NDA explainer: every clause of a non-disclosure agreement in plain English (2026)

A non-disclosure agreement (NDA) is a contract in which one or both sides promise to keep the other's information confidential and use it only for an agreed purpose. It is also the most signed and least read document in an Indian startup. This page walks through two real-shaped NDAs clause by clause: the mutual NDA Saffron Labs signed with a customer for a paid pilot, and the one-way confidentiality and standstill agreement it gave a listed buyer during acquisition diligence. That is 30 clauses in all, each with a plain-English note on what it says, what it means for you, what is normal in India in 2026 and how to negotiate it. Around them sit 59 glossary terms, a decision table covering 12 situations from an investor pitch to a government tender, a comparison of NDAs with confidentiality clauses, non-competes, non-solicits and trade-secret policies, and a calculator that tells you which NDA you need. The tax, stamp duty, data protection and company law layer is written by the BizExpress compliance team, because that is where templates go wrong.

Free, no sign-upWorks in your browserLaw as at 4 November 2026

In short

What it is

A non-disclosure agreement is a contract in which one or both sides promise to use the other's secret information only for a stated purpose and to keep it from everyone else. It protects information, not ideas or markets. Saffron signs two kinds on this page: a mutual NDA with a customer for a paid pilot and a one-way NDA with a listed buyer for acquisition diligence.

What is enforceable in India

Confidentiality promises are enforceable in India. They survive employment and end only when the information becomes public or the agreed survival period runs out. A non-compete that bites after employment ends is void under Section 27 of the Indian Contract Act 1872. A non-solicit for a reasonable period is usually upheld. The remedies are an injunction and proven damages, never a penalty.

The four clauses that matter most

The definition of Confidential Information and its exclusions decide what is protected. The purpose and need-to-know limits decide who may see it and why. Term and survival decide how long the duty lasts. Remedies decide what you can do about a leak. Read these four before anything else; the rest is machinery.

What is normal in 2026

A 2 to 3 year agreement with obligations surviving 3 to 5 years after it ends; trade secrets protected for as long as they stay secret; employee non-solicits of 12 to 18 months; mutual for pilots and partnerships, one-way for vendors and buyers; nominal State stamp duty of a few hundred rupees; signed electronically with no notarisation.

What to push back on

A marking requirement that loses every oral disclosure; a residual knowledge clause that swallows the agreement; perpetual terms on ordinary business information; one-sided indemnities and liquidated damages; a non-compete dressed up as confidentiality; and a compelled-disclosure clause with no notice, or no carve-out for compelled disclosure at all.

When not to bother

Investors do not sign NDAs for pitches, so do not send one. A pitch deck, information you will publish on your website, and a conversation with an employee who already has a confidentiality clause in the employment agreement need no separate NDA. A data room with click-through terms usually has one built in; read it instead of adding another.

Look up a term

Most looked-up terms: Non-disclosure agreement (NDA)Mutual NDA One-way NDA Confidential Information Exclusions from Confidential Information Residual knowledge clause Standstill NDA with investors Stamp duty on an NDA Term and survival

Before the clauses
NDA, confidentiality clause, non-compete, non-solicit and trade-secret policy compared
The sample documents, clause by clause
Which NDA for which situation
Calculators
Every term, in plain English
Before you sign
From first draft to the end of survival
How this page was put together
Questions founders ask about NDAs

Before the clauses

Four things that make the rest of the document easier to read.

An NDA protects information, not an idea

An NDA stops the other side from using or passing on specific information you gave them under it. It does not stop them competing with you, building a similar product from public knowledge, or acting on an idea they can show they already had. Indian law has no trade-secrets statute; protection rests on the contract and on the equitable action for breach of confidence. So the agreement is only as strong as its definition of Confidential Information, your record of what you disclosed and when, and your willingness to go to court for an injunction. Treat the NDA as a disclosure discipline, not a shield: disclose in stages, label what you can, and keep a log.

Section 27 draws the line: confidentiality yes, non-compete no

Section 27 of the Indian Contract Act 1872 makes any agreement in restraint of trade void, with a narrow exception for the seller of a business's goodwill. A promise not to disclose or misuse information is not a restraint of trade: the other side can carry on its business, just not with your secrets. That is why confidentiality survives the end of a relationship and the end of employment. A promise not to compete after the relationship ends is a restraint, and courts will not enforce it against a former employee however it is worded. A promise not to poach each other's staff for 12 to 18 months sits in between and is usually upheld. If a counterparty tries to add a non-compete to an NDA, that clause does not become enforceable because of the heading on the document.

The definition and the exclusions decide every later argument

Almost every NDA dispute is fought on two paragraphs: what counts as Confidential Information and what is excluded. A definition that only covers information marked Confidential loses every oral disclosure in a plant walk-through or a sales call. A definition with no exclusions is unenforceable in practice, because the other side cannot tell what it may use. The standard set of exclusions is public information, information already known, information independently developed and information received from a third party, each without breach of any duty, with the burden of proof on the party claiming the exclusion. Get these two paragraphs right and the rest of the document is machinery.

An acquirer's NDA is three agreements in one, plus insider-trading rules

When a buyer looks at your company, the NDA does three jobs. It is a confidentiality agreement for the data room, a standstill that stops the buyer going around you to your shareholders, customers and employees, and a non-solicit that protects your team and customers if the deal dies. Where the buyer is listed, as Kaveri Industrial Software Limited is on Saffron's exit page, the information can be unpublished price sensitive information for the buyer's own shares, so the buyer must handle it under the SEBI (Prohibition of Insider Trading) Regulations 2015. Where the buyer competes with you, a clean team keeps your pricing and customer contracts away from its commercial staff until signing.

NDA, confidentiality clause, non-compete, non-solicit and trade-secret policy compared

Founders use these five words interchangeably. They protect different things, bind different people and, in India, have very different lives after the relationship ends. The non-compete and non-solicit columns are explained in full on the Term Sheet Explainer and the Shareholders' Agreement Explainer.

	Standalone NDA	Confidentiality clause in a contract	Non-compete covenant	Non-solicit covenant	Trade-secret policy
What it protects	Specific information disclosed for a defined purpose, before or outside a main contract	Information exchanged while performing the main contract (a pilot, a SaaS subscription, a services agreement)	Your market position: the other side agrees not to carry on a competing business	Your people and customers: the other side agrees not to poach them	Your internal secrecy: who may see what inside your own company, how it is labelled, stored and logged
Who it binds	The signing parties and their Representatives (employees, advisers, affiliates) back to back	The contracting parties; usually silent on advisers and affiliates unless drafted	Founders as shareholders, sellers of goodwill, or employees during employment	Counterparties, departing founders, acquirers and sometimes vendors	Your own employees, contractors and systems; no counterparty
Enforceable after the relationship ends in India	Yes, for the survival period and, for trade secrets, while they stay secret	Yes, if the clause says it survives termination; otherwise argued	No against a former employee (Section 27 of the Indian Contract Act 1872); yes while a shareholding continues or on a sale of goodwill within reasonable limits	Usually yes for a reasonable period of 12 to 24 months, because it does not restrain the other side's own trade	Not a contract with outsiders; it is evidence that you treated the information as secret, which the action for breach of confidence needs
Typical term	2 to 3 years, with obligations surviving 3 to 5 years after expiry	Life of the contract plus 2 to 5 years	Shareholding plus 12 to 24 months (Series A); 3 years on a sale of goodwill	12 to 18 months after the relationship ends	Permanent, reviewed yearly
Remedy	Injunction under the Specific Relief Act 1963 and damages under Section 73 of the Indian Contract Act 1872; no penalty	The same, plus termination of the main contract and any indemnity it carries	Injunction where enforceable; damages are hard to prove; forfeiture of unvested shares where the SHA says so	Injunction and damages; sometimes an agreed sum tested against Section 74	Disciplinary action, termination for cause, and a cleaner case in court
Where it belongs	Pilots, partnerships, vendor evaluations, acquisition diligence, adviser discussions	Every commercial contract; it replaces the NDA once the contract is signed	The SHA, the SPA on an exit and the employment agreement for the period of employment	The SHA, the SPA, acquirer NDAs and employment agreements	Your employee handbook, IT policy and onboarding pack
Where it is explained	This page	This page, and the confidentiality clause on the Term Sheet Explainer	The non-compete term on the Term Sheet Explainer and the restraint of trade term on the SHA Explainer	The non-solicit term on the Term Sheet Explainer; the NDA non-solicit on this page	The trade secret term on this page

The sample documents, clause by clause

Click a clause. The notes beside it tell you what it says, what it means for you, what is normal, and how to negotiate it. Dotted words open the glossary; terms defined on another explainer open there.

Example only

Mutual Non-Disclosure Agreement between Saffron Labs Private Limited and Tungabhadra Forge Industries Limited

In January 2026 Saffron Labs agreed to pilot its workflow software at two Hosur plants of Tungabhadra Forge Industries Limited, an unlisted auto-components manufacturer. Both sides would disclose: Saffron its roadmap, pricing and demonstration environment, Tungabhadra its plant layouts, production data and employee shift records. So the parties signed a mutual NDA before the pilot agreement. The 16 clauses below are the full document, with a note on each explaining what it says, what it means for a founder, what is normal in India and how to negotiate it.

Parties: Saffron Labs Private Limited, Bengaluru (CIN U72900KA2023PTC171234); Tungabhadra Forge Industries Limited, Hosur, Tamil Nadu, an unlisted auto-components manufacturer
Purpose: Evaluation and a paid pilot of Saffron's workflow software at two of Tungabhadra's plants at Hosur
Type: Mutual: either party may be the Disclosing Party or the Receiving Party
Term: 2 years from the Effective Date; obligations survive 3 years after expiry; trade secrets protected while they remain secret
Personal data: Employee shift and attendance data of the customer, covered by the Digital Personal Data Protection Act 2023 from around 13 May 2027 and by the NDA's personal data clause from signing; Saffron acts as data processor
Non-solicit: Employees with material contact, 12 months after expiry, mutual, general advertising excepted
Governing law: Indian law; exclusive jurisdiction of the courts at Bengaluru; no arbitration
Signed: 5 January 2026, by electronic signature in counterparts; Ananya Rao for Saffron

Framework

1. Parties and Purpose

This Mutual Non-Disclosure Agreement (the "Agreement") is made on 5 January 2026 between Saffron Labs Private Limited, a company incorporated under the Companies Act 2013 with CIN U72900KA2023PTC171234 and its registered office at Bengaluru, Karnataka ("Saffron"), and Tungabhadra Forge Industries Limited, an unlisted public company with its registered office at Hosur, Tamil Nadu ("Tungabhadra"), each a "Party" and together the "Parties". The Parties wish to evaluate, and if both so agree to carry out, a paid pilot of Saffron's workflow software at two of Tungabhadra's manufacturing plants at Hosur (the "Purpose"). In connection with the Purpose each Party may disclose Confidential Information to the other, and each Party may accordingly be a "Disclosing Party" or a "Receiving Party". Nothing in this Agreement obliges either Party to disclose any information, to proceed with the pilot, or to enter into any further agreement, and no agreement for the pilot shall arise except under a separate written contract signed by both Parties.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

The opening clause names the two companies, fixes the date and defines the Purpose: evaluating and running a paid pilot of Saffron's software at two Hosur plants. Because the agreement is mutual, either company can be the discloser or the recipient depending on who is handing over information. The last sentence keeps the NDA from becoming a contract for the pilot itself: nobody has agreed to buy or build anything yet, and the pilot will need its own signed agreement.

What it means for you

The purpose definition is the fence around everything you disclose. Tungabhadra may use your roadmap and pricing only to evaluate and run this pilot, not to brief another vendor or build an in-house tool. Check the entities: if Tungabhadra signs through a group procurement company and the plants belong to a subsidiary, the subsidiary is not bound unless the clause brings it in. Get the CIN and registered office right, because an injunction is served on the entity named here. Keeping the pilot out of this document means you can walk away after evaluation with no obligation to deliver anything.

What is normal

A purpose clause of one or two sentences is normal. Pilots and partnerships are mutual in roughly 8 out of 10 cases; vendor evaluations and acquisitions are one-way. The purpose is usually tied to a named project, a product and a site, as here. Purpose definitions that say any business discussions between the parties are too wide and let the recipient use the information for anything. Most mutual NDAs name 2 to 4 entities on each side where group companies are involved. The sentence that nothing obliges either party to transact appears in nearly every modern template.

How to negotiate it

Ask for three things. First, name the plants and the product in the purpose so that a later in-house project is outside it. Second, if the counterparty has group companies, add them as parties or bring them in through the Representatives clause, so that a sister company receiving your demo is bound. Third, add the sentence that nothing here obliges anyone to proceed, and resist any attempt to turn the NDA into a letter of intent with pricing or exclusivity. If the customer wants exclusivity for the pilot, that belongs in the pilot agreement with a fee attached.

Non-disclosure agreement (NDA)Mutual NDA Purpose limitation No obligation to transact

2. Confidential Information

"Confidential Information" means all information disclosed by or on behalf of a Disclosing Party to a Receiving Party or its Representatives, before or after the date of this Agreement, in connection with the Purpose, whether in writing, orally, electronically, by demonstration or by inspection of premises, and whether or not marked or identified as confidential, including: (a) Saffron's product roadmaps, pricing, source code, object code, architecture, algorithms, documentation and demonstration environments; (b) Tungabhadra's plant layouts, production data, shift schedules, quality records, supplier and customer information and process know-how; (c) personal data of either Party's employees made available for the pilot; (d) the existence and content of the Parties' discussions and the terms of any proposed pilot; and (e) all notes, analyses and compilations prepared by the Receiving Party that contain or reflect such information. Information disclosed orally or by inspection shall be Confidential Information whether or not the Disclosing Party confirms it in writing, provided that the Disclosing Party shall use reasonable efforts to summarise such disclosure in writing within 15 days.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

Everything either side discloses for the pilot counts as confidential whether it is written, spoken, shown on a screen or seen on a plant walk, and whether or not it carries a Confidential stamp. The clause lists the obvious categories on each side, adds employee personal data, the fact that the companies are talking at all, and the notes the recipient makes from the information. Oral and visual disclosures are protected immediately; the discloser only has to try to confirm them in writing within 15 days, and a missed summary does not lose protection.

What it means for you

This wording protects you in the way a pilot actually happens: a sales engineer talking through the roadmap, a demo of an unreleased module, a question answered on the shop floor. Under a marking requirement every one of those is unprotected unless you follow up in writing. Here the 15-day summary is good practice, not a condition. Keep a simple disclosure log anyway: date, who, what, how. If a dispute arises three years later, the log is your evidence of what was disclosed. Protecting the fact of discussions matters too: you may not want a competitor of Tungabhadra to know you are piloting there.

What is normal

The modern Indian market standard is a broad definition covering marked and unmarked information, with oral disclosures either protected outright or subject to a written summary within 10 to 30 days. Around half of large-company templates still make oral disclosures conditional on a written summary; a condition is acceptable only with a window of at least 15 days. Listing 4 to 6 categories by name is normal and helps a court. Treating the recipient's own notes and analyses as confidential is standard. Templates that protect only information marked Confidential are common from procurement teams and are the single biggest gap for a software vendor.

How to negotiate it

Make three asks. One: delete any wording that protects only marked information, or convert it into the soft summary obligation used here. Two: name your crown jewels, source code, pricing and roadmap, in the definition so that there is no argument later about whether a pricing sheet shown in a meeting was confidential. Three: include the fact and status of discussions, so that the pilot cannot be announced or leaked to a rival vendor. If the counterparty insists on a marking rule, extend the summary window to 30 days and add that information a reasonable person would understand to be confidential is protected even if unmarked.

Confidential Information Oral and visual disclosure Marked versus unmarked information Marking requirement Personal data under the DPDP Act in an NDA

3. Exclusions

Confidential Information shall not include information that the Receiving Party can demonstrate by contemporaneous written records: (a) was in the public domain at the time of disclosure, or later enters the public domain other than through a breach of this Agreement by the Receiving Party or its Representatives; (b) was lawfully in the possession of the Receiving Party, free of any obligation of confidence, before it was disclosed by the Disclosing Party; (c) was independently developed by the Receiving Party without use of or reference to the Disclosing Party's Confidential Information; or (d) was lawfully received from a third party who was free to disclose it without restriction. The burden of proving that any information falls within an exclusion shall rest on the Receiving Party. A combination of features shall not be treated as being in the public domain merely because individual features are public, unless the combination itself is in the public domain.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

Four kinds of information fall outside the agreement: what is already public, what the recipient already knew without any duty of secrecy, what the recipient builds on its own, and what it gets from someone else who was free to pass it on. The recipient has to prove the exclusion with records made at the time, not with a later recollection. The last sentence closes a common gap: you cannot call a combination of public elements public just because each element is available somewhere.

What it means for you

The exclusions are what make the agreement enforceable, because they tell the other side what it may use. For you they are also the escape routes a counterparty will run down if it ever wants to use your information. The burden of proof sentence is your main protection: if Tungabhadra says it was already building a similar scheduling tool, it must show dated documents. The independent development exclusion is where software vendors lose; insist on the words without use of or reference to, so that a team that saw your demo cannot claim a clean-room build. The combination sentence protects a product whose parts are all known but whose assembly is the secret.

What is normal

These four exclusions appear in effectively every NDA and no counterparty will refuse them. The variables are three. First, whether the recipient bears the burden of proof: 7 out of 10 well-drafted NDAs say so expressly. Second, whether independent development requires records: good templates demand contemporaneous written records. Third, whether there is a fifth exclusion for information approved for release in writing by the discloser, which is harmless. A residuals clause dressed as an exclusion is not standard and is dealt with in clause 12. The combination sentence appears in perhaps a third of Indian templates and is worth adding.

How to negotiate it

Ask for the burden of proof to sit with the receiving party, with written records made at the time. Ask for the independent development exclusion to read without use of or reference to the Confidential Information, not merely without breach. Ask for the combination sentence if it is missing. Refuse any exclusion for information retained in unaided memory or information generally known in the industry without a public domain test; both are residuals clauses in disguise. If the counterparty is a large manufacturer with many vendors, accept their wording on the public domain limb but hold the line on independent development.

Exclusions from Confidential Information Burden of proof under an NDA Residual knowledge clause Trade secret

Obligations

4. Use and standard of care

The Receiving Party shall: (a) use the Disclosing Party's Confidential Information solely for the Purpose and for no other purpose, including the development of any competing product or process; (b) protect the Confidential Information using at least the same degree of care that it uses to protect its own confidential information of a similar nature, and in no event less than a reasonable degree of care, including appropriate technical and organisational measures; (c) not copy or reproduce Confidential Information except as reasonably necessary for the Purpose, and ensure that every copy carries any confidentiality legend of the original; and (d) not reverse engineer, decompile, disassemble or otherwise attempt to derive the source code, structure, algorithms or process parameters of any software, sample, material or equipment made available by the Disclosing Party. The Receiving Party shall promptly notify the Disclosing Party on becoming aware of any unauthorised use or disclosure of Confidential Information and shall cooperate in remedying it.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

Four duties for whoever receives information: use it only for the pilot, guard it at least as carefully as its own secrets and never below a reasonable standard, copy it only when the pilot requires and keep the labels on the copies, and never pull the software or a sample apart to learn how it works. A fifth duty sits at the end: tell the other side promptly if something leaks and help fix it. The standard of care has a floor, so a careless company cannot hide behind its own bad habits.

What it means for you

The purpose limitation does the heavy lifting: it is the clause you point to if Tungabhadra's IT team starts building a scheduling module that looks like yours. The no competing product words make that argument explicit. The no reverse engineering clause matters because the pilot puts your software on their servers or their network; without it, decompiling a binary might not be a breach of anything. On your side, the same duties apply to their production data: your engineers must not reuse Tungabhadra's shift patterns in a demo for another forge. The notice duty is your early warning: it lets you seek an injunction quickly and starts any data breach reporting.

What is normal

Purpose limitation and a reasonable care floor appear in almost every NDA. The same care as its own information wording is standard; around 6 in 10 templates add the at least reasonable care floor and you should always insist on it. A no reverse engineering clause appears in most NDAs where software, samples or equipment change hands and in few pure services NDAs. A notification duty for leaks appears in around half of Indian templates, usually with promptly rather than a fixed period; 48 to 72 hours is seen in data-heavy NDAs. Specific security standards such as ISO 27001 are rare at pilot stage and belong in the pilot agreement.

How to negotiate it

Ask for the reasonable care floor if it is missing; a counterparty that protects its own information badly should not be allowed to protect yours badly. Ask for the no competing product words in the purpose limitation. Ask for the no reverse engineering clause whenever your software or a sample will sit on the other side's systems. If the counterparty wants a fixed security standard, accept reasonable technical and organisational measures in the NDA and move specific controls, penetration tests and audit rights to the pilot agreement where they can be priced. Where the other side proposes a 24-hour breach notice, counter with without undue delay and in any event within 72 hours.

Standard of care Purpose limitation Reverse engineering Notice of breach

5. Need to know and Representatives

The Receiving Party may disclose Confidential Information only to those of its directors, officers, employees, professional advisers, affiliates and subcontractors (its "Representatives") who need to know it for the Purpose, who have been informed of its confidential nature, and who are bound by written obligations of confidentiality and restricted use no less protective of the Disclosing Party than this Agreement, whether under their contracts of employment or engagement, professional duties or a separate undertaking. The Receiving Party shall be liable for any act or omission of its Representatives that would be a breach of this Agreement if committed by the Receiving Party, and shall on request provide the Disclosing Party with a list of the Representatives to whom Confidential Information has been disclosed. The Receiving Party shall not disclose Confidential Information to any affiliate or subcontractor that competes with the Disclosing Party without the Disclosing Party's prior written consent.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

Information may be passed only to people inside the recipient's organisation, and to its advisers, group companies and subcontractors, who need it for the pilot and who are already bound to keep it secret in writing. The recipient answers for anything those people do as if it had done it itself, and must produce a list of them on request. One sentence stops the information reaching a group company or a subcontractor that competes with the discloser unless the discloser consents.

What it means for you

Need to know is the practical limit on how far your roadmap travels inside a 2,000-person manufacturer: the plant head and the IT team yes, the whole procurement department no. The back-to-back obligation means every employee who sees your material is covered by their own employment contract's confidentiality clause, and every consultant by an engagement letter. The liability sentence is the one that matters in a dispute: you sue Tungabhadra, not its system integrator, and Tungabhadra cannot say the leak was a contractor's fault. The competing affiliate sentence protects you if the group owns a software subsidiary. The same applies to you: your subcontracted developers must sign written NDAs before they touch plant data.

What is normal

A Representatives definition covering employees, advisers and affiliates is universal; subcontractors are included in around two thirds of templates and should be, since most software pilots use implementation partners. The recipient being liable for its Representatives is standard; a weaker version that only requires the recipient to use reasonable efforts to procure compliance appears in large-company templates and should be resisted. A right to a list of Representatives on request appears in roughly half of acquisition NDAs and a quarter of commercial ones. A competing-affiliate restriction is uncommon in pilots and common where the counterparty is a conglomerate with a technology arm.

How to negotiate it

Ask that the recipient is liable for its Representatives, not merely obliged to use reasonable efforts. Ask that subcontractors and implementation partners are named as Representatives and bound by written obligations, since they will have hands-on access to your software. Ask for the list-on-request right, which costs nothing and makes a later investigation possible. If the counterparty has a captive software or automation subsidiary, ask for the competing-affiliate consent sentence; a large manufacturer will usually accept it if you offer the same restriction on your side. Accept that professional advisers bound by professional duties, such as auditors and lawyers, need no separate undertaking.

Need to know Representatives Affiliates in an NDA affiliate

6. Permitted and compelled disclosure

The Receiving Party may disclose Confidential Information to the extent required by applicable law, by an order of a court or tribunal of competent jurisdiction, by a governmental or regulatory authority, or by the rules of any stock exchange on which its securities are listed, provided that the Receiving Party shall, to the extent lawful and practicable: (a) give the Disclosing Party prompt written notice of the requirement before making the disclosure, so that the Disclosing Party may seek a protective order or other remedy; (b) consult with the Disclosing Party on the content and timing of the disclosure; (c) disclose only that portion of the Confidential Information that its counsel advises is legally required to be disclosed; and (d) use reasonable efforts to obtain confidential treatment for the information disclosed. Disclosure made in compliance with this clause shall not be a breach of this Agreement, but the information disclosed shall otherwise remain Confidential Information for all other purposes.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

If the law, a court, a regulator or a stock exchange forces the recipient to hand over information, it may do so without breaching the agreement. In return it must warn the discloser first where that is lawful, talk to it about what will be disclosed, hand over only the minimum its lawyers say is required, and try to get the information treated as confidential by whoever receives it. The information stays confidential for every other purpose afterwards, so a disclosure to a tax officer does not make the information public.

What it means for you

Every NDA needs this clause because a recipient cannot promise to defy a court. For you the value is in the four conditions. Notice gives you the chance to go to court for a protective order before your pricing lands in a public filing. The minimum necessary rule stops a recipient dumping the whole data room in response to a narrow notice. If Tungabhadra were listed, its disclosure duties under SEBI's listing regulations would be a live route for information about the pilot to become public; it is unlisted, so the realistic triggers are an income-tax or GST notice, a labour inspection, or litigation with a third party. The same clause protects you if a court asks for their production data.

What is normal

A compelled disclosure carve-out appears in almost every NDA. Prompt notice where lawful is standard, as is the minimum necessary rule. Consultation and the duty to seek confidential treatment appear in roughly 6 of 10 templates. The weak version to watch for allows disclosure whenever required by law with no notice at all; around a quarter of procurement templates read that way. Some templates add a permitted disclosure list, allowing disclosure to existing investors, lenders and insurers; that is normal in acquisition and fundraising NDAs and unusual in a customer pilot. Notice periods are rarely fixed; where they are, 5 business days before disclosure is typical.

How to negotiate it

Ask for notice before disclosure wherever lawful, so you can seek a protective order, and for the minimum necessary rule to be stated expressly. Ask for the counsel advises wording, which stops a recipient over-disclosing to be safe. Ask that information disclosed under compulsion stays confidential for all other purposes. If the counterparty wants a permitted disclosure list for its auditors, insurers and lenders, agree, but tie each recipient to confidentiality duties and limit the information to what they need for their function. Refuse a clause that allows disclosure to any person where the recipient considers it required.

Compelled disclosure Permitted disclosure

7. Personal data

Each Party shall comply with the Digital Personal Data Protection Act 2023 and the rules made under it (the "DPDP Act") in respect of any personal data it processes in connection with the Purpose. Each Party shall remain the data fiduciary for the personal data of its own employees. Where Saffron processes personal data of Tungabhadra's employees, including shift, attendance and productivity data, for the pilot, Saffron shall do so as a data processor on behalf of Tungabhadra, solely on Tungabhadra's written instructions and under a written contract that satisfies the DPDP Act, which the Parties shall sign before any such data is transferred. Each Party shall implement reasonable security safeguards to prevent personal data breaches, shall notify the other without undue delay on becoming aware of any personal data breach affecting the other's data, shall not transfer such personal data outside India except as permitted under the DPDP Act, and shall erase such personal data at the end of the pilot or when the Purpose is served, whichever is earlier, unless retention is required by law.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

The pilot will run on Tungabhadra's employee data, so the clause sets out who is responsible for it under the DPDP Act. Each company stays the data fiduciary for its own employees. When Saffron handles Tungabhadra's shift and attendance data, it does so as a data processor under Tungabhadra's instructions and a separate written contract that must be signed before any data moves. Both sides must keep the data secure, report breaches to each other quickly, keep it in India unless the Act allows otherwise, and delete it when the pilot ends.

What it means for you

An NDA treats data as a secret; the DPDP Act treats it as something the employee has rights over. Both regimes apply to you at once. As a processor you may process only on the fiduciary's instructions, so a breach report from your systems goes to Tungabhadra, which carries the duty to notify the Data Protection Board and the affected employees. The written processor contract is what the Act and its Rules expect once their obligations commence, around 13 May 2027, so plan for it as a schedule to the pilot agreement rather than a separate negotiation. Erasure at the end of the pilot means your engineers cannot keep the real dataset to tune the product; anonymise it if you want to keep learning from it. Penalties under the Act run to ₹250 crore for a fiduciary that fails on security safeguards, so the customer will care.

What is normal

Since the DPDP Rules were notified on 13 November 2025, a personal data clause appears in most NDAs where employee or customer data will be handled, and a separate processor contract or schedule is standard where one party processes for the other. Breach notice to the other party within 24 to 72 hours is the usual range; the Act's own notification to the Data Protection Board and to affected individuals falls on the fiduciary. Erasure at the end of the purpose or within 30 to 90 days after it is normal. Obligations under the Rules phase in over 12 to 18 months, with most applying from around 13 May 2027, so pilots signed in 2026 often carry a clause saying each party will comply as and when the relevant provision comes into force.

How to negotiate it

Ask for the processor contract to be a schedule to the pilot agreement so there is one document, not three. Ask for a 72-hour breach notice between the parties rather than 24 hours, since you need time to confirm an incident before reporting it. Ask for a right to retain anonymised and aggregated data that no longer identifies anyone, so that the pilot improves the product. Ask that cross-border transfer is permitted for a named cloud region if your stack sits outside India, or confirm now that the pilot will run in an Indian region. Resist an open-ended audit right in the NDA; put audits in the pilot agreement with notice and frequency limits.

Personal data under the DPDP Act in an NDA Data fiduciary Data processor Breach notification under the DPDP Act Cross-border transfer under the DPDP Act

8. Return or destruction

Within 15 days of a written request by the Disclosing Party, and in any event within 30 days of the expiry or termination of this Agreement or the completion or abandonment of the Purpose, the Receiving Party shall, at the Disclosing Party's election, return or securely destroy all Confidential Information of the Disclosing Party in its or its Representatives' possession or control, including all copies, notes, analyses and extracts, and shall permanently erase all electronic copies, and an authorised officer of the Receiving Party shall certify compliance in writing. The Receiving Party may retain: (a) one archival copy of Confidential Information in the custody of its legal or compliance function solely to the extent required to comply with applicable law, regulation or bona fide document retention policies or to evidence its obligations under this Agreement; and (b) Confidential Information held in automatic electronic backup systems until overwritten in the ordinary course, provided that such copies are not accessed for any other purpose and remain subject to this Agreement for so long as they are retained.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

When the discloser asks, or when the agreement or the pilot ends, the recipient has to give back or destroy everything it received, including its own notes built on the information, wipe electronic copies and confirm in writing that it has done so. Two exceptions are allowed: one archival copy kept by the legal team for compliance, and whatever sits in automated backups until the backup cycle overwrites it. Anything kept under the exceptions stays confidential for as long as it exists, and the 15-day and 30-day deadlines fix when the duty bites.

