Before You Sign an NDA: 10 Things Founders Should Know

You are about to pitch an investor, engage a consultant, explore a partnership or discuss a potential acquisition. Someone says: "Let us sign an NDA first." It sounds routine — but an NDA can create meaningful obligations well beyond a simple promise not to disclose information.

The best NDA is not necessarily the longest or most restrictive. It is the one that fits the information, the parties and the transaction. Here are 10 issues founders should check before signing.

1. Do you actually need an NDA?

Not every commercial conversation requires one. The first question is what information you are about to disclose; how sensitive it is and whether you can stage the disclosure instead of handing over everything at once.

This is particularly relevant in fundraising. The Singapore Academy of Law VIMA model NDA notes that, for early-stage financing rounds including Series A rounds, it is common for VCs and other investors not to enter into NDAs. A company may instead take that into account when deciding what information to provide. The position may be different where the potential investor is a strategic investor or competitor.

2. Should it be one-way or mutual?

A one-way NDA generally makes sense where only one party is disclosing sensitive information. A mutual NDA makes sense where both sides expect to exchange confidential information.

Mutual does not automatically mean fairer. If the information flow is genuinely one-way, a mutual agreement may impose unnecessary obligations on the party that has little or nothing confidential to disclose.

3. What exactly counts as "Confidential Information"?

This definition is the engine room of the NDA. Some agreements protect only specifically identified material. Others sweep in almost anything non-public connected with the business. Depending on the drafting, the definition may capture:

• oral, written and electronic disclosures;
• information disclosed before the NDA was signed;
• trade secrets, technology, source code, financials, customer information and business plans;
• notes, analyses and summaries created by the recipient from the disclosed material; and
• the existence of the negotiations or transaction itself.

The exclusions matter just as much. Common exclusions cover information that is already public, was lawfully known to the recipient before disclosure, is legitimately received from an independent third party, or is independently developed without using the protected information.

4. Do not overlook the "Purpose"

Many NDAs do two things at once: they prohibit unauthorised disclosure and prohibit use of the information for anything other than an agreed purpose. A narrow purpose therefore creates a narrow lane in which the recipient may lawfully use the information.

For example, "evaluating a potential business relationship" is broader than "evaluating the proposed acquisition of Company B by Company A". Singapore Court of Appeal authority also shows why the drafting matters: in Adinop Co Ltd v Rovithai Ltd [2019] SGCA 67, the contractual Purpose was central to the finding that customer information had been misused outside what the confidentiality agreement permitted.

5. Who can receive the information?

A business acts through people. The NDA therefore needs to accommodate the employees, directors, advisers, consultants, affiliates, banks or investors who genuinely need access.

Check whether disclosure is limited to a "need to know" basis, whether each recipient must be separately bound by confidentiality obligations, and whether you are responsible for breaches by your representatives. A clause that is too narrow can even make ordinary internal circulation technically non-compliant.

6. How long do the obligations last?

Do not assume that the stated term of the NDA is the same as the period for which confidentiality must be maintained. There may be two clocks: the life of the agreement and the survival period for confidentiality obligations.

Some of the reviewed Singapore forms have a fixed agreement term, while the confidentiality obligations continue beyond termination until the information falls within an agreed exclusion. The practical question is not only "When does the NDA end?" but "When are we actually free to use or disclose the information?"

7. What happens when discussions end?

Return-and-destruction provisions sound simple until someone asks you to delete every copy of a document from email archives, backups, cloud storage and compliance systems.

More sophisticated agreements recognise this. They may permit retained copies where required by law, regulation, audit or document-retention policies, and may carve out material held in automatic electronic backups. If you are the recipient, the clause should reflect what your systems can realistically do.

8. What if disclosure is required by law?

An NDA should not require a party to choose between complying with the agreement and complying with a court, regulator or applicable law. Mandatory-disclosure clauses usually permit disclosure to the minimum extent required, often with prior notice to the disclosing party where legally permitted.

That notice can be important: it may allow the disclosing party to seek a protective order, challenge the request or limit the scope of the disclosure.

9. Check for clauses that are not really about confidentiality

A document headed "Non-Disclosure Agreement" can contain much more than non-disclosure obligations. Transaction NDAs sometimes include non-solicitation obligations, restrictions on contacting employees or customers, standstill-style protections, announcement controls, indemnities or other deal protections.

The VIMA model NDA, for example, contains an optional restrictive covenant addressing solicitation of certain employees, officers and directors. Such provisions may be appropriate in context, but they should be assessed as standalone commercial restrictions rather than accepted merely because they sit inside an NDA.

10. What happens if someone breaches it?

The consequences can range from nominal damages to substantial monetary awards, depending on what happened to the information and what loss, benefit or misuse can be proved. Injunctions are also important because once information has been publicly disclosed, damages may not restore its secrecy.

Singapore courts recognise a range of remedies in confidentiality cases, including injunctions and, depending on the cause of action and facts, damages, equitable compensation or an account of profits. A technical breach does not automatically produce a windfall — causation and proof still matter.

The FD NDA checklist

Ten questions to work through before you sign.

The takeaway

A good NDA is calibrated, not maximalist. The objective is to protect genuinely sensitive information while allowing the parties to evaluate or pursue the proposed relationship without creating impractical obligations.

For founders, the key is to understand what you are protecting — or promising to protect — before signing on the dotted line.

Sending the NDA rather than signing one? Draft an NDA with FD AI. It asks whether the NDA is one-way or mutual, what you are working on together, what information will be shared and how long each clock runs, then builds the agreement from your answers.

Frequently asked questions

Selected authorities and source materials

• Singapore Academy of Law, VIMA Model Non-Disclosure Agreement: sal.org.sg
• Adinop Co Ltd v Rovithai Ltd and another [2019] SGCA 67: elitigation.sg/gdviewer/s/2019_SGCA_67
• PH Hydraulics & Engineering Pte Ltd v Airtrust (Hong Kong) Ltd [2010] SGHC 267: elitigation.sg/gd/s/2010_SGHC_267
• I-Admin (Singapore) Pte Ltd v Hong Ying Ting [2020] SGCA 32: elitigation.sg/gd/s/2020_SGCA_32