Most NDA redlines come down to a handful of clauses: the definition of confidential information, the term, the exclusions, permitted use, compelled disclosure and remedies. Mark up those six, leave the rest alone, and a standard NDA usually closes in one or two rounds. This guide shows which edits are worth making, which red flags should stop you, and how to run the exchange so it does not stall a deal.
It is written for founders, account executives and in-house counsel who see NDAs weekly and want a repeatable way to handle them.
TL;DR
- Redline the definition of confidential information, the term, the exclusions, permitted use, compelled disclosure and remedies. Most other edits are noise.
- Make the NDA mutual when both sides will share information. A one-way draft handed to a party that is also disclosing is the most common mismatch.
- Check every NDA for a carve-out that allows reporting to regulators. Missing language can make an agreement unenforceable in part and has drawn SEC enforcement.
- Explain each change in a short comment. Reviewers who see a reason accept edits faster.
- Keep redlines, comments and the signed version in one place so you can show what changed and who agreed.
How an NDA redline round works
A redline is a visible record of edits to a draft: insertions, deletions and comments, attributed to whoever made them. In an NDA negotiation, one party sends a draft, the other marks it up, and the two go back and forth until no open points remain. Then both sign.
NDAs are well suited to this because the structure is standardized. A walkthrough from AI for Law Firms makes the same point: the risk patterns repeat and most negotiations revolve around the same handful of clauses. That is good news for you. It means you can build a checklist once and apply it to every draft.
Before you open the document, settle three questions:
- Who is disclosing? Only you, only them, or both? This decides whether you push for a mutual agreement.
- What is being shared? Source code, pricing, customer lists, a product roadmap and a security questionnaire carry different risk and different shelf lives.
- What is the deal stage? An NDA before a first demo should be light. An NDA before a data room or technical diligence can justify tighter terms.
Clauses that deserve a redline
The table below is the short version. The sections after it explain each one.
| Clause | What to look for | Typical edit |
|---|---|---|
| Definition of confidential information | Overbroad ("everything") or too narrow | Tie to marked or reasonably understood information |
| Term and survival | No end date, or perpetual duty for all information | Fixed term, with longer protection only for trade secrets |
| Exclusions | Missing standard carve-outs | Add public, previously known, independently developed, rightfully received |
| Permitted use | Open-ended use | Limit use to evaluating or pursuing the stated deal |
| Compelled disclosure | No path for subpoenas or regulators | Allow disclosure with notice where lawful |
| Remedies and governing law | One-sided injunctions, distant venue | Make remedies reciprocal, pick a reasonable venue |
Definition of confidential information
This is the clause that decides what the NDA actually protects. Two failure modes appear again and again.
The first is a definition so broad that it covers every conversation, including facts the other side already knew. A court may refuse to enforce overbroad terms, and Cornell's Legal Information Institute) notes that courts can decline enforcement where terms are overbroad, violate public policy or improperly restrain trade. Overbreadth is not your friend even when you are the discloser, because it invites a fight over enforceability.
The second is a definition so narrow that it only covers documents stamped "Confidential". If you are the discloser, that puts the burden on you to label every slide and every email. A common middle ground: protect information marked confidential, plus information a reasonable person would understand to be confidential given its nature and the circumstances of disclosure.
If you share information orally, add a short follow-up summary requirement only if you are prepared to actually send those summaries. A clause you never follow is worse than none.
Term and survival
An NDA that binds you forever on all information is a red flag. Technical information can become stale quickly, so a fixed term makes sense for most material. A typical structure is a term for the disclosure period, then a survival period for confidentiality duties, with trade secrets protected for as long as they remain trade secrets.
When you are the receiving party, push for a defined end. When you are the discloser, resist a short survival period for anything that would still hurt you if it leaked in three years: source code, unreleased pricing logic, security architecture.
Exclusions
Standard exclusions cover information that is or becomes public through no fault of the recipient, was already known to the recipient, was independently developed without using the discloser's information, or was rightfully received from a third party. If any of these four is missing, add it. Their absence is a quiet way to turn a light NDA into a heavy one.
Watch for a residuals clause, which lets the recipient use whatever its people remember after seeing the information. It is common in technology deals. If you are the discloser, strike it or limit it to general skills and knowledge. If you are the recipient and your engineers will review sensitive material, it can be a reasonable ask, but expect pushback.
