade secret, the 2018 Regulations add further remedies. Proving financial loss from a pure confidentiality breach can be genuinely difficult — which is why many NDAs include a liquidated damages clause, fixing in advance a sum payable on breach rather than requiring the innocent party to prove exact losses after the event.

Speed matters. Delay in applying for an injunction can itself count against the applicant, because courts are generally reluctant to grant urgent relief where the innocent party has sat on the issue. If a breach happens or is about to happen, taking early advice — including, where relevant, sending a formal cease and desist letter — is usually the first practical step.

Practical steps for using an NDA in your business

1. Work out whether you actually need one, or whether you need something more specific — for example an assignment agreement if ownership of IP is the real issue, not just confidentiality.
2. Decide unilateral or mutual based on who is actually disclosing sensitive information.
3. Describe the confidential information precisely, rather than relying on a catch-all definition.
4. Set a duration proportionate to how long the information will matter, and build in the standard carve-outs.
5. Don't try to draft around the statutory limits. Section 43J (whistleblowing) and, for post-1 October 2025 agreements, section 17 (victim disclosures) apply regardless of what the NDA says — attempting to exclude them doesn't work and can undermine confidence in the rest of the agreement.
6. Keep a record of what was signed and when, particularly given the changing law — the date an NDA is signed can determine which statutory protections apply to it.
7. Take advice before you sign or send an NDA that covers a genuinely high-value or high-risk relationship — a template is a starting point, not a finished document, for anything commercially significant.

This guide provides general information about how Non-Disclosure Agreements work under the law of England and Wales. It is not legal advice and is not a substitute for advice tailored to your specific circumstances. The law described was accurate as at July 2026 and is subject to change — in particular, the Employment Rights Act 2025 measure on harassment and discrimination NDAs is not yet in force, so always check GOV.UK and legislation.gov.uk for the current position before relying on this guide.

Last reviewed: July 2026 by a non-practising solicitor · Next review due: July 2027 or on legislative change.