Most companies derive substantial value from their confidential information and data, both by having exclusive use of it in their own businesses and by sharing it selectively with customers, suppliers, and others. Confidential information can be used and shared more effectively and securely, to the greater benefit of the business, if the company routinely:

Confidential information takes various forms in different businesses and industries and often includes information entrusted to a company by its customers, suppliers, and other parties, subject to contractual use restrictions and nondisclosure obligations.

Having effective confidentiality agreements in place with other parties is necessary but not sufficient to protect an organization’s confidential information and data. Comprehensive protection requires the participation and coordination of management and staff at all levels across all functions, from finance and administration to marketing and sales. It often falls to the legal department, working closely with the information technology (IT) function and with the support of senior executives, to lead the company-wide information management and protection program.

Effective information and data security depends on developing comprehensive policies and procedures, and applying them consistently. In this regard, it is especially important to have in place:

Robust physical and electronic security measures must be implemented and regularly tested, audited, and updated as part of the larger effort to protect the company’s information assets. The company should have:

Such procedures should include notification of other parties whose information may have been disclosed in violation of applicable confidentiality agreements and mandatory notification of individuals whose personal information is compromised.

In addition to safeguarding their own confidential information, companies are responsible for protecting information that is disclosed to them by customers, suppliers, and others, as a matter of compliance with relevant confidentiality agreements or analogous provisions within larger commercial agreements.

The principal obligations (covenants) typically imposed on recipients of confidential information include:

Certain confidential business, financial, and technical information may be subject to protection as trade secrets under state law, in addition to and independent of any contractual protections afforded by confidentiality agreements or provisions. For example, any of the following types of information may be considered trade secrets if certain criteria are met:

Additionally, every state offers some trade secret protection, with most having adopted the Uniform Trade Secrets Act (UTSA) in whole or part. The UTSA states three general conditions for protection of information as trade secrets:

Certain kinds of personal information commonly held by businesses, such as employee records and customers’ financial accounts, may be subject to special protection requirements under various federal and state privacy and data security laws and regulations. These legal requirements are related to contractual nondisclosure obligations but they apply whether or not the personal information would otherwise be treated as confidential.

A range of commercial transactions and relationships involve either the disclosure of confidential information by one party to the other or a reciprocal exchange of information. Although many confidentiality agreements have similar structures and share key provisions, there is great variation in the form, structure, and substantive details that should be tailored to the specific circumstances of each agreement. For example, confidentiality agreements may be used when:

Your business clients may not appreciate the importance of entering into written confidentiality agreements, preferring to rely on informal understandings and arrangements with parties to or from which confidential information is disclosed or received. However, there are numerous reasons to enter into written confidentiality agreements, such as:

The parties to the agreement are the business entities or individuals that will exchange confidential information and be subject to the security requirements, use restrictions, nondisclosure obligations, and the agreement’s other operative provisions. Although only the parties themselves are bound by the agreement, consider whether:

A recipient party (and, if applicable, that party’s affiliates) will also often be permitted to share confidential information with its business, financial, and legal advisors and other representatives. Representatives typically include the recipient’s:

In some cases, the recipient party may prefer to have certain of its representatives enter into separate confidentiality agreements with the other party, rather than be held responsible for the representatives’ compliance with the principal agreement.

Many confidentiality agreements limit the disclosure or exchange of confidential information to a specified business purpose, such as “to evaluate a potential marketing arrangement between the parties.” A defined business purpose is especially useful as a basis for access and use restrictions in the agreement. For example, confidentiality agreements can restrict the disclosure of confidential information to the recipient, its affiliates, and representatives solely for use in connection with the stated purpose.

Defining what information and data is confidential is central to any confidentiality agreement. Disclosing parties should:

The types of information that are commonly defined as confidential include:

In addition to business information that is actually disclosed or exchanged by the parties, confidential information may also include:

Confidential information should include information entrusted to a party by its affiliates and by third parties, such as customers, which may itself be subject to “upstream” confidentiality agreements with the third parties.

The definition of confidential information should state the possible forms in which it may be disclosed (written, electronic, and oral) and whether the disclosed material must be marked “confidential” or otherwise designated as such. Where especially sensitive or valuable confidential information is to be disclosed, numbered, printed copies may be distributed to specified individuals, so that all copies can be collected at the conclusion of the transaction.

Recipients should ensure there are appropriate exclusions from the definition (which can be broader or narrower, depending on the party). Typical exclusions include information that:

In general, recipients of confidential information are subject to an affirmative duty to keep the information confidential, and not to disclose it to third parties except as expressly permitted by the agreement. The recipient’s duty is often tied to a specified standard of care. For example, the agreement may require the recipient to maintain the confidentiality of the information using the same degree of care used to protect its own confidential information, but not less than a “reasonable” degree of care.

Recipients should ensure there are appropriate exceptions to the general nondisclosure obligations, including for disclosures:

Disclosing parties commonly try to ensure that recipients are required to have “downstream” confidentiality agreements in place with any third parties, including affiliates, representatives, contractors, and subcontractors, to which subsequent disclosure of confidential information is permitted. In these cases, either the recipient or the discloser may prefer to have these third parties enter into separate confidentiality agreements directly with the discloser.

Apart from a recipient’s nondisclosure obligations, confidentiality agreements typically limit access to and use of the information even within the recipient’s organization. For example, access and use may be restricted to the recipient’s employees who have a “need to know” the information solely for the defined business purpose.

Recipients may be required to adopt specific physical and network security methods and procedures to safeguard the discloser’s confidential information. Some agreements require that confidential information be segregated in a “data room,” with a log of all internal access and third-party disclosures. Recipients may also be obligated to notify the disclosing party of any security breaches or unauthorized disclosures.

Confidentiality agreements can run indefinitely, covering the parties’ disclosures of confidential information at any time, or can terminate on a certain date or event, such as the:

Whether or not the overall agreement has a definite term, the parties’ non-disclosure obligations can be stated to survive for a set period, running for some number of years from the date on which information is actually disclosed. Survival periods of one to five years are typical.

Disclosing parties typically prefer an indefinite period while recipients generally favor a fixed term. The term often depends on the type of information involved and how quickly the information changes. Some information becomes obsolete fairly quickly, such as marketing strategies or pricing arrangements. Other information may need to remain confidential long into the future, such as:

Disclosing parties should ensure they have rights to the return of their confidential information on termination of the confidentiality agreement or at any time on their request.

Recipients often want the option to destroy the confidential information instead of returning it to the disclosing party. In the course of evaluating the other party’s confidential information, conducting due diligence, or negotiating a principal agreement, a recipient may combine its own confidential information with that of the discloser. In that situation, the recipient usually wants to destroy the information because returning it would mean disclosing its own confidential information. Disclosing parties usually allow this destruction option but often require the recipient to certify in writing that the information was in fact destroyed. Disclosing parties should be especially aware of this risk because there is no way for a disclosing party to be sure that a recipient has destroyed the information.

It is often not practical for a recipient to certify that all confidential information has been destroyed, due to the widespread use of automated network back-up programs and e-mail archive systems. For this reason, a recipient may try to include language that allows archival copies to be retained. This issue is usually fact specific and should be negotiated between the parties.

Recipients also try to include language that allows them to keep copies of confidential information for evidentiary purposes or if required to do so by law or professional standards. Disclosing parties agree to this but sometimes require that the recipients’ outside attorneys keep the copies to protect against abuses.

Confidentiality agreements may also include any of the following general provisions: