Non-Disclosure Agreement (NDA) (UK)

A Non-Disclosure Agreement (NDA) in the United Kingdom binds the parties to keep specified information confidential and limits how it may be used or disclosed, under the framework of the Trade Secrets (Enforcement) Regulations 2018. It restricts disclosure and use of designated confidential information between the disclosing and receiving parties.

Under English common law, an NDA is enforceable as a contract provided it meets the basic requirements of offer, acceptance, consideration, and certainty of terms. The consideration in a typical NDA is the mutual exchange of promises — the Disclosing Party agrees to share valuable information, and the Receiving Party agrees to keep it confidential. English courts will enforce NDAs but will scrutinise their scope to confirm they do not unreasonably restrain trade or contravene public policy.

A UK NDA must comply with several pieces of legislation that distinguish it from NDAs used in other jurisdictions. The Data Protection Act 2018 (which incorporates the UK General Data Protection Regulation following the UK's departure from the European Union) applies wherever the Confidential Information includes personal data. The Contracts (Rights of Third Parties) Act 1999 is relevant because, unless expressly excluded, third parties who benefit from a contractual term may acquire rights to enforce it — a well-drafted UK NDA will exclude this. From October 2025, the Victims and Prisoners Act 2024 introduced new limitations on NDAs involving criminal conduct disclosures.

NDAs can be structured as unilateral (one-way) agreements — where only one party discloses information — or as mutual (two-way) agreements — where both parties disclose information to each other. Our UK NDA template is drafted as a unilateral agreement governed by the laws of England and Wales, with exclusive jurisdiction conferred on the courts of England and Wales.

The legal framework governing the Non-Disclosure Agreement (NDA) (UK) in United Kingdom draws on several key statutes and regulatory bodies. Under the Companies Act 2006, Companies House maintains the register of UK companies. Section 386 of the Companies Act 2006 sets accounting record obligations. The Competition and Markets Authority (CMA) enforces the Consumer Rights Act 2015. The Financial Conduct Authority (FCA) regulates financial services under the Financial Services and Markets Act 2000. The High Court of Justice has jurisdiction under the Senior Courts Act 1981. Parties executing a Non-Disclosure Agreement (NDA) (UK) in United Kingdom should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Trade Secrets (Enforcement) Regulations 2018 sets the foundational requirements.

A Non-Disclosure Agreement is appropriate in a wide range of commercial and professional situations in England and Wales. You should use an NDA whenever you are disclosing information that has real commercial value and that you wish to prevent from entering the public domain or being used for any purpose other than the one you have specified.

The most common circumstances in which a UK NDA is required include: discussions with a prospective business partner or joint venture partner before a formal agreement is reached; negotiations for the purchase or sale of a business, where the buyer requires access to financial records, customer data, and operational information; disclosures to potential investors during fundraising rounds; engaging contractors, consultants, or freelancers who will have access to proprietary systems, source code, or client information; licensing negotiations where trade secrets or patentable inventions are discussed; and employment relationships where senior employees, directors, or technical staff have access to confidential business strategies.

In the employment context, it is important to distinguish between pre-employment NDAs (signed at or before the start of employment) and post-employment NDAs or settlement agreements (sometimes called 'gagging clauses'). Following the changes introduced by the Victims and Prisoners Act 2024, NDAs used in a settlement context cannot prevent an individual from reporting criminal conduct to the police, making a protected disclosure, or cooperating with law enforcement. This applies to all NDAs entered into on or after 1 October 2025.

An NDA is particularly valuable when intellectual property is being shared with a third party prior to a patent application being filed, since disclosure without confidentiality protection can constitute prior art that undermines patent protection. Similarly, in the context of creative industries, NDAs protect undisclosed scripts, concepts, or designs before formal IP protection is sought.

Parties in United Kingdom should prepare a Non-Disclosure Agreement (NDA) (UK) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under the Companies Act 2006, Companies House maintains the register of UK companies. Section 386 of the Companies Act 2006 sets accounting record obligations. The Competition and Markets Authority (CMA) enforces the Consumer Rights Act 2015. The Financial Conduct Authority (FCA) regulates financial services under the Financial Services and Markets Act 2000. The High Court of Justice has jurisdiction under the Senior Courts Act 1981. Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A well-drafted Non-Disclosure Agreement for use in England and Wales must contain several key provisions that distinguish it from NDAs used under other legal systems.

The definition of Confidential Information is the most critical clause in any NDA. It should be drafted with sufficient breadth to cover all genuinely sensitive information while being specific enough to give the Receiving Party clear notice of what is protected. Overly vague definitions are harder to enforce in English courts. The definition should also clearly state the exclusions — information already in the public domain, information independently developed by the Receiving Party, or information disclosed by a third party without restriction.

The obligations clause sets out precisely what the Receiving Party may and may not do with the Confidential Information. Under English law, this typically includes obligations to maintain confidentiality, to use the information only for the specified Purpose, to restrict access to authorised personnel, and to promptly notify the Disclosing Party of any unauthorised disclosure.

The compelled disclosure clause is important: it recognises that in some circumstances — such as a court order or regulatory requirement — the Receiving Party may be legally compelled to disclose information, and sets out the procedure to be followed in such circumstances, including giving the Disclosing Party prior notice where possible.

The remedies clause acknowledges that damages alone may be inadequate in the event of a breach and expressly preserves the Disclosing Party's right to seek injunctive relief from the courts of England and Wales. English courts have broad powers to grant injunctions — including urgent interim injunctions — to prevent further disclosure.