What it means for you

This is the clause you use when a pilot ends without a contract: send the request, get the certificate, and the live risk of misuse drops sharply. Ask for the certificate every time; it is also evidence that the other side knew what it held. The archival copy exception is unavoidable in large companies and harmless if it is limited to the legal or compliance function and to compliance purposes. The backup exception reflects how IT actually works. On your side, the pilot software and any Tungabhadra data on your servers fall under the same duty; build deletion into your offboarding runbook so that the 30-day deadline is met without a scramble.

What is normal

Return or destroy at the discloser's election, within 10 to 30 days of a request, is standard. Certification by an officer appears in around 7 of 10 templates. The archival copy and backup exceptions appear in most templates drafted since 2015 and are accepted market practice; the variables are who holds the archival copy (legal or compliance is standard) and whether backups must be inaccessible in ordinary use. Some templates allow the recipient to keep information needed to evidence its rights, which is a wider and less acceptable exception. The duty rarely extends to the recipient's own board minutes or internal approvals, which is reasonable.

How to negotiate it

Ask for the election to be yours as discloser, so that you can demand return of a physical sample while allowing destruction of emails. Ask for certification by a named officer, not just by the recipient. Ask that the archival copy is held by legal or compliance and used only for compliance, and that backups are not accessed for any other purpose. Resist any exception for information the recipient needs to evidence its rights or to protect its position, which can justify keeping everything. If the counterparty asks for the same 30-day window from you, agree; it is easy to meet with a deletion checklist.

Return or destruction Archival copy Certificate of destruction

Boundaries

9. No licence, no warranty, no obligation to transact

All Confidential Information is provided as is. Neither Party makes any representation or warranty, express or implied, as to the accuracy, completeness or fitness for any purpose of its Confidential Information, except as may be set out in a definitive written agreement for the pilot, and neither Party shall have any liability to the other arising from the use of Confidential Information in accordance with this Agreement. Nothing in this Agreement grants the Receiving Party any licence, right, title or interest in or to any Confidential Information or any patent, copyright, trade mark, trade secret or other intellectual property right of the Disclosing Party, all of which remain the exclusive property of the Disclosing Party, and no such right shall arise by implication or estoppel. Either Party may at any time, for any reason and without liability, decline to disclose any information or terminate discussions concerning the Purpose by written notice to the other, and no Party is obliged to enter into the pilot or any other transaction.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

Three disclaimers in one place. The information is given as is, so a wrong figure in a roadmap or a plant layout cannot be sued on as a warranty. Receiving information gives the recipient no licence to use the discloser's intellectual property beyond the purpose, and nothing passes by implication. Either side may stop talking at any time, and nobody is obliged to go ahead with the pilot. All three protect the discloser and keep the NDA from growing into a commercial contract before anyone has priced the risk.

What it means for you

The no-licence sentence is your intellectual property shield during the pilot: Tungabhadra may run your software for the evaluation, but it acquires no right to keep using it, to adapt it or to have a developer rebuild it. Equally, you get no rights in their process know-how. The no-warranty sentence protects you if a sales projection or an integration estimate given during evaluation turns out wrong; warranties belong in the pilot agreement, where they are priced. The no obligation to transact sentence means a polite exit is always available. The carve-out matters: a definitive pilot agreement will override these disclaimers, so keep a clear line between what you say in the pilot scope and what you promise in the contract.

What is normal

All three disclaimers appear in nearly every NDA and are rarely contested. The variables are small: whether the no-warranty wording is subject to a definitive agreement (it should be), whether the licence clause is mutual, and whether a feedback clause is added, under which suggestions the recipient makes about the discloser's product may be used freely. Feedback clauses appear in perhaps 3 of 10 software NDAs and are fair if limited to voluntary suggestions. A right for either party to terminate discussions on notice is standard; a notice period for ending discussions is unusual and unnecessary. Some templates add that the NDA creates no agency, partnership or joint venture, which is harmless.

How to negotiate it

Ask for the no-licence clause to name intellectual property expressly, including trade secrets, so there is no argument that showing the software impliedly licensed it. Ask that no rights arise by implication or estoppel. If the counterparty adds a feedback clause, limit it to suggestions you volunteer about their product, exclude anything that reveals your Confidential Information, and make it mutual. Keep the right to terminate discussions free of any notice period or any duty to explain. If the customer wants an obligation to negotiate the pilot in good faith, agree only for a fixed period and only if it is mutual; exclusivity belongs in a paid pilot agreement.

No obligation to transact Trade secret IP ownership in an NDA ip assignment

10. Term and survival

This Agreement shall come into force on the Effective Date and shall continue for a period of 2 years, unless terminated earlier by either Party on 30 days' written notice to the other (the "Term"). Expiry or termination of this Agreement shall not affect any rights or obligations accrued before expiry or termination. The obligations of each Receiving Party under this Agreement in respect of Confidential Information disclosed during the Term shall survive the expiry or termination of this Agreement for a period of 3 years, provided that: (a) in respect of any Confidential Information that constitutes a trade secret under applicable law, including source code and process know-how identified as such by the Disclosing Party, such obligations shall survive for so long as the information remains a trade secret; and (b) obligations in respect of personal data shall survive for so long as the Receiving Party or its Representatives retain any such personal data. Clauses 8, 10, 11, 13, 14 and 15 shall survive expiry or termination.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

The agreement runs for 2 years from the effective date, so disclosures made in that window are protected, and either side can end it earlier on 30 days' notice. Ending it does not end the duty of secrecy: everything disclosed stays protected for 3 more years. Two categories last longer. Trade secrets, including source code the discloser has identified as such, stay protected as long as they remain secret, and personal data stays protected as long as anyone still holds it. The return, non-solicit, remedies and legal clauses survive too.

What it means for you

Term and survival are different clocks and founders confuse them. The term is the disclosure window: anything you hand over after it ends is unprotected unless you renew. Survival is how long the recipient must keep quiet after the term ends. For Saffron the trade secret carve-out is the important one: a 3-year survival on source code would let Tungabhadra's team use what they learned in 2031, so the clause keeps code protected while it remains secret. Mark your code and architecture documents as trade secrets when you share them, because the carve-out depends on the discloser identifying them. If the pilot turns into a contract, the pilot agreement's confidentiality clause takes over from here.

What is normal

A term of 2 to 3 years with survival of 3 to 5 years after expiry is the Indian market norm for commercial NDAs; 1-year terms are seen in vendor evaluations and 5-year survival in regulated sectors. A perpetual obligation on all information is unusual and often resisted by large companies, but a perpetual carve-out for trade secrets is now standard and accepted. Personal data surviving while held is the modern position since the DPDP Act. Early termination on 30 days' notice is normal and does not shorten survival. Templates that end all obligations on expiry with no survival exist and are a serious drafting error.

How to negotiate it

Ask for survival of at least 3 years from expiry, not from the date of each disclosure, which is harder to track. Ask for the trade secret carve-out to run while the information remains secret, and define trade secrets to include your source code, architecture and pricing models. Ask that personal data obligations survive while the data is held. If the counterparty wants a shorter survival of 1 or 2 years, accept it only for ordinary business information and never for code. Where the counterparty proposes a perpetual obligation on everything, offer the trade secret carve-out instead; it protects what matters and is easier to enforce.

Term and survival Term versus survival: the worked timeline Trade secret Perpetual confidentiality Effective date

11. Non-solicitation of employees

During the Term and for a period of 12 months after its expiry or termination, neither Party shall, directly or through any Representative, solicit for employment or engagement, or employ or engage, any employee of the other Party with whom it had material contact in connection with the Purpose, without the prior written consent of the other Party. This clause shall not prevent either Party from: (a) publishing general advertisements or using recruitment agencies not directed at the other Party's employees, or hiring any person who responds to them without having been solicited; or (b) soliciting or hiring any person whose employment with the other Party ended at least 6 months before the solicitation. The Parties acknowledge that this clause protects each Party's legitimate interest in the stability of the team engaged on the Purpose, does not restrain any individual from seeking employment, and is reasonable in scope and duration.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

For the life of the agreement and 12 months after it, neither company may poach the other's staff who worked on the pilot, nor hire them if they come knocking, without written consent. General job advertisements and recruiters not aimed at the other company are allowed, and so is hiring someone who left the other company more than 6 months ago. The last sentence records why the clause is reasonable: it protects the pilot team and restrains the companies, not the employees, which is what keeps it on the right side of Section 27.

What it means for you

This is the clause that protects your three engineers from being hired by a manufacturer with a far bigger salary budget after they spend six months inside its plants. It is usually enforceable in India because it restrains Tungabhadra, not your employees: an engineer can still apply for any job, and courts have generally not treated such a clause as a restraint of trade under Section 27 of the Indian Contract Act 1872. The material contact limit keeps it proportionate and is what a court looks for. It is mutual, so your sales team cannot recruit their plant managers either. The general advertising exception means you cannot complain when an employee answers a public job post; keep your team by other means too.

What is normal

Employee non-solicits of 12 to 18 months after expiry are standard in Indian NDAs where teams will work together; 24 months is seen in acquisition NDAs and anything longer is rare. Limiting the clause to employees with material contact appears in around half of templates and is best practice. The general advertising exception is near-universal; the 6-month gap for former employees appears in roughly a third. A no-hire clause (covering hiring as well as soliciting) is tighter than a pure non-solicit and appears in perhaps 4 of 10 pilot NDAs. Customer non-solicits are unusual in pilots and standard in acquisition NDAs.

How to negotiate it

Ask for the clause to be mutual; a customer that will not give you reciprocity is telling you something. Ask for 12 months after expiry, resist 24, and tie it to material contact so that it does not cover a receptionist. Ask for the no-hire wording if your team is small, since a pure non-solicit is hard to prove when an engineer resigns and reappears at the customer. Accept the general advertising exception. If the counterparty wants a non-compete in the same clause, refuse; it is void after the relationship under Section 27 and its presence can make a court read the whole clause narrowly.

Employee non-solicit in an NDA non solicit non compete restraint of trade

12. Residual knowledge

For the avoidance of doubt, no Receiving Party shall be entitled to use any Confidential Information retained in the unaided memory of its Representatives, and the Parties agree that no "residual knowledge", "residuals" or similar exception shall apply to this Agreement. Nothing in this clause shall restrict any Representative of a Receiving Party from using skills, knowledge and experience of a general nature acquired in the course of the Purpose, provided that such use does not involve the use or disclosure of any Confidential Information, including any Confidential Information that the Representative has memorised. Each Party shall instruct its Representatives accordingly and shall maintain reasonable records of the Confidential Information disclosed to it so that compliance with this clause can be verified. The exclusions in clause 3 shall be the only exclusions from Confidential Information under this Agreement.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

The clause says, in terms, that the recipient may not use what its people remember from the pilot: there is no residuals exception in this agreement. It draws a sensible line, though: engineers may still use general skills and experience, so long as doing so does not use or reveal confidential information, memorised or not. Each company must tell its people this and keep records of what was disclosed so the rule can be policed. The exclusions in clause 3 are the only exclusions, which stops a residuals idea creeping back in through another door.

What it means for you

A residuals clause is the single most dangerous paragraph a counterparty can slip into an NDA. In its usual form it lets the recipient use anything its employees retain in unaided memory without reference to documents. For a software vendor that is the architecture, the data model and the pricing logic, which a good engineer remembers without notes. This clause shuts that door: memory is no defence, and the records sentence gives you evidence to test any claim that only general skills were used. The general skills sentence keeps the clause enforceable and fair, because nobody can be stopped from getting better at their job. If a counterparty insists on residuals, treat it as a negotiation about which of your secrets it may keep, not as boilerplate.

What is normal

Residuals clauses appear in a minority of Indian commercial NDAs, perhaps 1 in 5, but in a majority of templates from large global technology companies, where they protect armies of engineers who see many vendors. An express exclusion of residuals, as here, appears in around a third of vendor-side templates and is unusual in customer templates. Where a residuals clause survives negotiation, the standard limits are: no intentional memorisation, no use of source code, pricing or personal data, no licence under the discloser's patents or copyrights, and a 30 to 90 day cut-off after the last access. Startups should expect to accept residuals only when the counterparty is a large platform partner and the information shared is correspondingly limited.

How to negotiate it

Ask for the express exclusion used here; a counterparty that has no intention of using your secrets loses nothing by agreeing. If they insist on residuals, make four demands: carve out source code, pricing, customer data and personal data entirely; exclude intentional memorisation and anything written down; state that no patent or copyright licence arises; and limit the residuals to people who had access for the purpose. If even that fails, reduce what you disclose: share demonstrations rather than code, and summaries rather than price books. Add the records sentence so that both sides can verify what was disclosed, which also makes any later claim provable.

Residual knowledge clause Exclusions from Confidential Information Trade secret

Remedies and legal

13. Remedies

Each Party acknowledges that its Confidential Information is valuable and that any breach or threatened breach of this Agreement may cause the Disclosing Party loss for which damages alone may not be an adequate remedy. Accordingly, without prejudice to any other right or remedy, the Disclosing Party shall be entitled to seek injunctive relief, specific performance and other equitable relief under the Specific Relief Act 1963, including interim and interlocutory relief, to restrain any actual or threatened breach, without the need to prove special damage or to furnish security beyond what the court requires. The Receiving Party shall indemnify the Disclosing Party against direct losses, including reasonable legal costs, arising from any breach of this Agreement by the Receiving Party or its Representatives, in accordance with Sections 73 and 74 of the Indian Contract Act 1872. Nothing in this Agreement shall operate as a penalty, and neither Party shall be liable to the other for indirect, consequential or punitive loss, provided that loss of the value of a trade secret shall be treated as direct loss.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

Both sides agree in advance that money may not fix a leak, which is the foundation for asking a court for an injunction to stop one. The discloser can go to court under the Specific Relief Act 1963 for an urgent order without proving a specific loss first. The recipient must make good direct losses and legal costs caused by a breach, measured under Sections 73 and 74 of the Indian Contract Act 1872. There is no penalty figure, indirect losses are excluded, and the lost value of a trade secret counts as a direct loss.

What it means for you

An injunction is the only remedy that matters in a live leak: by the time a damages claim is heard, the information is public. The acknowledgement that damages are inadequate helps you get interim relief under Order 39 of the Code of Civil Procedure 1908 within days. The indemnity for direct loss and legal costs is fair and mutual. The exclusion of indirect loss protects you too: if your engineer leaks Tungabhadra's production schedule, you pay their direct loss, not a lost contract with their customer. The trade secret sentence stops a court treating the loss of your code's value as too remote. There is deliberately no liquidated damages figure; Section 74 would cut it down to reasonable compensation anyway.

What is normal

An acknowledgement that damages are inadequate plus a right to seek an injunction appears in almost every NDA and Indian courts give it weight. A mutual indemnity for direct loss and reasonable legal costs is standard; an indemnity that runs only one way or covers indirect and consequential loss is customer-heavy drafting and should be resisted. Liquidated damages clauses appear in around 1 in 4 Indian NDAs, usually at ₹10 lakh to ₹1 crore; under Section 74 they are recoverable only as reasonable compensation, so they add little and signal distrust. Caps on liability are uncommon in NDAs, since a cap on a leak is hard to set; where they appear, 12 months of pilot fees or ₹50 lakh to ₹2 crore is typical.

How to negotiate it

Ask for the injunction wording and the acknowledgement that damages may be inadequate; no reasonable counterparty refuses it. Ask for any indemnity to be mutual and limited to direct loss and reasonable legal costs. Refuse a liquidated damages figure that runs only against you; if the counterparty insists on one, make it mutual and small, since Section 74 will reduce an inflated sum. Refuse an uncapped indemnity for consequential loss. If the counterparty wants a liability cap, make sure wilful misconduct and misuse of trade secrets sit outside it, otherwise the cap becomes a licence fee for stealing your code; for the personal data clause, where you are the processor, agree a separate higher cap rather than unlimited liability.

Injunction Liquidated damages and penalties Specific Relief Act 1963 Sections 73 and 74 of the Indian Contract Act 1872 Penalty versus liquidated damages Indemnity in an NDA

14. Governing law and jurisdiction

This Agreement and any dispute or claim arising out of or in connection with it, including non-contractual disputes or claims, shall be governed by and construed in accordance with the laws of India. The courts at Bengaluru, Karnataka shall have exclusive jurisdiction to settle any such dispute or claim, and each Party irrevocably submits to that jurisdiction and waives any objection on the ground of venue or inconvenient forum, provided that the Disclosing Party may seek interim or injunctive relief to protect its Confidential Information in any court of competent jurisdiction where the Receiving Party or its Representatives are located or where a breach has occurred or is threatened. Nothing in this Agreement shall limit any right or remedy available to either Party under applicable law, including under Section 72A of the Information Technology Act 2000 in respect of the disclosure of personal information in breach of a lawful contract.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

Indian law governs the agreement, and disputes go to the courts at Bengaluru, where Saffron is based. The one exception favours the discloser: if a leak is happening in Hosur or wherever a recipient's people are, the discloser can ask a local court for an urgent injunction instead of coming to Bengaluru first. The clause also keeps the statute in play: Section 72A of the Information Technology Act 2000 makes disclosure of personal information in breach of a lawful contract liable to a penalty of up to ₹25 lakh, and nothing in the NDA gives that up.

What it means for you

Courts rather than arbitration is a deliberate choice for a small NDA. An injunction is what you need and a court gives one in days under Order 39 of the Code of Civil Procedure 1908; an arbitral tribunal must first be constituted, which takes weeks unless you go to court under Section 9 anyway. Court fees in Karnataka for an injunction suit are modest compared with an arbitrator's fees. Bengaluru as the venue is a home advantage for Saffron, and Tungabhadra, about 40 kilometres away in Hosur, will usually accept it. The jurisdiction clause is exclusive, so a Tamil Nadu court should decline a suit filed there. Section 72A is a backstop: since 2023 it carries a penalty of up to ₹25 lakh, adjudged under the Information Technology Act, rather than imprisonment.

What is normal

Indian governing law with exclusive jurisdiction of the courts in one party's city is the norm for domestic NDAs; roughly 7 in 10 commercial NDAs choose courts and 3 in 10 choose arbitration, with arbitration more common when the amounts are large or a foreign party is involved. The discloser's right to seek interim relief anywhere appears in about half of well-drafted templates. Where arbitration is chosen, a sole arbitrator seated in the company's city with an institutional fallback is standard, as the acquisition NDA in the second tab shows. Mentioning Section 72A is unusual but useful where personal data is involved. Choosing a neutral third city is uncommon and adds cost for both.

How to negotiate it

Ask for your own city if you are the main discloser, and accept the counterparty's city if the information flow is mostly theirs. Ask for the carve-out letting you seek an injunction wherever the breach is happening. Prefer courts to arbitration for an NDA of this size unless the counterparty is foreign, in which case a seat in India with the arbitration seat clearly stated and Section 9 interim relief preserved is the compromise. Refuse a clause that requires 30 or 60 days of good-faith negotiation or mediation before court proceedings, since a leak cannot wait; if the counterparty insists, carve out injunctive relief from the waiting period.

Jurisdiction clause: courts or arbitration Section 72A of the Information Technology Act 2000 governing law interim relief arbitration seat

15. Miscellaneous

Neither Party may assign or transfer any of its rights or obligations under this Agreement without the prior written consent of the other Party. Notices under this Agreement shall be in writing and sent by email to the addresses set out below, with a copy by registered post or courier to the registered office, and shall be deemed received when the email is sent, provided no bounce message is received, or on the second business day after despatch by post. No amendment or waiver of this Agreement shall be effective unless in writing and signed by both Parties. This Agreement may be executed in counterparts and by electronic signature in accordance with the Information Technology Act 2000, each of which shall be an original and all of which together shall be one instrument. Saffron shall bear the stamp duty payable on this Agreement in Karnataka. This Agreement constitutes the entire agreement between the Parties with respect to the confidentiality of information exchanged for the Purpose and supersedes all prior confidentiality undertakings in that respect; it does not supersede any other agreement between the Parties. If any provision is held invalid or unenforceable, it shall be read down or severed to the minimum extent necessary and the remainder shall continue in force.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

The housekeeping clause. Neither side can hand the agreement to someone else without consent. Notices go by email with a hard copy to the registered office, and the clause says when they count as received. Changes need both signatures. The agreement can be signed in counterparts and electronically under the Information Technology Act 2000. Saffron pays the Karnataka stamp duty. The agreement is the whole deal on confidentiality for this pilot, but only on confidentiality, and if a court strikes one provision the rest survives.

What it means for you

Three items here save real money or trouble. The no-assignment rule matters if Tungabhadra is acquired: your secrets should not pass to the buyer without your consent. The email notice rule lets you serve a breach notice or a return request in minutes, with the hard copy as proof. The entire agreement wording is deliberately narrow: it wipes out earlier email promises about confidentiality but leaves any purchase order or pilot quote untouched, which is the right scope for an NDA. Stamp duty on an agreement in Karnataka is a few hundred rupees; paying it through e-stamping before signing avoids the duty-plus-penalty route under Section 34 of the Karnataka Stamp Act 1957, the State's version of Section 35 of the Indian Stamp Act 1899, if you ever need the document in court.

What is normal

Assignment only with consent is standard; a carve-out allowing assignment to an affiliate or a successor on a merger appears in roughly half of large-company templates and is acceptable if the assignee is bound. Email notice with a deemed receipt rule is now the norm; some templates still require registered post alone. Counterparts and electronic signature clauses appear in most templates since 2020. Stamp duty is paid by the party in whose State the document is first executed, or as agreed; a few hundred rupees in Karnataka, Maharashtra and Tamil Nadu. An entire agreement clause limited to confidentiality is the correct scope; a general one is a drafting error in an NDA signed alongside other contracts. Severability is universal.

How to negotiate it

Ask for the entire agreement clause to be limited to confidentiality so that it does not wipe out a quote or a purchase order. Ask for email notice with deemed receipt, since registered post to a factory can take a week. If the counterparty wants a right to assign to affiliates, agree only if the affiliate signs an undertaking and the original party stays liable. Agree to pay the stamp duty if you want control of the e-stamping and the signing timetable; the amount is nominal. Make sure the electronic signature clause covers Aadhaar e-sign and DSC as well as a commercial signing platform, so that nobody argues later about the method used.

Counterparts and electronic signature Stamp duty on an NDA entire agreement severability e signature

16. Signatures and authority

Each Party represents and warrants that it has full corporate power and authority to enter into and perform this Agreement, that the individual signing on its behalf has been duly authorised to do so by a resolution of its board of directors or by a valid delegation of authority, and that this Agreement constitutes legal, valid and binding obligations enforceable against it. Each Party shall, on request, provide the other with a certified copy of the board resolution or power of attorney under which its signatory acts. This Agreement shall be effective from the date on which it has been signed by both Parties (the "Effective Date"), and where the Parties sign on different dates, the Effective Date shall be the date of the last signature, notwithstanding the date appearing at the head of this Agreement. In witness whereof the Parties have executed this Agreement through their authorised signatories: for Saffron Labs Private Limited, Ananya Rao, Chief Executive Officer; for Tungabhadra Forge Industries Limited, its authorised signatory acting under the board resolution identified in the signature block.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

Each company confirms that it has the power to sign, that the person signing has been authorised by its board or by a proper delegation, and that the agreement binds it. Either side can ask for a copy of the board resolution or power of attorney. The agreement starts when the second signature lands: if the two companies sign on different days, the later date is the effective date whatever the heading says. Ananya Rao signs for Saffron as Chief Executive Officer, and Tungabhadra's signatory names the board resolution they act under.

What it means for you

Authority to sign is where NDAs with large companies quietly fail. A plant manager or a procurement executive at an unlisted public company often has no authority to bind it, and when you need an injunction the company's first defence is that the signatory was not authorised. Ask for the board resolution or the delegation of authority before signing, not after. On your side, Ananya Rao signs under a standing board resolution authorising the directors to sign NDAs and commercial contracts up to a limit; make sure one exists in your minute book. The effective date rule matters for your register: the 2-year term runs from the last signature, and the 3-year survival from the end of that term.

What is normal

An authority warranty appears in most NDAs; the right to request the board resolution appears in around a third and is worth adding when the counterparty is a public company or a large group. For a private company a director signs under a general board authorisation; for a listed or large public company a company secretary or an officer under a power of attorney is normal. The last-signature rule for the effective date is standard; dating the agreement at the head and then signing later is common and causes confusion unless this clause fixes it. Witnesses are not required for a company's execution under Indian law but many templates still provide two witness lines. Notarisation is not required.

How to negotiate it

Ask the counterparty to name the resolution or power of attorney under which its signatory acts, and ask for a copy if the counterparty is a public company or a group. Ask for the last-signature rule so that the effective date is certain. Make sure your own signatory is covered by a board resolution in your minute book; a standing authorisation for the CEO to sign NDAs and contracts up to a stated value is enough. If the counterparty proposes an effective date earlier than signing to cover disclosures already made, agree, since it extends protection to the pre-signing meetings, but check that the survival period is still measured from expiry.

Authority to sign and the effective date Effective date Counterparts and electronic signature

Example only

Confidentiality and Standstill Agreement between Saffron Labs Private Limited (Discloser) and Kaveri Industrial Software Limited (Recipient)

In January 2029, three years after the Tungabhadra pilot, Saffron Labs opened its books to a potential buyer. Kaveri Industrial Software Limited, Mumbai, listed on the National Stock Exchange, wanted to evaluate an acquisition of the whole company. Almost all the information flows one way, from Saffron to Kaveri, so the agreement is one-way, with a small reverse duty about the existence of the talks. Because the buyer is listed and sells into the same manufacturers, the document adds a standstill, an 18-month non-solicit of employees and customers, a clean team for pricing and customer contracts, and an acknowledgement about insider-trading rules. The 14 clauses below are the full document. The share purchase agreement that followed on 15 March 2029 is on the Share Purchase Agreement Explainer.

Discloser: Saffron Labs Private Limited, Bengaluru (CIN U72900KA2023PTC171234), with its shareholders Ananya Rao, Vikram Menon, Marigold Capital Partners Fund II, Ritika Iyer and Arjun Nair
Recipient: Kaveri Industrial Software Limited, Mumbai, Maharashtra, a public company listed on the National Stock Exchange of India
Purpose: Evaluation, negotiation and, if agreed, implementation of a possible acquisition of the entire share capital of the Company (the Transaction)
Type: One-way, Saffron as Discloser, with a limited reverse obligation on Saffron about the existence and status of the discussions
Term: 2 years from 10 January 2029; obligations survive 3 years after expiry; trade secrets while secret; superseded by the SPA confidentiality clause at signing
Clean team: Customer identities and contract terms, pricing and employee compensation only to a named clean team of advisers and non-commercial staff until signing
Standstill and non-solicit: 18 months: no contact with shareholders, customers, suppliers or employees except through the founders; no solicitation of employees or customers
Insider trading: Kaveri acknowledges that the information may be unpublished price sensitive information for its own securities under the SEBI (Prohibition of Insider Trading) Regulations 2015
Disputes: Indian law; sole arbitrator seated in Bengaluru under the MCIA Rules; Section 9 interim relief from the courts at Bengaluru

Framework

1. Parties, Purpose and the Transaction

This Confidentiality and Standstill Agreement (the "Agreement") is made on 10 January 2029 between Saffron Labs Private Limited, a company incorporated under the Companies Act 2013 with CIN U72900KA2023PTC171234 and its registered office at Bengaluru, Karnataka (the "Company" or the "Discloser"), and Kaveri Industrial Software Limited, a public company incorporated under the Companies Act 2013 with its registered office at Mumbai, Maharashtra, whose equity shares are listed on the National Stock Exchange of India Limited (the "Recipient"). The Recipient has expressed interest in evaluating, negotiating and, if agreed, implementing a possible acquisition of the entire issued share capital of the Company from its shareholders (the "Transaction"), and the Company is willing to make Confidential Information available to the Recipient solely for that purpose (the "Purpose"). The Company enters into this Agreement for itself and as trustee for the benefit of its shareholders, each of whom may enforce the provisions of this Agreement intended to protect them. Save for Clause 10 and the limited obligations of the Company in Clause 2, the obligations in this Agreement bind the Recipient only.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

Saffron is the discloser and Kaveri, a listed Mumbai software company, is the recipient. The purpose is tightly drawn: evaluating and, if agreed, completing a purchase of all of Saffron's shares. The clause records that Saffron signs for itself and as trustee for its shareholders, which gives the founders, Marigold and the angels an arguable route to enforce the protections meant for them even though they do not sign. Apart from the no-obligation clause and a small duty on Saffron not to disclose that talks are happening, every obligation runs against Kaveri. That is what makes it a one-way NDA.

What it means for you

A buyer's NDA is one-way because the buyer learns everything and you learn almost nothing about it. Do not accept a mutual draft here: mutuality would bind you and your shareholders to secrecy about Kaveri's offer in ways that could hamper a competing process. Enforcement by the shareholders matters because the standstill and the non-solicit protect them and their team, not just the company. Naming the Transaction as a purchase of all shares keeps Kaveri from using the information to pitch a partnership or a customer deal instead. Since the purpose includes implementation, the agreement carries through to signing and is then replaced by the share purchase agreement's own confidentiality clause.

What is normal

Acquisition NDAs are one-way in roughly 9 of 10 cases where a single buyer looks at a private target; mutual drafts appear when the deal is a share swap or a merger of equals. Express third-party enforcement rights for shareholders appear in around half of Indian acquisition NDAs; without them the shareholders rely on the company to sue. Defining the Transaction as an acquisition of the entire share capital, or alternatively as a controlling interest, is standard. Signing in the name of the company rather than each shareholder is normal and avoids a 5-party document; some sellers add Marigold as a party because fund documents require it.

How to negotiate it

Ask for a one-way structure with the reverse duty limited to the fact of discussions. Ask for the company to sign for itself and as trustee for its shareholders. Because Indian law keeps privity, the trust route is untested for standstills and indemnities, and a shareholder who has not signed may not be able to start the arbitration, so have Marigold and the founders sign a short deed of adherence for the standstill, the indemnity and the dispute clause; the company can enforce the non-solicit itself. Ask for the Transaction to be defined by reference to all or a controlling part of the share capital, so that a minority stake or a commercial partnership is outside the purpose. Check that the recipient entity is the listed company itself and not an unlisted subsidiary with no assets, since an injunction and a damages claim need a solvent defendant. If Marigold's fund documents require it, add Marigold as a party rather than relying on third-party enforcement.

