Non-Disclosure Agreements: Drafting and Enforcement in India

Is an NDA legally enforceable in India?

Yes. An NDA is a contract like any other, so it binds if it meets the basic tests of the Contract Act: free consent, competent parties, lawful consideration and a lawful object. The mutual promise to share information for a purpose and to keep it secret is consideration enough. Courts in Delhi, including the Commercial Division of the Delhi High Court and the commercial courts in the district complexes, routinely hear suits founded on NDAs and confidentiality clauses.

Courts also protect confidential information even without a written NDA, on the equitable principle of breach of confidence. If information with the quality of confidence is shared in circumstances that make its confidential nature obvious, and the recipient uses it without permission, a court can restrain that use. A written NDA makes this far easier to prove, because it fixes what was confidential, why it was shared and what the recipient promised.

The limit comes from section 27 of the Contract Act, which makes void any agreement restraining a person from exercising a lawful profession, trade or business. A promise not to disclose or misuse specific information is not a restraint of trade. A promise not to work in the industry, or not to deal with anyone in a sector, is. Many NDAs mix the two, and the mixed clause is where enforcement usually fails.

What can an NDA protect, and what can it not?

An NDA can protect information that is actually confidential: source code, product roadmaps, pricing models, customer lists with contact and purchase data, supplier terms, formulas, manufacturing processes, unpublished financials, deal terms and business plans. The common thread is that the information is not in the public domain, has value because it is secret, and was shared for a limited purpose.

It cannot protect what is already public, what the recipient knew before you told them, what the recipient develops independently, or what a third party gives the recipient lawfully. It also cannot take away the general skill, knowledge and experience a person carries in their head. A sales manager who learns how the industry works, who the buyers usually are and how pricing generally moves cannot be stopped from using that know-how. He can be stopped from copying your customer database or your rate card.

India has no standalone trade secrets statute in force. The Law Commission of India recommended one in its 289th Report in 2024 and attached a draft bill, but as of this writing it has not been enacted. So the protection of trade secrets still rests on contract, on the law of confidence, and in some cases on copyright (for code, databases and compilations) and on criminal provisions. This makes the drafting of the NDA itself more important in India than in countries with a trade secrets act.

One-way NDA, mutual NDA or a confidentiality clause: which do you need?

The right form depends on who is sharing what. Using a mutual NDA when only one side discloses, or the reverse, creates obligations nobody intended.

Which clauses decide whether an NDA holds up in court?

Judges read the NDA closely at the interim stage. These are the clauses that carry the weight, in roughly the order a court looks at them.

• Definition of confidential information. It should describe categories that fit your business (for example, source code, customer data, pricing and product plans) and cover oral and visual disclosures confirmed in writing within a short period. A definition that says everything is confidential tends to persuade nobody.
• Purpose. State why the information is being shared, such as evaluating a supply arrangement. Use for any other purpose is then a breach, even without disclosure to anyone else. Many leaks are actually misuse, not disclosure.
• Exclusions. Public domain information, prior knowledge, independent development and lawful receipt from a third party. Courts expect to see these. Their absence makes the NDA look one-sided and can weaken an injunction claim.
• Permitted recipients. Limit disclosure to employees, directors and advisers who need to know, bound by similar duties, and make the recipient liable for their breaches.
• Compelled disclosure. Allow disclosure required by law, a court or a regulator, with prompt notice to you where the law permits, and disclosure of no more than is required.
• Standard of care and security. At least the care the recipient uses for its own information, and no less than reasonable care. For data-heavy deals, specify access controls and a ban on copying to personal devices.
• Return or destruction. On request or at the end of the purpose, with written certification. Allow retention of archival copies only where the law requires, still under confidentiality.
• Term and survival. How long disclosures may be made, and how long the duty of confidence lasts after that. Trade secrets can be protected for as long as they remain secret.
• No licence and no obligation. Sharing information grants no rights in it and does not commit either side to a deal.
• Remedies. An acknowledgment that damages may not be adequate and that the discloser may seek an injunction, plus an indemnity or a liquidated damages figure where it can be justified.
• Governing law, jurisdiction and dispute resolution. Indian law, a named court with jurisdiction (for example, courts at New Delhi), or an arbitration clause that preserves the right to go to court for urgent interim relief.