The exclusion of third-party rights under the Contracts (Rights of Third Parties) Act 1999 is a standard provision in English commercial contracts and should always be included in a UK NDA. The governing law and jurisdiction clause specifying England and Wales is essential for confirming that any disputes are resolved in the correct forum under the correct legal system.

Additional compliance elements for a Non-Disclosure Agreement (NDA) (UK) used in United Kingdom include: Under the Companies Act 2006, Companies House maintains the register of UK companies. Section 386 of the Companies Act 2006 sets accounting record obligations. The Competition and Markets Authority (CMA) enforces the Consumer Rights Act 2015. The Financial Conduct Authority (FCA) regulates financial services under the Financial Services and Markets Act 2000. The High Court of Justice has jurisdiction under the Senior Courts Act 1981. Forms-legal.com provides this template as a starting point for United Kingdom-compliant documentation.

Three landmark decisions shape how English courts assess and enforce Non-Disclosure Agreements in the United Kingdom.

In Coco v AN Clark (Engineers) Ltd [1969] RPC 41, Megarry J set out the three essential requirements for an action in breach of confidence under English law: the information must have the necessary quality of confidence; it must have been communicated in circumstances importing an obligation of confidence; and there must be an unauthorised use of the information to the detriment of the communicating party. This framework remains the bedrock of confidentiality law in England and Wales and governs situations where no written NDA has been signed, as well as informing the courts' interpretation of express confidentiality clauses in commercial agreements.

Faccenda Chicken Ltd v Fowler [1987] Ch 117 drew a critical distinction — still routinely applied by courts — between trade secrets proper and other confidential information acquired during employment. Neill LJ held that after employment ends, a former employee is free to use general skill and knowledge acquired during the engagement, but remains bound by implied obligations not to disclose genuine trade secrets. For commercial NDAs between businesses, this case underscores the importance of clearly identifying the tier of information being protected and applying appropriately graduated obligations to each tier.

Tillman v Egon Zehnder Ltd [2019] UKSC 32 confirmed the Supreme Court's power to sever an unenforceable portion of a restrictive covenant without invalidating the remainder, provided severance does not change the overall character of the agreement. Although the case arose in an employment context, the severance principle applies equally to over-broad scope or duration provisions in commercial NDAs. Parties drafting NDAs should confirm that definitions of Confidential Information and the duration of post-disclosure obligations are proportionate, so that — if one element were challenged — the remaining provisions would still stand.

Common mistakes made when drafting or executing a Non-Disclosure Agreement under English law can expose the Disclosing Party's confidential information, render the agreement unenforceable, or create unexpected liabilities. The following eight errors arise repeatedly in practice.

1. Defining Confidential Information too broadly or too vaguely. A definition that sweeps in everything the parties discuss — without distinguishing genuinely sensitive commercial information from routine business communications — is vulnerable to challenge on certainty grounds. English courts require sufficient certainty of terms for a contract to be enforceable. Best practice is to identify the specific categories (trade secrets, financial projections, source code, customer lists) and exclude information already in the public domain, independently developed material, and information received from third parties without restriction.

2. Omitting the post-termination survival clause. Many NDAs state a confidentiality period of, say, two years from the date of signing, without clarifying that the obligations survive termination of the NDA itself. As a result, the Receiving Party may argue that once the agreement expires, all confidentiality obligations fall away. The survival clause should specify that obligations continue for the full agreed period regardless of when the NDA terminates.

3. Failing to carve out compelled disclosure. Without a compelled disclosure clause, a Receiving Party served with a court order or regulatory demand may be in breach of the NDA if they comply with that order. Best practice requires the Receiving Party to give the Disclosing Party prompt written notice (where legally permissible), co-operate with any application to resist the order, and disclose only the minimum required.

4. Ignoring the Victims and Prisoners Act 2024. From October 2025, NDAs cannot prevent a party from reporting criminal conduct, cooperating with law enforcement, or making a protected whistleblowing disclosure under the Employment Rights Act 1996. An NDA that attempts to restrict these disclosures is void to that extent. Agreements signed before October 2025 may also be affected where they relate to ongoing conduct.

5. Using a unilateral NDA where mutual exchange is occurring. Where both parties are disclosing sensitive information to each other — as in merger discussions or joint ventures — a unilateral NDA fails to protect the party designated as the Receiving Party when they share their own confidential information. The result is that information disclosed by the Receiving Party enjoys no contractual protection at all. A mutual (two-way) NDA is required.

6. Drafting penalty clauses that amount to unenforceable penalties. The Supreme Court confirmed in Cavendish Square Holding BV v Makdessi [2015] UKSC 67 that a clause is enforceable if it protects a legitimate commercial interest proportionately, but is unenforceable as a penalty if it is extravagant or unconscionable in comparison to the legitimate interest. Liquidated damages clauses in NDAs must reflect a genuine pre-estimate of loss or be commercially justified.

7. Neglecting UK GDPR compliance where personal data is involved. Where Confidential Information includes personal data — employee records, customer databases, medical information — the NDA must also function as a data processing agreement under Article 28 of the UK GDPR. Failure to include GDPR-compliant data processing provisions exposes both parties to regulatory enforcement by the Information Commissioner's Office.

8. Executing as a simple contract where a deed limitation period is needed. A simple contract carries a six-year limitation period under the Limitation Act 1980, whereas a deed carries twelve years. For long-term commercial relationships where breach might not surface for many years, execution as a deed significantly widens the window for legal action. The three-party requirements for a deed (sign, witnessed, delivered) must be strictly observed — a document described as a deed but not properly witnessed is merely a simple contract and attracts the shorter six-year period.