One-way NDA Non-disclosure agreement (NDA)Purpose limitation due diligence

2. Confidential Information

"Confidential Information" means all information relating to the Company, its business, customers, suppliers, employees, technology, finances, prospects and shareholders that is made available to the Recipient or its Representatives by or on behalf of the Company or its shareholders, before or after the date of this Agreement, in any form, whether or not marked confidential, including: (a) all documents and data made available in any physical or virtual data room; (b) management presentations, site visits and responses to questions; (c) the terms of any term sheet, offer or draft agreement relating to the Transaction; and (d) all notes, analyses, valuations, models and other materials prepared by or for the Recipient that contain, reflect or are derived from such information. The fact that discussions are taking place, their status and the identity of the parties shall be Confidential Information of both Parties, and the Company shall not disclose them except to its shareholders, Representatives and other bidders, in each case bound by confidentiality, or as required by law. The exclusions in Clause 3 of the Mutual Non-Disclosure Agreement form, as set out in Schedule 1, shall apply, with the burden of proof on the Recipient.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

Everything Kaveri learns about Saffron from any source during the process is confidential, marked or not: the data room, management meetings, plant visits, answers to questions, and the terms of any offer or draft agreement. Kaveri's own valuation models and board papers built on the information are caught too. The fact and status of the talks are confidential for both sides, with Saffron free to tell its shareholders, advisers and other bidders. The usual four exclusions apply through a schedule, with the burden of proof on Kaveri.

What it means for you

The breadth is deliberate. In diligence you cannot mark 4,000 documents one by one, so the definition catches everything by source rather than by label. Catching Kaveri's derived models matters because its board deck will contain your customer concentration and your margins. The reverse duty on you is narrow: you cannot announce that Kaveri is looking at you, but you can run a competitive process and tell other bidders that there is interest, which is how you keep leverage. Protecting the offer terms stops Kaveri telling a rival bidder what it offered. The schedule keeps the exclusions identical to the pilot NDA so your legal team is not maintaining two standards.

What is normal

Acquisition NDAs define Confidential Information by reference to everything disclosed in the process, including data room contents, management presentations and the recipient's derivative materials, in effectively every case. The fact and status of discussions being confidential for both parties is standard and is the usual extent of the reverse obligation on the seller; around a third of drafts make the seller's duty subject to the right to run a process with other bidders expressly, as here. The standard four exclusions apply; a listed buyer sometimes asks for an exclusion for information its own analysts have independently compiled about the market, which is acceptable if limited to public sources.

How to negotiate it

Ask for the definition to cover information from any source in the process, including oral answers and site visits, and the recipient's derived materials. Ask that the offer terms are confidential so that your process is not leaked to other bidders. Limit your own reverse duty to the fact and status of discussions and reserve the right to run a process with other bidders and to inform your shareholders. If the buyer wants the exclusions widened, accept only public-source market research and refuse any residuals-style wording. Keep the burden of proof on the recipient with contemporaneous written records.

Confidential Information Data room and click-through terms Exclusions from Confidential Information data room

3. Recipient obligations

The Recipient shall, and shall procure that its Representatives shall: (a) keep the Confidential Information strictly confidential and use it solely for the Purpose and not for any other purpose, including to compete with the Company, to solicit its customers, suppliers or employees, or to obtain any commercial advantage over the Company or its shareholders; (b) protect the Confidential Information with at least the degree of care it applies to its own most sensitive information and in no event less than a reasonable degree of care; (c) not copy, extract, download or reproduce Confidential Information except to the extent strictly necessary for the Purpose and in accordance with the rules of any data room; (d) not reverse engineer or analyse any software, source code or data of the Company made available for the Purpose except as expressly permitted in writing; (e) keep a record of the Representatives to whom Confidential Information has been disclosed; and (f) notify the Company promptly on becoming aware of any actual or suspected unauthorised use or disclosure and provide all reasonable assistance to limit its effect.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

Kaveri must keep everything secret and use it only to evaluate and complete the purchase. It may not use what it learns to compete with Saffron, approach its customers, poach its people or gain any commercial edge. It must guard the information at least as well as its own most sensitive material, copy or download only what the purpose strictly needs and the data room rules allow, leave the software and code alone except with written permission, keep a record of who has seen the information, and report any leak promptly and help contain it.

What it means for you

The most important words are not to compete with the Company or to obtain any commercial advantage. Kaveri sells software to the same manufacturers you do. If the deal dies, this sentence is the basis for an injunction when its sales team turns up at your customers with a pricing sheet that looks like yours. The most sensitive information standard is higher than the usual same care test and is appropriate for a listed buyer that handles price-sensitive information every day. The download limit ties the NDA to the data room rules so that a bulk export is a breach of contract, not just a technical violation. The record of Representatives lets you trace a leak.

What is normal

A no-competing-use sentence appears in most acquisition NDAs where the buyer is a strategic competitor and in around half where it is a financial buyer. The most sensitive information standard appears in about a third of drafts; the same care plus reasonable care floor is the common alternative. Download limits referencing data room rules are standard where a virtual data room is used. A duty to keep a record of Representatives and to produce it on request appears in roughly 6 of 10 acquisition NDAs. Notice of a leak promptly or within 48 to 72 hours is standard. Audit rights over the buyer's systems are rare and resisted.

How to negotiate it

Ask for the no-competing-use and no-commercial-advantage words; a buyer that balks at them is telling you what it plans to do if the deal fails. Ask for the higher standard of care from a listed buyer, which already runs an insider-trading compliance programme. Ask for the download and copying limits to follow the data room rules and for the record of Representatives. If the buyer resists the no reverse engineering limb because its technical diligence needs code review, agree a written protocol: code review on screen in a controlled environment, no copies, and a named reviewer list. Keep the notification duty, and ask for reasonable assistance in containing a leak.

Standard of care Purpose limitation Reverse engineering Notice of breach

People and information flow

4. Representatives and financiers

The Recipient may disclose Confidential Information only to those of its directors, officers and employees, and those of its legal, financial, accounting and technical advisers, actual or prospective lenders and co-investors, and their respective advisers (together its "Representatives") who need to know it for the Purpose, provided that: (a) each Representative is informed of the confidential nature of the information and is bound by written obligations of confidentiality no less protective than this Agreement, or by professional duties of confidence; (b) no disclosure is made to any prospective lender, co-investor or other financing source without the Company's prior written consent, which shall identify the financing source by name; (c) the Recipient provides the Company, on request, with a list of its advisers and financing sources who have received Confidential Information; and (d) the Recipient shall be liable for any act or omission of any Representative that would be a breach of this Agreement if committed by the Recipient, as if it were its own. The Recipient shall not disclose Confidential Information to any portfolio company, affiliate or business unit that competes with the Company except through the Clean Team under Clause 5.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

Kaveri may share the information with its own directors, staff and advisers, and with banks or co-investors funding the deal, but only those who need it, only if they are bound in writing or by professional duty, and, for any financier, only after Saffron agrees in writing to that named financier. Saffron can ask for the list of advisers and funders. Kaveri answers for every one of them as if it had acted itself. Any competing group company or business unit is kept out except through the clean team.

What it means for you

Financiers are where acquisition NDAs leak. A buyer that needs debt or a co-investor will show your numbers to two or three banks and a private equity fund, each of which has a dozen people on the deal. The consent right lets you say no to a funder that is also talking to your competitor, and the named-source rule means you know who is in the room. The Representatives liability sentence means you sue Kaveri, not a bank. The competing business unit sentence matters because Kaveri sells to your market: its sales division must not see your customer contracts, which is the job of the clean team in the next clause.

What is normal

Advisers and employees on a need-to-know basis are standard. Consent before disclosure to financing sources appears in around 7 of 10 seller-friendly acquisition NDAs; buyer templates often allow disclosure to lenders without consent, which sellers should resist. A list of Representatives on request is standard. Recipient liability for Representatives is standard; a weaker procure compliance formulation appears in buyer drafts and should be resisted. Barring competing affiliates and business units except through a clean team is common where the buyer is a strategic competitor and unusual where it is a financial investor. Some sellers also limit the number of advisers to 2 or 3 firms per discipline.

How to negotiate it

Ask for prior written consent, naming each financing source, before any lender or co-investor sees the information, and for the right to refuse a financier that is talking to a competitor. Ask for the list-on-request right. Ask for the recipient to be liable for its Representatives as if for itself. Ask for competing affiliates and business units to be excluded except through the clean team. If the buyer wants to bring in a co-investor, require the co-investor to sign a joinder to this Agreement rather than relying on the buyer's liability. Accept that lawyers, auditors and bankers bound by professional duties need no separate undertaking.

Representatives Need to know Affiliates in an NDA Clean team

5. Clean team

"Competitively Sensitive Information" means Confidential Information consisting of the identities of the Company's customers and the terms of their contracts, the Company's pricing, discounts and pipeline, the compensation and terms of individual employees, and such other information as the Company designates in writing as competitively sensitive. Competitively Sensitive Information shall be disclosed only to a clean team consisting of the Recipient's external legal, financial and accounting advisers and such of its employees who are not engaged in sales, pricing, marketing or product decisions in any business competing with the Company, each named in a clean team list approved in writing by the Company (the "Clean Team"). Clean Team members shall not disclose Competitively Sensitive Information to any other Representative of the Recipient except in aggregated, anonymised or redacted form that does not identify any customer, contract term, price or individual, as approved by the Company's counsel, until the signing of a definitive agreement for the Transaction, and thereafter only to the extent permitted by applicable competition law until completion. Each Clean Team member shall sign an undertaking in the form in Schedule 2.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

A ring fence inside a ring fence. The most sensitive commercial information, who Saffron's customers are and what they pay, its pricing and pipeline, and what individual employees earn, goes only to a small named group: Kaveri's outside advisers and staff who do not make sales, pricing, marketing or product decisions in a competing business. The clean team may pass summaries to Kaveri's deal team only in aggregated or redacted form approved by Saffron's counsel, until the acquisition agreement is signed, and after that only as competition law allows until completion.

What it means for you

Kaveri competes with you for the same manufacturers. If its head of sales reads your customer contracts and your discount matrix and then the deal dies, you have handed a competitor your playbook, and no injunction can make a person forget. The clean team means the people who decide Kaveri's pricing never see yours; they get a one-page summary saying average contract value and churn. The approval right over the list and over the summaries is your control. The clause also protects both companies under the Competition Act 2002: exchanging pricing between competitors before a deal completes can be treated as coordination, and the clean team is the accepted way to manage that. Expect Kaveri to argue it cannot value the business without customer detail; the answer is anonymised customer A, B, C data with revenue bands.

What is normal

Clean team arrangements appear in most acquisition NDAs where the buyer is a direct competitor and in few where it is a financial buyer. The usual scope is customer identities and contract terms, pricing and discounts, pipeline, and individual employee compensation; some add supplier terms and product roadmaps. The clean team is usually external advisers plus 2 to 5 non-commercial employees such as corporate development and finance staff. Aggregated reporting to the deal team, approved by the seller's counsel, is standard. Release of the information to the full deal team at signing is the common compromise; some sellers hold it to completion. Separate clean team undertakings signed by each member are standard.

How to negotiate it

Ask for a clean team whenever the buyer competes with you or owns a business that does. Ask for approval of the named list and for the right to add categories of Competitively Sensitive Information in writing as diligence progresses. Ask that only aggregated or redacted summaries approved by your counsel reach the deal team before signing. Ask for individual undertakings from each clean team member. If the buyer insists that its commercial team must see customer data to price the deal, offer anonymised data with revenue bands and contract lengths, and agree to release identities only on signing. Add a sentence that the clean team is also intended to comply with the Competition Act 2002 so that both sides have cover.

Clean team Need to know signing cci small target

6. Data room terms and personal data

The Company may make Confidential Information available through a virtual data room operated by a provider appointed by the Company. The Recipient shall, and shall procure that its Representatives shall, comply with the access rules of the data room, including restrictions on printing, downloading, saving and screen capture, and shall not attempt to circumvent any technical control. Any click-through or online terms presented by the data room provider shall govern the use of the platform only, and in the event of any inconsistency between those terms and this Agreement, this Agreement shall prevail; no such terms shall reduce the Recipient's obligations or the Company's rights under this Agreement. Personal data of the Company's employees, customers and other individuals made available for the Purpose shall be processed by the Recipient and its Representatives solely for the Purpose, in compliance with the Digital Personal Data Protection Act 2023, with reasonable security safeguards, and shall be made available in redacted or pseudonymised form wherever the Purpose can be served without identifying individuals. The Recipient shall not transfer such personal data outside India except as permitted by law and shall erase it in accordance with Clause 11.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

Saffron will run the process through a virtual data room, and Kaveri and its advisers must follow the room's rules on printing, downloading and screenshots and must not try to get around the technical locks. The data room provider's own click-through terms govern only the use of the platform; if they conflict with this agreement, this agreement wins, and they cannot water it down. Personal data in the room, such as employee files and customer contact details, is to be used only for the deal, kept secure, provided in redacted or pseudonymised form wherever possible, kept in India unless the law allows otherwise, and erased under the return clause.

What it means for you

A data room click-through is drafted by the provider to protect the provider, not you; this clause stops the buyer arguing that the click-through, as the later document, replaced the NDA. The circumvention sentence makes a screenshot a breach of contract, which matters because every data room's technical controls can be defeated by a phone camera. The personal data limb reflects the DPDP Act: during diligence you are the data fiduciary for your employees' records, so you need a lawful basis to show them to a buyer, and the practical answer is redaction. Give the buyer employee grades, cost and tenure, not names and bank details, until signing. The India-only transfer sentence matters if Kaveri's advisers are offshore.

What is normal

A data room clause stating that the NDA prevails over click-through terms appears in most acquisition NDAs drafted since virtual data rooms became standard. Compliance with data room access rules and no circumvention are standard. A personal data limb has become standard since the DPDP Act and its Rules of 13 November 2025; redaction or pseudonymisation of employee data before signing is market practice, with full personnel files released to HR diligence only after signing or under a clean team. Localisation of personal data within India is a cautious drafting choice while the DPDP cross-border rules settle; most drafts say as permitted by law.

How to negotiate it

Ask for the sentence that this Agreement prevails over click-through terms, and for the no-circumvention duty. Ask for employee personal data to be provided redacted or pseudonymised until signing, which protects you under the DPDP Act and costs the buyer little. Ask for the India-only transfer limit, or agree a list of countries once the DPDP Rules on cross-border transfer are settled. If the buyer wants downloads for its financial model, allow downloads of specific folders such as management accounts and refuse downloads of customer contracts and source code. Make the data room index part of the disclosure record so that what was disclosed is provable later.

Data room and click-through terms Personal data under the DPDP Act in an NDA Data fiduciary Cross-border transfer under the DPDP Act data room

Conduct

7. Standstill

For a period of 18 months from the date of this Agreement, the Recipient shall not, and shall procure that its affiliates and Representatives acting on its behalf shall not, without the prior written consent of the Company acting through its Board: (a) approach, contact or communicate with any shareholder, customer, supplier, lender, employee or consultant of the Company in connection with the Company, the Transaction or any alternative transaction, except through Ananya Rao and Vikram Menon or such other persons as the Company nominates in writing; (b) make, or announce an intention to make, any offer or proposal to acquire any shares, securities, business or material assets of the Company otherwise than to the Company and its shareholders through the process conducted by the Company; (c) enter into any agreement, arrangement or understanding with any shareholder of the Company concerning the voting or transfer of their shares; (d) seek to influence or control the Board or the management of the Company, or to procure the appointment or removal of any director; or (e) assist, finance or encourage any other person to do any of the foregoing. This Clause shall cease to apply if the Company signs a definitive agreement for the sale of a controlling interest in the Company to a third party.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

For 18 months Kaveri must not go around the founders. It may not approach Saffron's shareholders, customers, suppliers, lenders or staff about the company or any deal except through Ananya Rao and Vikram Menon or whoever the company nominates. It may not make or announce an offer except to the company and its shareholders through Saffron's own process, may not do side deals with any shareholder about voting or selling their shares, may not try to influence the board, and may not help anyone else do these things. The standstill falls away if Saffron agrees to sell control to somebody else.

