NDA Review Basics: Definitions, a Checklist and Risks by Position

Hello, I'm Noriaki Asato, Representative Attorney at LegalAgent.

In corporate legal practice, I often see nondisclosure agreements (NDAs) treated as "standard, formal paperwork." This is because they are often signed in a hurry before a project gets fully under way, such as before business discussions begin or at the initial stage of considering an M&A deal. From a practical standpoint, however, an NDA is by no means a lightweight contract. At a stage when it is not yet known whether a definitive agreement will even be signed, information that is difficult to fully take back once known, such as technical know-how, customer information and business plans, passes to the counterparty. If products under development, pricing strategies or fundraising materials reach a competitor, some business opportunities cannot be recovered through damages after the fact. In my experience, if you proceed with the scope of information, the purpose of use and the duration of the obligations left vague, the question of what exactly was protected tends to become contested when trouble arises later.

The Contract Type and the Nature of the Information to Be Protected

When you receive a draft NDA, first determine the contract type that fits the actual transaction (one-way or mutual) and whether your company is the disclosing party or the receiving party. An NDA is an arrangement that restricts leaks to third parties and use for other purposes of information disclosed by one or both parties. A one-way NDA is a form in which only one party discloses and only the counterparty bears confidentiality obligations; typical scenarios are a startup presenting technical materials to a large company, or a seller in an M&A deal disclosing financial materials to a prospective buyer. A mutual NDA is a form in which both parties bear obligations, and it is widely used in joint research, business alliances and mutual due diligence.

Even where the form is mutual, the type and amount of information disclosed may be skewed, for example where one party provides technical information and the other provides sales channels or customer information. Even if the wording appears equal, it may in substance place a heavy burden on one side, so examine the form of the obligations against the actual direction of disclosure. Also, what must be protected may include not only paper materials but also oral explanations, what was seen and heard in meetings or factory visits, and the very fact that a transaction is being considered. On the other hand, bear in mind that even after the term of the NDA ends, protection of trade secrets under the Unfair Competition Prevention Act and obligations under the Act on the Protection of Personal Information (APPI) do not all immediately disappear.

Defining Confidential Information and Drawing the Line on Exclusions

In the definition of confidential information, check whether important information is included without omission, or conversely whether it extends too broadly without limit. If the definition is limited only to "documents marked as confidential," information shared in oral exchanges or on-site visits may fall outside it. A clause under which materials are not protected unless every one of them is marked "Confidential" can be hard to keep up with in business discussions where speed is required.

At the same time, check where the line is drawn on exclusions. Typically, the following four categories are set out as exceptions to confidential information.

• Information that was already publicly known at the time of disclosure, or that became publicly known after receipt through no fault of the recipient
• Information lawfully held before receiving the disclosure
• Information lawfully obtained from a third party with legitimate authority to disclose it, without a confidentiality obligation
• Information independently developed or created without relying on the counterparty's confidential information

From the receiving party's standpoint, if these exceptions are not written specifically and clearly, there is a risk that even results your company developed independently or information it already knew will be treated as confidential information. To forestall later suspicion, it is practically effective to keep internal records of the fact that information was held before receipt and of the process of independent development.

Checking the Purpose of Use and the Scope of Sharing

The purpose-of-use clause directly determines the scope within which confidential information can be handled. If the purpose of use is narrowly limited to "for the purpose of considering this transaction," preparatory work after the contract is signed and internal verification may be hindered. On the other hand, if the purpose of use is defined too broadly, from the disclosing party's standpoint there is a risk that the information will be used for unintended purposes. Confirm with the business unit whether the NDA is the gateway to subsequent agreements such as service agreements, investment agreements or joint research agreements, or whether it is limited to the negotiation stage, and adjust the wording accordingly.

Also define the scope of disclosure to third parties carefully. Some transactions require sharing not only with officers and employees but also with group companies such as parent companies and subsidiaries, outside attorneys and certified public accountants, and investors and investment committees. As the receiving party, if the recipients needed in practice are not included in advance within the scope of permitted disclosure under the contract, there is a concern that internal consideration and decision-making will grind to a halt. Agree on the confidentiality obligations imposed on recipients and the receiving party's responsibility for them. Taking into account the obligations professionals bear under law or by virtue of their duties, make clear which recipients require a separate agreement.

Return or Destruction and Designing Effective Clauses

In the return and destruction clause, applicable at the end of the contract or upon the disclosing party's request, check whether the receiving party can realistically comply. If it is obliged to completely and physically erase everything, including email and backup data in the cloud, performance is difficult in practice. Both parties should agree on an exception allowing backup data and copies needed for legal compliance, internal audits and litigation to be retained for a certain period. Because internal rules alone do not release a party from contractual erasure obligations, narrow the items and period that may be retained, and also set out the confidentiality obligations during retention.

As for the duration of confidentiality obligations, a commonly used provision is a one-year contract term with the obligations surviving for three or five years after termination, but this is only one design example and not a uniform period prescribed by law. Depending on the nature of the technical information or trade secrets, judge individually whether long-term protection is necessary and whether it would impose an excessive management burden. As for damages and injunctions in the event of breach, merely including a clause does not mean a court will automatically grant an injunction; the statutory requirements for provisional remedies or the merits must be met. As the receiving party, consider organizing a cap and scope so that the scope of damages does not expand without limit.

In recent years, contract review using generative AI has also become widespread, but the information covered by an NDA may include unannounced M&A deals and technical specifications. You need to confirm whether the environment has been approved internally as secure and decide whether the tool may be used. One way to use AI is to have it extract the clauses on definitions, exceptions, return and survival of obligations, and draft comments with the disclosing or receiving side specified. Rather than taking the general comments presented by AI at face value, it is important for the person in charge to make their own judgment, looking ahead to the balance of power with the counterparty and future business development. What we cover when the routine review of NDAs is entrusted externally on an ongoing basis is summarized under Legal Outsourcing.