Confidentiality Agreements (NDAs) in the UK: Drafting and Signing Best Practices

In practice, "confidentiality agreement" and "non-disclosure agreement" describe the same thing: a contract that imposes obligations of confidentiality on those who receive sensitive information. The terms are used interchangeably in the UK, so there is no meaningful legal difference between them.

What does vary is the structure. A one-way (unilateral) NDA protects information flowing from one party to another — for example when you share plans with a contractor. A mutual NDA protects information shared in both directions, common when two businesses explore a partnership. Our guide to confidentiality agreements covers these forms in more detail.

The three main structures are:

1. One-way NDA. One party discloses; the receiving party keeps it confidential.
2. Mutual NDA. Both parties disclose and both owe obligations of confidentiality.
3. Standalone or clause. Confidentiality can be a full agreement or a clause within a larger contract.

An NDA earns its place whenever you need to share something valuable before a relationship is formalised. The common thread is that sensitive information leaves your control, so you want a legal obligation on the person receiving it.

The most common situations are:

1. Investment and fundraising. Before showing financials or forecasts to a potential investor.
2. Mergers and acquisitions. During due diligence, when a buyer inspects your confidential records.
3. Supplier and partner talks. When sharing trade secrets, designs, processes, or intellectual property with a third party.
4. Employment and consultancy. To protect client lists, know-how, and commercially sensitive information when people join or leave.

There is also a difference between a standalone NDA and a confidentiality clause built into a wider contract, and it is worth choosing deliberately. A standalone agreement suits early, exploratory talks where no other contract yet exists — such as before due diligence begins. A clause within a services or employment contract is often cleaner once a relationship is formalised, because it keeps all the obligations in one place. Either way, the confidentiality obligations should survive the end of the wider relationship, so that sensitive information stays protected long after the parties stop working together.

Yes, but the precise rules differ by jurisdiction. In England and Wales, a confidentiality agreement is legally binding and enforceable provided it meets the normal requirements of a valid contract: offer, acceptance, an intention to create legal relations, and consideration. Once signed, both the disclosing and receiving parties must keep to what has been agreed, and a breach can lead to an injunction or a claim for damages.

In Scotland, the position is different: Scottish contract law does not require consideration to form a binding contract, meaning an NDA can be enforceable even where no payment or benefit is exchanged. Consent alone is sufficient. Businesses operating across UK borders should ensure their agreements are reviewed against the law of the applicable jurisdiction.

Enforceability also depends on drafting. A court is far more likely to uphold an NDA that is clear, reasonable in scope, and limited to genuinely confidential information than one that tries to lock down everything indefinitely. ACAS guidance on using non-disclosure agreements stresses that NDAs should be specific rather than blanket.

If a party breaks the agreement, the disclosing party has several options. They can seek an injunction to stop further disclosure, claim damages for losses caused by the breach, or in some cases pursue an account of any profit the other party made from misusing the information. In practice, the threat of these remedies is often enough to deter misuse — which is much of the value an NDA provides in the first place.

A well-drafted NDA defines its terms tightly so both parties know exactly what is covered. The following clauses form the backbone of most agreements.

Permitted disclosures matter especially. A sound NDA always allows a party to disclose where required by law, to a regulator, or to professional advisers — including employees' professional advisers — bound by their own confidentiality. Leaving these carve-outs out can make the whole clause look unreasonable and risk its enforceability.

The definition of confidential information deserves particular care. Too narrow, and genuinely sensitive material falls outside the agreement; too broad, and a court may find the whole clause unreasonable and refuse to enforce it. Good practice is to describe categories of protected information clearly — such as trade secrets, intellectual property, pricing data, and commercially sensitive business plans — and to exclude anything already in the public domain or independently known to the receiving party.

The duration should also be proportionate: a fixed number of years for most commercial information, with genuine trade secrets protected for as long as they stay secret.

The legal landscape around NDAs has tightened significantly. Two developments matter most for anyone drafting them today.

First, the Solicitors Regulation Authority has issued a warning notice making clear that NDAs must not be used to prevent people from cooperating with criminal investigations, reporting to regulators, or seeking medical or legal advice. The SRA guidance on non-disclosure agreements (updated August 2024) applies to solicitors who draft them and sets a clear standard of good practice across England and Wales.

Second, the Victims and Prisoners Act 2024 — changes to non-disclosure agreements make any confidentiality clause void to the extent it tries to stop a victim of crime disclosing information about that crime to the police, a regulator, a legal adviser, or certain support contacts. These provisions apply in England and Wales only. The main provisions came into force on 1 October 2025; two further categories of permitted disclosure — relating to the Criminal Injuries Compensation Authority (CICA) — apply from 12 December 2025. All of these changes apply to NDAs signed on or after those respective dates. Agreements signed before 1 October 2025 remain subject to the previous rules.

For employers, the practical takeaway is to separate two very different uses of confidentiality. Protecting trade secrets, pricing, and client information is legitimate and enforceable. Trying to buy silence about wrongdoing is neither, and increasingly carries legal and reputational risk. Any NDA template that has not been checked against the current law — particularly if it pre-dates October 2025 — should be revisited before it is used again.

For most businesses, the safest approach is to keep a small set of well-drafted templates — one for one-way disclosures and one for mutual agreements — and to have them reviewed periodically by a legal adviser. That avoids the temptation to reuse an old NDA that no longer reflects the law, and it means the person signing is presented with a clear, proportionate document rather than an intimidating catch-all that a court might decline to enforce.

A strong NDA is clear, proportionate, and properly executed. The following practices help your agreement hold up and reflect current expectations.

Getting the signing method right is part of enforceability. Our guide on what type of signature to choose helps you match the signature to the risk, and our explainer on the legal value of signature initials clears up a common source of confusion. For businesses managing high volumes of agreements, our overview of AI contract agents shows how drafting and review can be streamlined.

A confidentiality agreement remains one of the most practical ways to protect sensitive and trade information — but only when it is drafted within the law. Define what is confidential, keep the scope proportionate, always allow permitted disclosures, and never use an NDA to conceal misconduct. With the law now voiding clauses that silence victims of crime for agreements signed from October 2025 onwards in England and Wales, careful drafting is essential.

Signing is the final safeguard. A securely signed agreement — with a clear record of each party and the date — turns a good NDA into an enforceable one.