How long should confidentiality last under an NDA?

There is no statutory period. Two to five years after the end of the discussions is common for ordinary commercial information such as pricing and business plans, because that kind of information loses value quickly. For genuine trade secrets, such as a formula, an algorithm or a manufacturing process, the duty should last as long as the information remains confidential, and the NDA should say so expressly.

Separate the disclosure period from the survival period. The disclosure period is the window during which information is exchanged, often one or two years. The survival period runs after that. NDAs that have one short term for everything sometimes expire at the very moment the recipient is most tempted to use what it learned.

A long duty of confidence is not a restraint of trade, so section 27 does not cut it down. What courts dislike is a long period attached to vague information. Five years of confidentiality over a clearly defined customer database is easier to enforce than an indefinite duty over everything said in meetings.

Does an NDA need stamp paper, notarisation or registration?

An NDA does not need registration under the Registration Act 1908, because it does not create or transfer rights in immovable property. Notarisation is not required for validity either; it adds little except proof of identity and date. What an NDA does attract is stamp duty under the stamp law of the state where it is executed, usually under the entry for agreements not otherwise provided for, which in Delhi and Uttar Pradesh is a small fixed amount. Check the current schedule before you buy the e-stamp, as states revise these entries.

Skipping stamp duty does not make the NDA void, but it does make it inadmissible in evidence until the deficit and penalty are paid, under section 35 of the Indian Stamp Act 1899. A seven-judge bench of the Supreme Court held in 2023 (In re Interplay between Arbitration Agreements and the Indian Stamp Act) that an unstamped agreement is not void and the defect is curable, but paying a penalty in the middle of an urgent injunction hearing is avoidable trouble. Pay the duty when you sign.

NDAs signed electronically are valid. Section 10A of the Information Technology Act 2000 recognises contracts formed electronically, and electronic signatures under sections 3A and 5 have the same effect as handwritten ones. Aadhaar-based eSign and digital signature certificates leave the clearest trail. A click-through acceptance or an exchange of emails can also form a binding NDA; our post on whether e-signed and click-through contracts are valid in India covers the evidence you need to keep.

Can an employer enforce an NDA against an employee who has left?

Yes, the confidentiality part survives the end of employment and is enforceable against a former employee. Courts in Delhi have repeatedly drawn the line this way: an employer cannot stop an ex-employee from joining a competitor or earning a living, but it can stop him from using or disclosing confidential information and, in many cases, from soliciting the clients he dealt with using that information.

In practice the dispute turns on what the employee took and what he is doing with it. A court will want to know whether he downloaded files before leaving, forwarded documents to a personal email, copied a client list or is approaching your customers with your pricing. Evidence of these acts is what turns a confidentiality clause into an injunction. A bare allegation that he knows our business does not.

Draft employee NDAs with this in mind. Keep the confidentiality undertaking separate from the non-compete, so that if the non-compete falls under section 27 the confidentiality clause still stands. Section 27 says the agreement is void to that extent, and courts can sever the bad part, but a clean separate clause makes that easier. Build in an exit routine: return of devices and documents, a signed declaration that no copies are retained, and revocation of system access on the last day.

What should you do in the first week after discovering a breach?

Preserve evidence before you confront anyone. Take forensic images of the laptops, phones and email accounts that belong to your business, through a qualified examiner, and keep system logs showing downloads, USB use and file transfers. Do not log into the other side's personal accounts or devices; that can itself be an offence under the IT Act and will undermine your case.

Electronic records will be the heart of the case, and they must be proved properly. Under section 63 of the Bharatiya Sakshya Adhiniyam 2023, a certificate in the prescribed form is needed to admit computer outputs. Our post on electronic evidence and the section 63 BSA certificate explains how to get this right from the start.

Then decide quickly, because delay is the most common reason courts refuse interim relief in confidentiality cases. A plaintiff who knew of the leak in January and files in June will be asked why the court should treat the matter as urgent. When Advocate B.K. Singh is called in on a data leak, the first thing he fixes is a dated timeline: when the information was shared, when the employee or partner left, when the misuse was discovered and what has been done since. That timeline usually decides whether an ex parte order is realistic.