Permitted use
The recipient should use confidential information only to evaluate or carry out the specific transaction. Broad language such as "for any business purpose" defeats the point of the NDA. Replace it with a purpose statement that names the deal in one sentence, for example evaluating a potential software subscription between the parties.
Also check who may see the information. "Representatives" should be limited to employees, contractors and advisers who need it and who are bound by duties at least as protective.
Compelled disclosure
Subpoenas and regulator requests happen. A good clause lets the recipient comply when legally required, ideally after giving the discloser prompt notice where the law allows, and disclosing only what is required. A clause that bans disclosure under all circumstances is not just impractical. As the next section shows, it can be unlawful.
Remedies and governing law
Many drafts say a breach causes irreparable harm and entitles the discloser to an injunction. That is fine when it applies to both sides. If the clause only runs one way in a mutual NDA, make it reciprocal. Check the governing law and venue too: a venue across the country raises your cost of ever enforcing or defending the agreement.
Red flags that should stop the review
Some issues are not matters of negotiating preference. Treat these as reasons to pause and, where the stakes justify it, call a lawyer.
- No whistleblower or regulatory carve-out. Federal rules limit what an NDA can restrict. The SEC says in its whistleblower protections guidance that agreements cannot impede people from reporting possible violations. Cornell's overview also notes limits from the Speak Out Act of 2022 and SEC Rule 21F-17(a)).
- A requirement to notify the company before talking to a regulator. The SEC's September 2024 settlement with GQG Partners involved NDAs that made it more difficult for candidates to report potential violations. Language like this is a hazard for the party that drafted it and a signal for the party reviewing it.
- Non-compete or non-solicit terms hiding in a confidentiality agreement. Cornell notes that "confidentiality agreement" is sometimes used more broadly than NDA and may bring wider duties. If a document titled NDA contains restraints on hiring or competing, treat it as a different agreement and review it that way.
- Silence on the existence of talks. Some NDAs forbid disclosing that negotiations are happening at all, even to your own investors or advisers. Carve out advisers, lenders and investors who are under confidentiality duties.
- Unlimited term for everything. See the term section above.
- Assignment without consent. If the other party can transfer the NDA to a successor, you may end up bound to a company you never chose to deal with.
A brief note on personal data: if the information shared will include personal information about customers or prospects, the NDA is not the right place to settle privacy obligations. Those usually belong in a data processing agreement. For background on the compliance side, this CCPA B2B compliance roadmap lays out how California's rules affect business contact data.
Why the regulatory carve-out matters in practice
The SEC has acted on this more than once. In September 2024 it announced settled charges against Nationwide Planning Associates and two affiliates over confidentiality agreements that the agency said violated its whistleblower protection rule. The same month, it charged GQG Partners over its candidate NDAs, as noted above. Those cases involved registered financial firms, so Rule 21F-17 enforcement will not touch every company. But the drafting lesson applies to any template: say plainly that nothing in the agreement limits a person's right to report to a government agency.
The SEC's own whistleblower page is the authoritative starting point. If your NDA touches employees, candidates or regulated entities, have counsel confirm the language before you send it.
How to redline without souring the deal
Tone matters. IEEE Computer Society advises that asking questions about an NDA is often seen as a mark of professional competence, and suggests framing your questions as an effort to align on terms that protect both sides. That fits what works in practice.
Some habits that keep rounds short:
- Send one consolidated markup. Several rounds of tiny edits cost more time than one thorough pass.
- Comment on every substantive change. A one-line reason, such as "Added standard exclusions so both parties are covered," removes guesswork.
- Separate must-haves from preferences. Say which edits are required and which you will trade.
- Accept harmless edits quickly. If the other side changes "shall" to "will," let it go.
- Work from one live document. Emailing Word files back and forth creates version confusion. Track who changed what, and keep the final signed copy tied to that history.
- Know your fallback. If the other side will not move on term, decide beforehand whether you will accept a longer period in exchange for a clean exclusions list.
