What Is a Confidentiality Clause? Review Practice for Contracts Other Than NDAs
Hello, I'm Noriaki Asato, Representative Attorney at LegalAgent.
Confidentiality clauses are included not only in standalone non-disclosure agreements (NDAs) but also in a wide variety of contracts, such as service agreements, joint development agreements and M&A agreements. In practice, they tend to be glossed over as boilerplate, but the risks you take on change significantly depending on the definition of confidential information, the scope of permitted disclosure, and the treatment after termination. Check the clause against your actual operations, all the way to whom you will share the information you receive with and where you will delete it from when the contract ends.
The Role of a Confidentiality Clause and the Definition of Confidential Information
A confidentiality clause is an arrangement to prevent disclosed technical or business information from being used for other purposes or leaked to third parties. The information covered includes technical data, customer information, pricing structures, business plans, source code, know-how and so on.
The starting point of the review is the definition of confidential information. Some definitions limit it to information expressly marked as confidential, some include information disclosed orally and then identified in writing within a certain period, and some cover all information managed as confidential regardless of the method of disclosure. The scope of each is determined by the wording and the exclusions, and there is no fixed ranking of which is broader or narrower. In addition, "confidential information" as agreed in a contract and a "trade secret" under the Unfair Competition Prevention Act (information that meets the requirements of being managed as a secret, being useful, and not being publicly known) are separate concepts, and they should be considered separately without being confused.
The disclosing party checks that all the information it wants to protect is included, and the receiving party checks that everyday conversations and public information are not swept in as subject to control in a way that creates an excessive burden.
Purpose of Use, Scope of Disclosure, and Excluded Information
A confidentiality clause specifies the purpose for which the confidential information may be used and the scope of persons to whom it may be disclosed. If the purpose is vague, there is room for the receiving party to use the information broadly; if it is too narrow, it hinders internal deliberation and consultation with outside experts.
As for permitted recipients, check, following the actual flow of work, whether sharing is allowed with the company's officers and employees (and which ones), group companies, outside experts such as attorneys and certified public accountants, subcontractors and system vendors. For disclosure under laws and regulations or in response to requests from courts or regulators, consider a clause that limits the disclosure to the extent required and provides for advance notice or prompt communication to the extent permitted by law. Avoid imposing an unconditional obligation of advance notice even in cases where notice is not permitted by law.
Also check the provisions on excluded information that is removed from the scope of confidential information. This includes information that was publicly known at the time of disclosure, information that became publicly known after disclosure through no fault of the recipient, information lawfully held before disclosure, information obtained from a third party with legitimate authority without any duty of confidentiality, and information independently developed without using the confidential information. For the receiving party, these provisions keep its own know-how from being tied up; for the disclosing party, they are provisions to examine to make sure the exceptions are not so broad that protection becomes hollow. In joint development and AI or data-related transactions, distinguishing between independent development and results that used the disclosed information becomes an issue. Keep records of the development history and materials held beforehand so that you can show the basis when claiming an exclusion.
Duration and Return or Destruction After Termination
Confidentiality obligations generally survive for a certain period after the contract ends. The length of that period is adjusted according to how quickly the information becomes outdated and how much it needs protection.
For return or destruction at the end of the contract, check whether it can actually be carried out on the ground as the clause provides. Check not only paper and PDF materials and their copies but also emails and storage locations in the cloud. Confirm whether logs and output of AI tools and materials handed to subcontractors are also covered, and set deadlines for return and deletion. If you also make clear the exclusion of documents that must be retained by law, the treatment of electronic backup data, whether a certificate of destruction is required, and the route for instructing subcontractors to delete and report back, it becomes easier to decide at termination what must be deleted and what may be kept.
Also consider claims for injunctions in the event of a leak or use for other purposes. The right to seek an injunction in case of breach is not automatically granted, and you need to carefully determine whether there is a contractual basis and whether the legal requirements are met.
The Disclosing Party's and Receiving Party's Perspectives, and Points to Focus on by Transaction Type
What to check in a confidentiality clause differs greatly depending on whether you are the party providing the information or the party receiving it.
The disclosing party focuses on whether everything it wants to protect is included, whether it can stop use for other purposes or unauthorized disclosure, and whether it can claim damages in the event of a breach. The receiving party focuses on whether the definition is so broad that it is forced into unworkable controls, whether its existing information and independent development are hindered, and whether necessary internal sharing and consultation with outside experts are possible.
The emphasis also differs by transaction type. In M&A and fundraising, the focus is on the confidentiality of the very fact that the transaction is being considered; in joint development, separating existing technology from joint results is central. For SaaS and AI services, the handling of input data and its use for training are the main items to consider.
Use of Generative AI and Internal Management in Practice
With the spread of generative AI, you should also look at the relationship between business use and confidentiality clauses. Check whether entering sales meeting minutes, source code and the like into an AI tool constitutes use for other purposes or disclosure to a third party under the contract. You need to understand the specifications, such as whether input data is used to train AI models, whether it is stored on external servers, and whether administrators can view it.
Sort out whether the contract will prohibit AI use across the board or allow it only in environments that meet security standards, and settle details such as the retention period for logs and the procedure for deleting confidential information. In practice, it is essential not only to put the contract in order but also to link internal operating rules with tool settings.
- Before disclosing confidential information, make the necessary agreement in an NDA or in the confidentiality clause of the main contract
- Mark information as confidential
- Limit access rights
- Record the external parties with whom information is shared
- Decide whether information may be entered into AI tools and the criteria for masking
- Carry out return and deletion at the end of the contract
- Set up a point of contact for cases where a leak is suspected
Identify the AI tools used by each department, and list whether each uses input for training and where and for how long input, output and logs are stored. Decide who will check and when, so that the list can be updated when a service's specifications or settings change. Also share the procedure for prior approval when handling business partners' confidential information and the point of contact for questions. We also accept consultations on building information management systems and checking contract clauses through the following pages.
Services connected to this topic