How to enforce an NDA: from discovery to an injunction

The usual route in Delhi NCR is a civil suit for injunction and damages with an urgent application for interim relief. The steps below assume the dispute is a commercial dispute of ₹3 lakh or more.

1. Collect the contract and proof of disclosure

   Locate the signed NDA, its stamp paper or e-stamp certificate, and records showing what was actually shared: data room logs, email trails, meeting notes, versions of documents. An NDA without proof of what was disclosed under it is half a case.

2. Gather proof of misuse

   Forensic reports, screenshots of the competitor's product or website, messages sent to your customers, statements from staff or clients. Get the section 63 BSA certificate prepared along with the printouts.

3. Decide whether to send a notice first

   A cease-and-desist notice works where the other side is reputable and may back off. Where there is a risk that data will be destroyed or spread further, skipping the notice and going straight to court is usually wiser.

4. Choose the forum

   If the NDA has an arbitration clause, interim relief is sought under section 9 of the Arbitration and Conciliation Act 1996. Otherwise file a commercial suit before the commercial court or, for claims above ₹2 crore in Delhi, the Commercial Division of the Delhi High Court. Pre-institution mediation under section 12A of the Commercial Courts Act 2015 is not needed when urgent interim relief is sought.

5. File the suit with an application under Order 39 Rules 1 and 2 CPC

   Ask for an ad interim injunction restraining use and disclosure, and where needed an order appointing a local commissioner to visit the premises and seize or image devices. The plaint must describe the confidential information with enough detail for an order to be workable, without disclosing it publicly; sealed covers can be requested.

6. Appear at the first hearing

   The court decides whether to grant an ex parte order, issue notice, or both. Be ready to explain urgency, show the NDA and the evidence, and offer an undertaking to compensate the defendant if the order is later found wrong.

7. Contest the interim application and move to trial or settlement

   The defendant files a reply and the court hears both sides on the interim injunction. Many NDA disputes settle at this stage with undertakings, return of data and a payment. If not, the suit proceeds to pleadings, the case management hearing and trial.

If the NDA has an arbitration clause, the same evidence goes into a section 9 petition, and the tribunal later decides the merits. Our post on section 9 interim relief before and during arbitration covers that route.

The legal provisions used in NDA disputes

What does a court look at before granting an injunction for breach of an NDA?

The court applies the usual three tests: a prima facie case, the balance of convenience and irreparable harm. In confidentiality cases, the prima facie case depends on three things you must show on paper: that the information is confidential, that it was shared under an obligation of confidence, and that the defendant is using or about to disclose it without permission.

Specificity matters more than people expect. A court cannot pass a workable order restraining the use of all confidential information of the plaintiff, because the defendant will not know what he may and may not do. Plaintiffs who identify the information by category and example, and file the details in a sealed cover where needed, get orders. Plaintiffs who rely on a general allegation often get notice and a date.

The balance of convenience usually favours a narrow order. Courts are reluctant to stop a business from operating altogether, or an individual from working, on the basis of an NDA. An order that restrains use of a particular customer list or a particular codebase, while the case is decided, is much easier for a judge to grant than an order shutting down a competitor. Ask for what you can justify.

Conduct counts. A plaintiff that delayed, that shared the same information widely without any NDA, or that itself breached the agreement will struggle. A defendant that can show independent development, with dated design documents and commit histories, often defeats the injunction even where some overlap exists.

Damages, liquidated damages and accounts of profits

Money is the second remedy, and it is harder to prove than people think. Under section 73 you must show the loss that flowed from the breach: lost contracts, lost customers, the cost of rebuilding, or the market value of the information. Courts want evidence such as accounts, lost purchase orders or an expert valuation, not a round figure in the plaint.

A liquidated damages clause helps, but it is not a blank cheque. Section 74 lets the court award reasonable compensation up to the agreed figure, and the Supreme Court has held that where loss is capable of proof, it must be proved, while a genuine pre-estimate can be awarded where loss is hard to measure. An NDA figure of ₹10 crore for any breach, in a deal worth ₹50 lakh, looks like a penalty and is unlikely to be awarded in full. The broader rules are in our post on claiming damages and liquidated damages for breach of contract.