What it means for you

Without a standstill a buyer that has seen your cap table can call Marigold directly and offer to buy its stake, or email your two angels, or quietly tell your biggest customer that it is about to own you. Each of those splits your shareholders, unsettles customers and costs you leverage. The standstill forces every conversation through the founders and keeps a single process. For a listed buyer the clause also matters to the buyer: it stops its own staff making an approach that could be a leak of unpublished price sensitive information. Because Saffron is unlisted, the SEBI takeover regulations do not apply and no public offer is possible, so the clause is pure contract. The fall-away keeps Kaveri free to bid again if you sell to someone else.

What is normal

Standstills of 12 to 18 months appear in most acquisition NDAs for private targets drafted by the seller; 24 months is seen where the target has a large shareholder base. Limiting contact to named founders or a named deal team is standard. A prohibition on offers outside the process and on agreements with shareholders about voting or transfer is standard; a bar on seeking to influence the board is common where the buyer already holds shares and unusual where it does not, but costs nothing. Fall-away on a signed sale to a third party appears in roughly half of drafts; buyers often ask for fall-away on any public announcement of a competing deal. A customer and supplier contact bar is less common than a shareholder bar and matters most when the buyer is a competitor.

How to negotiate it

Ask for 18 months, accept 12. Ask for contact to be routed through named founders, with the right to add or substitute names in writing. Ask for the bar on side agreements with shareholders, which protects your angels and Marigold from being picked off. Ask for customers, suppliers and lenders to be covered, since a competitor-buyer can do real damage with one call to your largest customer. Agree a fall-away on a signed sale of control to a third party, and resist a fall-away on a mere announcement or on the end of discussions. If the buyer wants the right to make a confidential proposal directly to the board, agree, since that is within the process anyway.

Standstill No obligation to transact exclusivity board

8. Non-solicitation of employees and customers

For a period of 18 months from the date of this Agreement, the Recipient shall not, and shall procure that its affiliates shall not, directly or indirectly: (a) solicit for employment or engagement, or employ or engage, any person who is listed in Schedule 3 as a key employee of the Company, or any other employee of the Company with whom the Recipient or its Representatives had contact or of whom they became aware in connection with the Purpose; or (b) solicit, induce or encourage any customer, distributor or supplier of the Company of which the Recipient became aware through the Confidential Information to terminate, reduce or adversely vary its relationship with the Company, or use Confidential Information to solicit any such customer. Paragraph (a) shall not prevent the Recipient from publishing general advertisements or using recruitment agencies not directed at the Company's employees, or from hiring any person who responds to them without having been solicited, or any person whose employment with the Company ended at least 6 months before the solicitation. Paragraph (b) shall not prevent the Recipient from carrying on its existing business with any customer or supplier in the ordinary course without use of Confidential Information. The Parties acknowledge that this Clause protects the Company's legitimate interest in its workforce and customer relationships, does not restrain the trade of any individual and is reasonable in duration and scope.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

For 18 months Kaveri may not hire or try to hire the key employees named in a schedule, or any other Saffron employee it met or learned about during diligence, and may not use what it learned to lure Saffron's customers, distributors or suppliers away. The usual exceptions apply: general job advertisements, people who left Saffron more than 6 months earlier, and Kaveri's existing business with shared customers in the ordinary course without using the confidential information. The final sentence records that the clause restrains Kaveri, not any individual, and is reasonable, which is what keeps it enforceable under Section 27.

What it means for you

Diligence shows a competitor exactly who your ten best engineers are and what they earn. If the deal fails, this clause is what stops the recruitment calls the following week. The named schedule makes enforcement easy: no argument about whether Kaveri had contact with a given person. The customer limb matters because Kaveri will see your customer list and contract renewal dates; it may keep selling to customers it already has, but it may not use your contract data to time an approach. The clause is usually enforceable in India because it binds Kaveri, not your employees: any engineer remains free to apply for any job. Keep the schedule accurate and update it if the process runs for months.

What is normal

Non-solicits of 12 to 24 months are standard in acquisition NDAs, with 18 months the most common; the employee limb appears in nearly every seller draft and the customer limb in around two thirds where the buyer is a competitor. A named schedule of key employees appears in roughly half of drafts; the alternative is a limit to employees the buyer met or learned of in diligence, and this clause uses both. No-hire wording, as here, is common in acquisition NDAs and more acceptable than in commercial NDAs because the buyer has seen the whole organisation chart. The ordinary course carve-out for existing customers is standard where the buyer already serves the same market. General advertising and 6-month exceptions are standard.

How to negotiate it

Ask for 18 months and for both an employee and a customer limb when the buyer is a competitor. Ask for a schedule of key employees plus the general contact test. Ask for no-hire, not just no-solicit, for the scheduled names; a buyer that intends to behave loses nothing. Accept the general advertising, 6-month gap and ordinary course exceptions. If the buyer pushes back on the customer limb, narrow it to use of Confidential Information to solicit rather than any solicitation, which is what this clause does. Refuse any attempt to add a mutual limb binding you not to hire the buyer's deal team, which is pointless and creates a trap for your HR team.

Employee non-solicit in an NDA non solicit restraint of trade retention bonus

9. Insider trading and the Recipient's listed status

The Recipient acknowledges that, as a company whose securities are listed on a recognised stock exchange, information concerning the Transaction and the Confidential Information may constitute unpublished price sensitive information in relation to the Recipient's own securities within the meaning of the SEBI (Prohibition of Insider Trading) Regulations 2015 (the "PIT Regulations"). The Recipient shall: (a) communicate such information only for legitimate purposes, on a need-to-know basis and in compliance with its code of conduct and the PIT Regulations; (b) maintain the structured digital database required under Regulation 3(5) of the PIT Regulations recording the persons with whom such information is shared; (c) ensure that persons in possession of such information do not trade in the Recipient's securities while it remains unpublished, including by closing its trading window where required; and (d) make any disclosure of the Transaction under the SEBI (Listing Obligations and Disclosure Requirements) Regulations 2015 only in accordance with the compelled disclosure provisions of this Agreement, after consulting the Company on content and timing. The Company gives no undertaking as to the Recipient's compliance with the PIT Regulations. The Parties acknowledge that, while the Transaction remains unpublished, any person who knows of it, including the Company's shareholders and Representatives, may not trade in the Recipient's securities or communicate such information except as the PIT Regulations permit. This Clause is notice under Regulation 3(2B) of the PIT Regulations to the Company and, through it, to its shareholders and Representatives who receive such information for the Purpose, that they are to be treated as insiders and must keep it confidential. Nothing in this Clause restricts the Recipient from complying with any disclosure obligation under applicable securities law.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

Because Kaveri is listed, the fact that it is negotiating to buy Saffron, and what it learns about Saffron, may be price-sensitive information about Kaveri's own shares. The clause has Kaveri acknowledge that and promise to handle the information under the SEBI (Prohibition of Insider Trading) Regulations 2015: share it only for legitimate purposes and on a need-to-know basis, log every recipient in its structured digital database, stop its insiders trading while the information is unpublished, and make any stock exchange disclosure only through the compelled disclosure route after consulting Saffron. Saffron promises nothing about Kaveri's compliance, but the clause records that anyone on Saffron's side who knows of the talks may not trade in Kaveri shares or pass the information on, and doubles as Kaveri's formal notice to them that they are insiders.

What it means for you

Your information has a second legal life once a listed company holds it. If a Kaveri executive or an adviser trades Kaveri shares knowing a material acquisition is coming, that is insider trading, and the first question SEBI asks is who knew and when. The structured digital database is Kaveri's record of exactly that, and it means every person who sees your data room is logged by name and PAN. That discipline helps you. The insider trading rules also explain why a listed buyer insists on controlling any announcement: a leak can force an early disclosure to the exchanges and move its share price. Kaveri's compliance is not your problem, but one rule binds your side too: anyone who knows of the talks is an insider for Kaveri's shares, so you, Marigold and the angels must not trade in them or tip anyone until the deal is announced or abandoned. Kaveri must also give your side formal notice that you are insiders under Regulation 3(2B) and log your names in its structured digital database; this clause doubles as that notice.

What is normal

An insider-trading acknowledgement appears in most NDAs where a listed Indian company is the recipient, usually drafted by the listed company's own compliance team and then adjusted by the seller. Reference to Regulation 3(5) and the structured digital database is standard since the 2018 amendments and the April 2019 implementation. Trading window and need-to-know commitments are standard. A statement that the unlisted seller gives no undertaking about the buyer's compliance appears in about half of drafts and is worth adding. Where the target itself is listed, the clause is much longer and becomes an insider-trading agreement in its own right with wall-crossing procedures; for a private target like Saffron the version here is the norm.

How to negotiate it

Ask for the acknowledgement that the information may be price sensitive for the buyer's securities, which the buyer's own compliance team will usually volunteer. Ask for the structured digital database commitment and for the exchange disclosure to run through the compelled disclosure clause with consultation on content and timing. Ask for the sentence that the unlisted seller gives no undertaking about the buyer's compliance. If the buyer asks your founders and investors to acknowledge that they hold price sensitive information about Kaveri, accept a narrow acknowledgement limited to not trading in or tipping about Kaveri securities while the deal is unpublished, which the regulations require anyway, and refuse wider duties such as reporting to Kaveri's compliance officer. Ask who the buyer's compliance officer is and record the name.

Unpublished price sensitive information (UPSI)SEBI (Prohibition of Insider Trading) Regulations 2015 Structured digital database Trading window lodr 30

10. No obligation to transact, no exclusivity

The Parties acknowledge that this Agreement does not constitute an offer, commitment or agreement to proceed with the Transaction or any other transaction, and that neither Party, nor any shareholder of the Company, shall have any obligation in relation to the Transaction unless and until a definitive written agreement has been executed and delivered. Either Party may, at any time and for any reason, terminate discussions concerning the Transaction, decline to provide or receive further Confidential Information, or reject any proposal, without liability to the other. Nothing in this Agreement grants the Recipient any exclusivity or any right of first refusal or first offer, and the Company and its shareholders shall be free to conduct whatever process they consider appropriate, including soliciting and negotiating proposals from and providing information to other persons, without notice to the Recipient, unless and until the Parties agree otherwise in a signed term sheet or other written agreement. The Recipient acknowledges that it has not relied on any statement made by the Company or its Representatives other than those that may be set out in a definitive agreement.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

Signing the NDA commits nobody to a deal. Either side can stop talking at any time, refuse to share more, or turn down a proposal, with no liability. Kaveri gets no exclusivity and no right of first refusal; Saffron and its shareholders are free to run a competitive process, talk to other bidders and share information with them, without telling Kaveri, until the parties sign a term sheet or other agreement that says otherwise. Kaveri also confirms it is not relying on anything said in diligence except what ends up as a warranty in the final agreement.

What it means for you

This is where the NDA and a term sheet diverge. A buyer will eventually ask for exclusivity for 30 to 60 days to finish diligence; that is a reasonable ask in a term sheet, where you can tie it to a price and a timetable, and an unreasonable one in an NDA signed before any price has been named. Keeping the process open is your leverage: Kaveri knows Marigold's exit timetable and will try to lock you in early. The non-reliance sentence protects you and your shareholders from a later claim that a management presentation was a misrepresentation, which is why the share purchase agreement warranties, not diligence answers, are what the buyer may sue on. For the no obligation language to work, do not send emails that read like acceptances of an offer.

What is normal

A no-obligation clause appears in every acquisition NDA. An express statement that no exclusivity or pre-emption right arises appears in most seller drafts; buyer drafts are often silent, which is acceptable but less clear. A non-reliance acknowledgement appears in around 6 of 10 acquisition NDAs and protects the seller's management from misrepresentation claims on diligence materials. Exclusivity itself is almost never granted in the NDA; it comes with a non-binding term sheet or letter of intent, typically for 30 to 60 days, and is the only binding term in that document apart from confidentiality. Some NDAs record that the seller may change the process at any time, which is implicit here.

How to negotiate it

Ask for the express statement that no exclusivity or first refusal right arises from the NDA and that you may run a process with others. Ask for the non-reliance sentence, which protects your founders. Refuse any exclusivity, break fee or cost reimbursement at this stage; tell the buyer those belong in a term sheet with a price attached. If the buyer wants notice when you engage other bidders, refuse, because that information is itself leverage. If the buyer asks for a short period of exclusivity in return for an indicative offer with a price range, consider it only through a separate term sheet with a hard end date and a right to terminate if the price moves.

No obligation to transact exclusivity term sheet spa

End and legal

11. Term, survival and return or destruction

This Agreement shall continue for 2 years from the date of this Agreement. The Recipient's obligations in respect of Confidential Information disclosed during that period shall survive for 3 years after its expiry, except that obligations in respect of trade secrets, including source code, and personal data shall survive for so long as the information remains a trade secret or the personal data is retained. Within 10 days of a written request from the Company, and in any event within 10 days of the termination of discussions concerning the Transaction, the Recipient shall, and shall procure that its Representatives shall, return or destroy all Confidential Information in their possession, including all copies, extracts, analyses and other derived materials, permanently erase electronic copies, and deliver to the Company a certificate signed by an authorised officer confirming compliance. The Recipient may retain one archival copy in the custody of its legal or compliance function to the extent required by law, regulation or bona fide internal compliance policies, including the PIT Regulations, and copies held in automatic backup systems until overwritten, all of which shall remain subject to this Agreement for so long as retained. Clauses 7, 8, 9, 11, 12, 13 and 14 shall survive expiry or termination for their respective periods.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

The agreement lasts 2 years and the secrecy duties last 3 years beyond that; trade secrets and personal data are protected for as long as they stay secret or are held. If discussions end, or whenever Saffron asks, Kaveri has 10 days to return or destroy everything, including its own analyses built on the information, and to deliver an officer's certificate saying so. Kaveri's legal team may keep one archival copy for compliance, including under the insider-trading regulations, and backups stay until overwritten, but all of it remains confidential while it exists. The standstill, non-solicit, insider-trading, remedies and legal clauses survive for their own periods.

What it means for you

When a buyer walks away, send the return request the same day; the 10-day deadline is tight by design because a competitor's deal team moves on to its next target quickly. The certificate is what you hold if the information resurfaces. The archival copy exception has a particular justification for a listed buyer: its insider-trading records must show what information it held and when, so refusing it is pointless. The survival periods interact with the standstill and non-solicit, which run on their own 18-month clock from signing, not from expiry; keep both dates in your register. If the deal signs, the share purchase agreement's confidentiality clause takes over.

What is normal

Acquisition NDAs run 2 to 3 years, with survival of 2 to 5 years; 3 years after expiry is the common middle. Trade secret and personal data carve-outs from the survival period are standard in seller drafts. Return or destroy within 10 to 15 business days of a request or the end of discussions is standard; 30 days appears in buyer drafts. An officer's certificate is standard. The archival copy exception for legal and compliance purposes, expressly including securities law records, appears in most drafts where the recipient is listed or regulated. Survival of the standstill and non-solicit for their own periods regardless of the agreement's expiry is standard and should be checked carefully, since a drafting slip can end an 18-month standstill early if the agreement is terminated or superseded at signing.