A worked example
Suppose a seed-stage startup receives a one-way NDA from a prospective enterprise customer before a security review. The startup will share architecture diagrams, and the customer will share its requirements. Here is how a markup could look.
| Draft language | Problem | Proposed redline |
|---|---|---|
| Confidential information means all information disclosed by either party | Too broad, and the draft is one-way | Convert to mutual and define by marking or reasonable understanding |
| Obligations continue in perpetuity | No end for stale information | Three years from disclosure, trade secrets protected while they qualify |
| Recipient may use information for any business purpose | Open-ended use | Limit to evaluating the proposed subscription |
| Recipient must notify the company before any government contact | Regulatory reporting hazard | Replace with a carve-out confirming nothing limits reporting to agencies |
| Governed by the laws of a distant state, exclusive venue there | Costly to defend | Propose a neutral or home venue, or accept if the stakes are low |
The period and venue are examples, not recommendations. Pick terms that match your risk and your counsel's advice.
Five edits, each with a one-line reason, is a realistic first markup. Do not rewrite the whole document in your own style. Reviewers are more likely to accept targeted changes than a full redraft.
Our perspective on NDA redlining
We see NDAs as the clearest case for a repeatable process. The clauses are predictable, the stakes are real, and yet the work often happens in email threads with attachments named "final_v3_REAL". That is where deals slow down and where nobody can later say which version was agreed.
Our view is that the redline and the signature should live in the same workflow. When both parties edit in one place, the history of who proposed what stays attached to the agreement. When the review happens against your own playbook, the checklist above stops being something one person remembers and becomes something the whole team applies. For startups where an account executive may send ten NDAs a week, that consistency matters more than any single clever edit.
We also think the first draft is the biggest lever. If you start from a mutual template with the carve-outs already in, most of the negotiation disappears. Our mutual NDA template and the guide to mutual NDAs for US businesses cover the clauses in more depth, and our post on one-way non-disclosure agreements explains when a one-way draft is the right call.
— Alex
Run NDA redlines in Formable
Formable puts NDA drafting, review, negotiation and e-signing in one workflow. You can start from a template with the contract creator, upload your playbook and have AI contract review flag risks and missing clauses at intake, then send the draft for browser-native negotiation so both sides redline in the same document. When terms are agreed, collect signatures with e-signing. The Pro plan is $29.99 per month, and you can compare all plans on the pricing page.
If your team needs mutual, one-way or multi-party paper, you can also start directly from the mutual NDA generator or the multilateral NDA creator.
A pre-send checklist
Before you send or sign any NDA, run through these questions:
- Is it mutual if both sides will disclose?
- Is confidential information defined by marking or reasonable understanding, not "everything"?
- Are the four standard exclusions present?
- Is use limited to the stated deal?
- Is there a fixed term, with trade secrets handled separately?
- Can the recipient comply with a subpoena or regulator request?
- Is there language confirming that nothing blocks lawful reporting to government agencies?
- Are remedies, governing law and venue reasonable for both sides?
- Are the agreed changes and the signed copy stored together?
If you answer no to the regulatory item or find restrictive covenants inside the document, bring in a lawyer before you sign.
FAQ
How do you redline an NDA?
Open the draft, turn on tracked changes or use a negotiation tool, and edit only the clauses that matter: definition, term, exclusions, use, compelled disclosure and remedies. Add a short comment explaining each edit and send one consolidated markup. Then work from the single live version until both sides accept.
Do NDAs hold up in court?
Often, yes. Courts enforce NDAs as contracts), but they may refuse where terms are overbroad, violate public policy or improperly restrain trade. Reasonable scope, a defined term and clear definitions make enforcement more likely.
Is an NDA the same as a confidentiality agreement?
The terms are often used interchangeably. According to Cornell's legal encyclopedia, a confidentiality agreement is sometimes broader and may include duties such as non-solicitation or non-compete. Read the actual clauses, not the title.
What are the biggest NDA red flags?
Look for a perpetual term on all information, a one-sided draft where both parties will disclose, open-ended permitted use, missing standard exclusions, and restrictive covenants tucked inside. Also check for any clause that discourages or conditions reporting to a regulator. Those are the points most worth raising or escalating to counsel.
Sources
- Non-disclosure agreement (NDA), Legal Information Institute, Cornell Law School)
- Whistleblower protections, U.S. Securities and Exchange Commission
- SEC charges GQG Partners with violating whistleblower protection rule
- SEC charges Nationwide Planning and two affiliated investment advisers
- Three things to know before you sign an NDA, IEEE Computer Society
- AI redlining an NDA: example redlines, AI for Law Firms
