Confidentiality clause review beyond NDAs
Hello, this is Legal Agent.
Confidentiality clauses are not unique to standalone NDAs: they appear inside services agreements, M&A documents and license agreements as well, and precisely because the language feels routine, it is easy to read past it as boilerplate. The definition of confidential information, the scope of permitted disclosure and the survival period actually determine how much practical risk the clause creates.
Defining confidential information
A definition that is too broad becomes a management burden for the receiving party; one that is too narrow leaves the disclosing party's real information unprotected. Approaches range from covering only information explicitly marked confidential, to including oral disclosures designated in writing within a set period, to covering anything the discloser treats as confidential regardless of form, and some agreements treat the existence of the deal itself as confidential. That point is worth checking even outside standalone NDAs, particularly in M&A, fundraising and joint development.
Purpose and disclosure scope
How narrowly the permitted purpose is drawn, and who may receive the information (group companies, employees, outside counsel and accountants, subcontractors), determines whether the clause actually matches how the business operates day to day. In the AI era, this list should also address whether confidential information may be entered into an AI tool, and whether doing so is consistent with the company's confidentiality obligations and security policy.
Carve-outs
Standard exceptions cover information that was already public, became public without the receiver's fault, was already held before disclosure, was received from a third party without a confidentiality obligation, or was independently developed without reference to the confidential information. A receiving party needs these carve-outs so that information it already had is not swept in; a disclosing party needs them narrow enough that protection is not hollowed out. The independent-development exception matters particularly in joint development and AI or data-related deals, where it can be hard to say afterward which part of a result came from the shared information.
Survival, return and destruction
Confidentiality duties commonly outlast the contract itself, and the survival period should track the sensitivity of the information involved. Because copies can persist in email, cloud storage and AI tool logs, review should check the survival period, the timing of return or destruction, treatment of backups and derivative materials, whether a destruction certificate is required, and any carve-out for records a company must keep by law.
Reading the clause from either side
A disclosing party focuses on whether the definition genuinely captures what needs protecting and whether misuse can be stopped through injunction or damages; a receiving party focuses on whether the definition is workably narrow and whether information it already held or developed independently stays free of restriction. The same clause can look strong from one side and unworkable from the other, so which side your company is on should be settled before drafting comments.
Confidentiality clauses in an AI environment
Whether employees may enter confidential information into an external AI tool, whether input data feeds model training, and whether logs are retained externally are now standard questions for confidentiality review, on top of the contract text itself. The answer often needs translating into a concrete rule for who may use which tool for which kind of information, decided across departments rather than left to legal alone. A clause is not functioning as intended until information really is deleted, or genuinely stops being shared, at the point the contract requires.