How to negotiate it

Ask for 10 days to return or destroy, an officer's certificate and the trade secret and personal data carve-outs. Accept the archival copy for legal and compliance, including PIT Regulations records, but require it to sit with legal or compliance and not with the deal team. Ask that derived materials such as valuation models are destroyed or, if the buyer insists on keeping its own board papers, that they are redacted of your data. Make sure the survival clause lists the standstill and non-solicit by number so that they run their full periods. If the buyer wants a longer window of 30 days, agree only for backup erasure, not for live copies.

Term and survival Return or destruction Archival copy Certificate of destruction Trade secret

12. Remedies

The Recipient acknowledges that the Confidential Information is of substantial value to the Company and its shareholders, that any breach of this Agreement may cause them loss that cannot be adequately compensated by damages, and that the Company and, where relevant, its shareholders shall be entitled to seek injunctive relief, specific performance and other equitable remedies under the Specific Relief Act 1963, including interim measures under Section 9 of the Arbitration and Conciliation Act 1996, to prevent any actual or threatened breach, without the need to prove special damage. The Recipient specifically acknowledges that a breach of Clause 7 (Standstill) or Clause 8 (Non-solicitation) could disrupt the Company's process, its relationships and its workforce in ways that are difficult to quantify, and agrees that an injunction is the appropriate primary remedy for any such breach. The Recipient shall indemnify the Company and its shareholders against all direct losses, costs and expenses, including reasonable legal fees, arising from any breach of this Agreement by the Recipient or its Representatives, in accordance with Sections 73 and 74 of the Indian Contract Act 1872. No provision of this Agreement shall operate as a penalty. The Recipient shall have no claim against the Company or its shareholders arising from the use of Confidential Information in accordance with this Agreement.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

Kaveri agrees that the information is valuable, that a leak may cause loss money cannot fix, and that Saffron and its shareholders may go to court for an injunction under the Specific Relief Act 1963, or for interim measures under Section 9 of the Arbitration and Conciliation Act 1996 since disputes go to arbitration. It specifically accepts that a breach of the standstill or the non-solicit damages the process and the team in ways hard to price, so an injunction is the right first remedy. It must make good direct losses and legal fees under Sections 73 and 74 of the Indian Contract Act 1872, nothing operates as a penalty, and Kaveri cannot claim against Saffron for anything it does with the information properly.

What it means for you

The standstill acknowledgement is the sentence doing the extra work here. Courts grant injunctions more readily when the party being restrained has agreed in writing that damages are inadequate for that specific breach. If Kaveri calls Marigold directly, you want an order within days, not a damages trial in 2032. Section 9 lets you get that from the Bengaluru courts even though the merits go to an arbitrator. The indemnity runs to your shareholders too, which gives Marigold an arguable route to its own legal costs; for certainty, have it sign a deed of adherence to the indemnity and the dispute clause. The absence of a liquidated damages figure is deliberate: under Section 74 a stated sum is recoverable only as reasonable compensation, and a large figure invites a buyer to negotiate it down and treat it as the price of a breach.

What is normal

An injunction acknowledgement appears in every acquisition NDA, and a specific acknowledgement for the standstill and non-solicit appears in around half of seller drafts. Indemnity for direct loss and reasonable legal fees in favour of the company and its shareholders is standard; buyers often try to limit it to the company alone. Liquidated damages appear in perhaps 1 in 5 acquisition NDAs in India and are almost always negotiated out by listed buyers. Liability caps are rare in acquisition NDAs and sellers should refuse them. A no-claims sentence protecting the seller from claims about the information itself, as here, is standard and ties in with the non-reliance clause.

How to negotiate it

Ask for the general injunction acknowledgement and the specific one for the standstill and non-solicit. Ask for Section 9 interim relief to be expressly preserved, since arbitration is the dispute route. Ask for the indemnity to extend to your shareholders and to cover reasonable legal fees. Refuse any cap on the buyer's liability and any attempt to exclude the buyer's liability for its Representatives. Do not propose liquidated damages; if the buyer offers them as a cap in disguise, refuse. Accept the no-claims sentence about proper use of the information, which protects you as much as the buyer.

Injunction Specific Relief Act 1963 Sections 73 and 74 of the Indian Contract Act 1872 Liquidated damages and penalties interim relief

13. Governing law and arbitration

This Agreement and any dispute or claim arising out of or in connection with it shall be governed by the laws of India. Any dispute arising out of or in connection with this Agreement, including any question regarding its existence, validity or termination, shall be referred to and finally resolved by arbitration under the Arbitration and Conciliation Act 1996 by a sole arbitrator appointed by agreement of the Parties or, failing agreement within 15 days of a request, by the Mumbai Centre for International Arbitration in accordance with its Rules. The seat and venue of arbitration shall be Bengaluru, Karnataka, and the language shall be English. Nothing in this Clause shall prevent either Party from seeking interim or injunctive relief under Section 9 of the Arbitration and Conciliation Act 1996 from the courts at Bengaluru, which shall have exclusive jurisdiction for that purpose, or emergency relief under the applicable Rules. The compelled disclosure provisions of Clause 6 of the Mutual Non-Disclosure Agreement form, as set out in Schedule 1, shall apply to the Recipient, provided that any disclosure required by the SEBI (Listing Obligations and Disclosure Requirements) Regulations 2015 shall be made only after the Recipient has consulted the Company on its content and timing to the extent lawful.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

Indian law governs. Disputes go to a single arbitrator seated in Bengaluru, chosen by agreement or, failing that within 15 days, appointed by the Mumbai Centre for International Arbitration under its rules, in English. Either side can still go to the Bengaluru courts for urgent interim relief under Section 9 of the Arbitration and Conciliation Act 1996, or use the institution's emergency arbitrator. The compelled disclosure rules from the mutual NDA apply through a schedule, with one addition: any stock exchange disclosure Kaveri must make under the listing regulations happens only after consulting Saffron on what it says and when.

What it means for you

The pilot NDA chose courts; this one chooses arbitration. The difference is the counterparty and the stakes. A listed company with a deal team in Mumbai will want a private forum where a dispute about a ₹450 crore acquisition does not become a public court record that moves its share price, and so do you, because a public fight with a buyer damages your process. Arbitration also keeps the standstill dispute out of the newspapers. You lose nothing on urgency: Section 9 interim relief from the Bengaluru courts is preserved, and the MCIA's emergency arbitrator is a second route. The seat in Bengaluru means the Karnataka courts supervise the arbitration and hear any challenge to the award. The LODR consultation sentence stops Kaveri announcing the deal to the exchanges before you have told your team.

What is normal

Arbitration is the usual choice for acquisition NDAs with a listed or large counterparty, chosen in perhaps 7 of 10 such documents, while courts remain the norm for small commercial NDAs. A sole arbitrator with an institutional fallback, the Mumbai Centre for International Arbitration or the Delhi International Arbitration Centre being the common Indian institutions, is standard. The seat is usually the seller's city for a seller draft and the buyer's city for a buyer draft; a neutral city is uncommon. Preservation of Section 9 relief and exclusive jurisdiction of the seat's courts for that purpose is standard. A consultation right before LODR disclosures appears in most NDAs with a listed recipient.

How to negotiate it

Ask for a sole arbitrator and an institutional fallback with a short appointment window, 15 to 30 days, so that a dispute cannot be stalled at the appointment stage. Ask for the seat in Bengaluru as the seller; accept Mumbai if the buyer insists and you are otherwise getting the standstill and clean team you want, since the venue matters less than the preserved Section 9 right. Ask for Section 9 relief and emergency arbitration to be expressly available. Ask for the LODR consultation sentence and, if possible, a right to approve the description of the Company in any announcement. Refuse any pre-arbitration negotiation period that would delay an injunction; carve interim relief out of it if the buyer insists.

Jurisdiction clause: courts or arbitration Compelled disclosure arbitration seat interim relief governing law

14. Miscellaneous

The Recipient may not assign or transfer any of its rights or obligations under this Agreement without the Company's prior written consent, except to a wholly owned subsidiary of the Recipient that signs a deed of adherence to this Agreement, in which case the Recipient shall remain liable for that subsidiary's compliance. Notices shall be in writing and delivered by email to the addresses in Schedule 4, with a copy by courier to the registered office, and shall be deemed received on the business day after the email is sent provided no bounce message is received. No amendment or waiver shall be effective unless in writing and signed by both Parties; no failure or delay in exercising any right shall operate as a waiver. This Agreement may be executed in counterparts and by electronic signature under the Information Technology Act 2000. The Recipient shall bear the stamp duty payable on this Agreement in Maharashtra and Karnataka. This Agreement constitutes the entire agreement between the Parties relating to the confidentiality of information exchanged for the Purpose and the Recipient's conduct in connection with the Transaction, and supersedes all prior undertakings in that respect. On the execution of a definitive agreement for the Transaction containing confidentiality provisions, those provisions shall supersede Clauses 2 to 6 of this Agreement in respect of information disclosed thereafter, and Clauses 7, 8 and 9 shall continue in accordance with their terms unless that agreement provides otherwise. If any provision is held invalid, it shall be read down or severed and the remainder shall continue in force.

Click for the notes: what it says, what it means for you, what is normal, how to negotiate it

What it says

Kaveri cannot pass the agreement to anyone else without consent, except to a wholly owned subsidiary that signs up to the same terms, and Kaveri stays on the hook for it. Notices go by email with a courier copy, and count as received the next business day. Changes need both signatures and slow enforcement is not a waiver. Electronic signature in counterparts is fine. Kaveri pays the stamp duty in both States. The agreement is the whole deal on confidentiality and conduct, and once the acquisition agreement is signed, its confidentiality clause takes over for new information while the standstill, non-solicit and insider-trading clauses keep running unless the acquisition agreement says otherwise.

What it means for you

Three points matter. The subsidiary assignment carve-out is a normal ask from a listed group that may buy through an acquisition vehicle; the deed of adherence and the continuing liability sentence are what make it safe. The hand-over to the share purchase agreement avoids two overlapping confidentiality regimes after signing, but notice that the standstill and non-solicit survive the signing on purpose: if the deal signs and then fails to complete, you still want Kaveri bound for the balance of the 18 months. Stamp duty on an agreement executed in Mumbai and used in Bengaluru is nominal in both States, and paying it before signing avoids an admissibility fight under Section 34 of the Maharashtra and Karnataka Stamp Acts, the State versions of Section 35 of the Indian Stamp Act 1899, if you ever need the document for an injunction.

What is normal

No assignment without consent, with a carve-out for a wholly owned subsidiary that adheres and with continuing liability of the original party, is standard in acquisition NDAs where the buyer may use an acquisition vehicle. Email notice with next business day deemed receipt is normal. Electronic signature and counterparts are standard. The buyer paying stamp duty on a seller-drafted NDA is common; the amounts are a few hundred rupees in Maharashtra and Karnataka. A supersession clause handing confidentiality to the definitive agreement while preserving the standstill and non-solicit appears in most well-drafted seller NDAs; buyer drafts often provide that the whole NDA terminates on signing, which is a trap if completion fails. Severability and no-waiver clauses are universal.

How to negotiate it

Ask for the assignment carve-out to be limited to a wholly owned subsidiary that signs a deed of adherence, with the buyer remaining liable. Ask for the standstill, non-solicit and insider-trading clauses to survive the signing of the definitive agreement and to end only on completion or by express agreement. Ask the buyer to bear stamp duty, since it is nominal and the buyer's compliance team will want a properly stamped document in its own records. Ask for email notice with a courier copy so that a breach notice can be served in hours. Make sure the entire agreement clause is limited to confidentiality and conduct in the process, so that any later term sheet is not accidentally superseded.

Counterparts and electronic signature Stamp duty on an NDA entire agreement severability spa deed of adherence

Which NDA for which situation

The same two-page template gets sent to investors, vendors, employees and buyers. Each needs a different document, and in two cases no document at all. The table gives the type, the usual term, the clauses to add and the trap to watch in each situation.

Situation	Type	Term	Extra clauses	Watch out for
Investor pitch (angel, VC, family office)	None. Investors do not sign NDAs for pitches	Not applicable	Instead: a deck with no source code, customer names or unit economics beyond what you would say on stage; detailed data only after a term sheet, under its confidentiality clause	Sending an NDA signals inexperience and gets ignored; the real protection is staged disclosure and the confidentiality clause in the term sheet
Customer pilot (as with Tungabhadra Forge)	Mutual	2 years; obligations survive 3 years; trade secrets while secret	Personal data terms under the DPDP Act where the pilot touches employee or customer data; a 12-month mutual employee non-solicit; no reverse engineering	The customer's procurement team will try to swap in its own template; check the definition covers your source code and roadmap, not only their plant data
Enterprise procurement (the customer insists on its template)	Mutual on paper, often one-way in effect	Whatever the template says; aim for 2 to 3 years plus 3-year survival	Negotiate, do not redraft: add your information to the definition, add oral disclosures, cap survival, delete any residuals clause and any indemnity	A liquidated damages figure or an uncapped indemnity that only runs against you; marking requirements that lose your demos
Vendor or contractor (payroll, hosting, development agency)	One-way, you disclose	Life of the engagement plus 3 years	IP assignment of everything made for you; data processor terms under the DPDP Act; subcontractor flow-down; return or destroy with a certificate	The vendor's own terms of service may claim a licence over your data; an NDA without an IP assignment leaves the code with the vendor
Freelancer or outsourced developer	One-way, you disclose, inside the contractor agreement	Engagement plus 3 years	Present assignment of IP (not a promise to assign), moral rights waiver, no residuals clause, no use of your code in other projects, source code escrow if the engagement is large	A residuals clause lets the developer reuse what they remember; for a developer that is the whole architecture
Employee	Confidentiality clause in the employment agreement, not a separate NDA	Employment plus survival for 3 to 5 years; trade secrets while secret	Invention assignment, return of devices and data, a 12-month non-solicit of colleagues (often upheld) and, if you want one, of customers (courts are divided; it is likeliest to hold where it stops use of your confidential customer information), cooperation after leaving	A post-employment non-compete is void under Section 27 and makes the whole letter look oppressive; it can also colour a court's view of the confidentiality clause
Adviser or mentor	Light mutual	2 years; 2-year survival	Disclosure of the relationship to investors permitted; no obligation to advise; advisory shares or fees dealt with elsewhere	Advisers talk to many startups; keep the definition tight and never share source code or customer contracts with an adviser who also advises a competitor
Joint development or partnership	Mutual, with field of use	Project plus 3 to 5 years	Who owns jointly created IP, each party's field of use, background IP stays with its owner, a named project manager who controls disclosures	Without an IP ownership rule the NDA protects the inputs but says nothing about who owns the output; that is the fight that ends partnerships
Accelerator or incubator	Light mutual, or none	Programme plus 1 to 2 years	Carve-out for demo day and cohort sessions; publicity rights handled in the incubation agreement, not the NDA	Programmes see hundreds of decks and will not sign a strict NDA; disclose at the level you would in a public demo
Acquirer (as with Kaveri Industrial Software)	One-way, you disclose, with a limited reverse duty about the existence of talks	2 years; 3-year survival	Standstill for 18 months; employee and customer non-solicit for 18 months; clean team for pricing and customer contracts; insider-trading acknowledgement where the buyer is listed; data room terms	A buyer that is also a competitor learns your pricing and customer list and walks away; the clean team and the non-solicit are what you are left holding
Bank or lender	Their format, usually one-way in their favour plus a confidentiality undertaking from the bank in the facility letter	Life of the facility plus 2 to 3 years	Data protection terms for borrower and guarantor personal data; consent to credit bureau reporting is separate and statutory	Banks rarely change their format; focus on who inside the bank sees your customer contracts and projections, and ask for return or destruction if the facility is declined
Government tender or PSU procurement	The tender's format; no changes possible	As stated in the tender, often 5 years or more	None can be added; check the integrity pact and the confidentiality undertaking you must sign with the bid	Bid documents can be sought under the Right to Information Act 2005; mark commercially confidential parts when you bid, which supports the Section 8(1)(d) exemption and entitles you to notice under Section 11 before disclosure

Calculators

Change any figure and the result updates. Every formula is shown.