Where the defendant has profited from the information, the plaintiff can also ask for an account of profits as an alternative to damages. This is a well-recognised equitable remedy in confidence and intellectual property cases, and it can be easier to prove when the defendant's sales of the copied product are known.

Should an NDA have an arbitration clause or go to court?

For most NDAs, court is the better forum, or at least a clause that keeps court open for urgent relief. Arbitration suits disputes about money and performance between commercial parties. NDA breaches are about speed: you need an order against the defendant, and often against third parties such as a new employer or a hosting provider, within days. A court can bind third parties more easily, and its orders are enforced directly.

An arbitration clause does not prevent urgent relief, because section 9 lets a party approach the court for interim measures before or during the arbitration. The tribunal can also grant interim measures under section 17 once constituted. But you end up with two proceedings and two sets of costs. If the NDA is part of a larger contract that already has an arbitration clause, keep it consistent and make sure the clause expressly preserves court relief for confidentiality breaches.

With foreign parties, choose the governing law and the forum deliberately. An NDA under English law with London courts may look neutral, but if the information and the defendant are in India, enforcing a foreign court judgment here involves its own steps. An Indian seat or Indian courts with jurisdiction are often more practical.

Can you file a police complaint for theft of confidential data?

Sometimes, but it is rarely the main remedy. Police complaints help where there was clear unauthorised access, such as an ex-employee logging into company servers after leaving, or physical removal of documents and devices. The IT Act offences under sections 43 and 66, and section 72A for personal data disclosed in breach of contract, fit those facts, and the cyber police station can seize devices with a warrant or court order.

Where the dispute is really about what an ex-partner or ex-employee remembers and is using commercially, police usually treat it as a civil matter, and a criminal complaint filed only to pressure the other side can be quashed by the High Court. Our cyber laws practice page explains when the criminal route adds something. In most NDA breaches, the civil injunction does the real work and a criminal case is a supplement at best.

Common mistakes that weaken an NDA

The first is using an internet template without changing it. Templates written for US or UK law often refer to statutes and remedies that do not exist here, choose foreign courts by default, and include broad non-competes that are void in India. A judge reading a template that does not fit the transaction gives it less weight.

The second is failing to record what was shared. Businesses sign the NDA, then send information through calls, WhatsApp and shared drives with no index. When a dispute arises, they cannot show which documents went across, when and to whom. Use a data room or at least a log, and mark key documents as confidential.

The third is sharing first and signing later. Information disclosed before the NDA was signed may not be covered unless the NDA expressly includes earlier disclosures. The fourth is getting the wrong person to sign. An NDA signed by a junior employee of a company, without authority, can be disputed. Check that a director or an authorised signatory signs, and keep the board resolution or authority letter.

Checklist before you sign or send an NDA

Run through this list for every NDA, on either side of the table.

• Is it one-way or mutual, and does that match who is actually sharing information?
• Are the parties correctly named, with the company's registered name and CIN, and is the signatory authorised?
• Does the definition describe the real categories of information, including oral disclosures?
• Is the purpose stated, and is use for any other purpose prohibited?
• Are the standard exclusions included?
• Is there a separate disclosure period and survival period, with longer protection for trade secrets?
• Does it cover advisers and group companies, and make the recipient liable for them?
• Is there a return or destruction clause with certification?
• Is any non-compete or non-solicit kept separate and narrowly drawn?
• Is the governing law Indian, with a named court or an arbitration clause that preserves urgent court relief?
• Has stamp duty been paid under the right state's schedule, or is the e-signature trail complete?
• Is there a log of what you share under it?

What to do this week

If you are about to share sensitive information, get the NDA right before the first meeting, and share only what the purpose needs. A good NDA cannot undo an over-disclosure. If you suspect a breach, secure your own systems and devices, write down the timeline, and get advice before contacting the other side.

A point Advocate B.K. Singh often makes to founders is that the NDA is only as strong as the paper trail behind it: who received what, on which date, under which agreement. If you want an advocate to read your NDA or assess a suspected leak, the team of Advocate B.K. Singh at B.K. Singh & Associates can look at the papers and tell you what is realistic. You can reach us through the online legal enquiry page, and disputes that go to court are handled through our commercial court practice in Delhi.