Which NDA do I need?

Answer five questions and the picker tells you whether you need an NDA at all, whether it should be mutual or one-way, how long the term and survival should run, and which extra clauses to add. It asks who discloses (only you, only them, both), the situation (investor pitch, customer pilot, vendor or contractor, employee, adviser, acquirer, partnership), whether personal data is shared, whether source code or trade secrets are shared, and how many months the relationship is expected to last.

Worked example. Default inputs: both sides disclose, the situation is a customer pilot, personal data is shared (the customer's employee shift and attendance data), no source code or trade secrets are shared, and the relationship is expected to last 12 months. The picker returns a mutual NDA with a 2-year term and 3-year survival, and tells you to add data processor terms under the Digital Personal Data Protection Act 2023 and a 12-month employee non-solicit, and not to accept a residuals clause. That is the shape of Saffron's agreement with Tungabhadra Forge in Tab 1. Change the situation to acquirer and the answer becomes a one-way NDA with an 18-month standstill, a non-solicit of employees and customers and a clean team, the shape of Tab 2. Change the situation to investor pitch and the answer is no NDA.

The picker is a starting point, not legal advice: it applies the ranges on this page to your answers and cannot see the counterparty's template or your sector. Investors do not sign NDAs for pitches, so for that situation it returns none and points you to staged disclosure instead. For an acquirer it always returns a one-way NDA with a standstill and a clean team, and reminds you to add an insider-trading acknowledgement if the buyer is listed. If source code or trade secrets are shared, it adds a no reverse engineering clause and carves trade secrets out of the survival period. Where personal data is shared it adds data processor terms in every situation except an investor pitch.

Every term, in plain English

59 terms in 5 groups. Each one has the plain meaning, a worked example where numbers help, what is normal, what to watch for, and the India-specific rule.

Start here

The document, its two shapes, and the situations where you need one or do not

Non-disclosure agreement (NDA)A contract in which one or both parties promise to use the other's secret information only for a stated purpose and keep it from everyone else.

Also called: Confidentiality agreement, Confidential disclosure agreement, CDA

In plain English

An NDA is a promise about information. The receiving party agrees to use what it is told only for the purpose the parties name, to show it only to people who need it, and to keep it secret for an agreed period. It does not stop the other side competing with you, and it does not protect an idea you have not reduced to specific information. Its strength comes from four paragraphs: the definition of Confidential Information, the exclusions, the term and survival, and the remedies. Everything else is machinery. In India the promise is enforceable because it is not a restraint of trade; the remedy is an injunction, not a penalty.

Worked example

Saffron Labs signed a mutual NDA with Tungabhadra Forge Industries Limited on 5 January 2026 before a paid pilot at two Hosur plants. Saffron disclosed its roadmap, pricing and demonstration environment; Tungabhadra disclosed plant layouts, production data and employee shift records. The agreement ran 2 years with obligations surviving 3 years, trade secrets protected while secret, and a 12-month mutual employee non-solicit.

What is normal

A 2 to 3 year term with 3 to 5 year survival; mutual for pilots and partnerships, one-way for vendors and acquirers; 2 to 6 pages; no liquidated damages; courts for small NDAs, arbitration for acquisitions; nominal State stamp duty; signed electronically.

Watch out for

A template that protects only marked information, a residuals clause, a perpetual term on ordinary information, an indemnity or liquidated damages running one way, a non-compete dressed as confidentiality, and no notice before compelled disclosure.

In India

Enforceable under the Indian Contract Act 1872; confidentiality is not a restraint of trade under Section 27. India has no trade-secrets statute, so protection rests on contract and the action for breach of confidence. Stamp duty is a few hundred rupees under the State Stamp Act; e-signature is valid under Section 5 of the Information Technology Act 2000.

Copy link to this term

Mutual NDAAn NDA in which both parties disclose and both are bound by the same obligations as receiving party.

Also called: Two-way NDA, Bilateral NDA, Reciprocal NDA

In plain English

In a mutual NDA each party can be the disclosing party or the receiving party depending on who hands over information, and the same rules apply to both. It suits a pilot, a partnership or a joint development where information flows in both directions. The practical advantage is speed: because every obligation binds both sides, neither side can push for one-sided terms without accepting them itself. The practical risk is that founders agree to duties they cannot meet, such as a 24-hour breach notice or an audit right, because they are thinking only about receiving protection. Read a mutual NDA twice, once as discloser and once as recipient.

Worked example

In the Tungabhadra pilot, Saffron disclosed source code and pricing while Tungabhadra disclosed plant layouts and shift data. The same definition, exclusions, standard of care, 3-year survival and 12-month non-solicit applied to both. When Saffron's engineers later built a demo for another forge, the same clause 4 that protected Saffron's code stopped them reusing Tungabhadra's shift patterns.

What is normal

Mutual in roughly 8 of 10 pilot and partnership NDAs; 2 to 3 year term; identical obligations for both sides; a mutual employee non-solicit of 12 months where teams work together.

Watch out for

A mutual heading with one-sided content: a definition listing only the customer's categories, an indemnity that runs one way, or a residuals clause that only benefits the larger party. Check that each obligation reads sensibly with your name as the receiving party.

In India

No special Indian rule; the same Section 27 analysis applies to both sides, so a mutual non-compete is as void as a one-sided one. Stamp duty is payable once on the instrument, not once per party.

Copy link to this term

One-way NDAAn NDA in which only one party discloses and only the other is bound to keep the information secret.

Also called: Unilateral NDA, Recipient NDA, Confidentiality undertaking

In plain English

A one-way NDA has a fixed discloser and a fixed recipient. It fits situations where the information flows in one direction: a vendor or contractor receiving your systems and data, an acquirer receiving your books, or you receiving a customer's data for a project. Because only one side is bound, the drafting can be strict without the discloser paying for it: a higher standard of care, consent before disclosure to financiers, a clean team, a standstill. The recipient will often propose a mutual draft instead, so that the strict terms bind both; in an acquisition the seller should refuse, because mutuality can bind the seller and its shareholders in ways that hamper a competing process.

Worked example

Saffron's agreement of 10 January 2029 with Kaveri Industrial Software Limited was one-way: Saffron disclosed the data room, management presentations and offer terms, and Kaveri was bound by confidentiality, an 18-month standstill, an 18-month non-solicit and clean team rules. Saffron's only duty was not to disclose the existence of the talks.

What is normal

One-way in roughly 9 of 10 acquisition NDAs and most vendor NDAs; 2 to 3 year term with 3-year survival; often a limited reverse duty about the existence of discussions.

Watch out for

A buyer or a large customer that insists on mutuality when it will disclose nothing; a one-way NDA imposed on you as recipient by a vendor whose own terms of service claim rights over your data.

In India

No special rule. Where the recipient is a listed company, the one-way NDA usually carries an insider-trading acknowledgement under the SEBI (Prohibition of Insider Trading) Regulations 2015, since the information may be price sensitive for the recipient's own securities.

Copy link to this term

NDA with investorsInvestors as a class do not sign NDAs for pitches; protection comes from staged disclosure and the term sheet's confidentiality clause.

Also called: Investor NDA, Pitch NDA

In plain English

Angels, venture funds and family offices see hundreds of decks a year, many in the same sector, and cannot sign a document that could later be used to claim they stole an idea they had already seen elsewhere. Asking for one signals inexperience and is usually ignored. The protection you actually have is threefold: disclose in stages, keeping source code, customer contracts and unit economics beyond the deck until there is a term sheet; rely on the confidentiality clause in the term sheet, which is one of its binding provisions; and remember that reputation is the investor's main asset. Disclosure to an investor's existing portfolio and advisers is normally a permitted disclosure under that clause.

Worked example

Before the Series A, Saffron sent Marigold a deck and a product demo with no NDA. Detailed customer contracts, the data room and source code review followed only after the term sheet was accepted on 15 September 2026, under its confidentiality clause and 45-day exclusivity. Marigold's partners were free to tell their investment committee and existing portfolio advisers.

What is normal

No NDA for a pitch in effectively every venture process; confidentiality in the term sheet binding for 12 to 24 months; data room access only after the term sheet; no NDA for an accelerator application either.

Watch out for

A founder who refuses to share anything without an NDA loses the meeting; a founder who shares the source code at the first meeting has no protection at all. The middle path is a deck that reads like a conference talk and a data room that opens after a term sheet.

In India

No Indian rule requires or prohibits it; market practice follows the global norm. Where a term sheet is signed, its confidentiality and exclusivity clauses are the binding provisions and are enforceable under the Indian Contract Act 1872.

Copy link to this term

NDA with employeesEmployees are bound by a confidentiality clause in the employment agreement, which survives employment; a separate NDA adds little and a post-employment non-compete adds nothing.

Also called: Employee confidentiality clause, Employee confidentiality agreement

In plain English

An employee needs no separate NDA if the employment agreement does the job: a definition of confidential information that covers everything learned in the role, a duty to use it only for the employer, a duty to return devices and data on leaving, an assignment of inventions and work product, and a statement that the confidentiality duty survives for a stated period or, for trade secrets, while they stay secret. A 12-month non-solicit of colleagues is often upheld; courts are divided on customer non-solicits after employment. A non-compete that operates after employment ends is void under Section 27 of the Indian Contract Act 1872 and its presence can make a court read the whole letter unsympathetically. Confidentiality, by contrast, survives employment because it restrains disclosure, not trade.

Worked example

Priya Nambiar, Saffron's Head of Sales, signed an employment agreement on 1 August 2025 with a confidentiality clause surviving 3 years after leaving, trade secrets while secret, an invention assignment and a 12-month non-solicit of Saffron's customers and colleagues. No separate NDA was needed. A non-compete clause was deliberately left out because it would be void once she left.

What is normal

A confidentiality clause in every employment agreement; survival of 2 to 5 years after leaving, trade secrets while secret; a 12-month non-solicit; invention assignment; return of property on exit; no post-employment non-compete.

Watch out for

Garden leave and notice-period restrictions are enforceable during employment and are the lawful way to delay a departing employee; a clause that forfeits earned salary for breach of confidentiality is a penalty and unenforceable under Section 74.

In India

Niranjan Shankar Golikari v. Century Spinning (Supreme Court, 1967) upheld a restriction operating during employment and distinguished post-termination restraints; post-employment non-competes are unenforceable, confidentiality survives. The four Labour Codes in force since 21 November 2025 do not change this contract-law position.

Copy link to this term

NDA with contractors and vendorsA one-way NDA from you to a vendor, contractor or freelancer, which must travel with an IP assignment and data processor terms to be useful.

Also called: Vendor NDA, Contractor confidentiality agreement, Freelancer NDA

In plain English

A payroll vendor, a hosting provider, a development agency or a freelance developer receives your systems, your data and sometimes your code. The NDA keeps that secret, but on its own it does not make the work product yours: without a present assignment of intellectual property, the copyright in code written by an independent contractor stays with the contractor under the Copyright Act 1957. Add a data processor clause under the Digital Personal Data Protection Act 2023 where the vendor touches personal data, a flow-down to subcontractors, a no-residuals clause, and return or destruction with a certificate. Many vendors' own terms of service claim a licence over customer data; the NDA should say that it prevails.

Worked example

When Saffron engaged an outsourced development agency in 2027 to build a reporting module, the contractor agreement carried a one-way NDA (engagement plus 3 years, source code while secret), a present assignment of all code and designs with a moral rights waiver, a bar on reusing Saffron's code in other projects, and DPDP processor terms for the customer data the module would read.

What is normal

One-way in favour of the company; life of the engagement plus 3 years; IP assignment and moral rights waiver; DPDP processor schedule; no residuals; a certificate of destruction at the end; often inside the services agreement rather than a separate document.

Watch out for

An NDA without an IP assignment leaves the code with the developer; a residuals clause gives the developer the architecture; the vendor's online terms may claim rights the NDA does not override unless it says so.

In India

Section 17 of the Copyright Act 1957 vests first ownership in the author, so a contractor owns its code unless assigned in writing under Section 19; an assignment must be in writing and signed. A data processor may be engaged only under a valid contract under the DPDP Act 2023.

Copy link to this term

No obligation to transactA clause confirming that the NDA commits nobody to a deal and either party may end discussions at any time without liability.

Also called: No commitment clause, Freedom to terminate discussions, Non-binding discussions

In plain English

The clause keeps the NDA in its lane. Signing it does not mean the pilot will happen, the acquisition will close or any price has been agreed. Either party may stop talking, refuse to disclose more or reject a proposal without owing the other anything. In an acquisition NDA it is paired with a statement that no exclusivity or right of first refusal arises and that the seller is free to run a process with other bidders, and often with a non-reliance acknowledgement so that diligence answers cannot later be sued on as misrepresentations. The clause matters because deal emails can read like acceptances; the written agreement is what commits you.

Worked example

Clause 10 of Saffron's agreement with Kaveri confirmed that Kaveri had no exclusivity, that Saffron could solicit other bidders without notice, and that Kaveri was not relying on any management statement outside a definitive agreement. Kaveri later asked for 45 days of exclusivity; Saffron agreed only in a term sheet signed in February 2029, with a hard end date.

What is normal

Present in effectively every NDA; an express no-exclusivity sentence in most seller-drafted acquisition NDAs; a non-reliance acknowledgement in around 6 of 10 acquisition NDAs; exclusivity itself only in a term sheet for 30 to 60 days.

Watch out for

An NDA that contains a duty to negotiate in good faith for a period, a break fee or a cost reimbursement has become a letter of intent; price those separately or refuse. Avoid sending emails that read as acceptance of an offer.

In India

Indian law recognises agreements to agree as unenforceable, and a non-reliance clause is given effect subject to Section 17 of the Indian Contract Act 1872 on fraud, which cannot be excluded. Exclusivity, once given in a signed term sheet, is enforceable as a binding provision.

Copy link to this term

Purpose limitationThe rule that the receiving party may use Confidential Information only for the Purpose defined in the NDA and for nothing else.

Also called: Permitted purpose, Use restriction, Purpose clause

In plain English

Every NDA defines a Purpose, and the use clause says the information may be used only for it. The narrower the Purpose, the stronger the protection, because any other use is a breach without needing to prove disclosure to anyone. A Purpose tied to a named project, product and site means an in-house build or a pitch to a rival vendor is outside it. A Purpose described as any business discussions between the parties lets the recipient use the information for anything. The best drafting adds the words including to develop any competing product or to obtain any commercial advantage, so that the argument is not about what the recipient told others but about what it did itself.

Worked example

The Purpose in the Tungabhadra NDA was evaluation and a paid pilot of Saffron's workflow software at two Hosur plants. When Tungabhadra's IT team proposed a third plant and an in-house scheduling module, the first was a new Purpose needing an amendment and the second was a breach of the use clause if it drew on Saffron's demonstration.

What is normal

One or two sentences naming the project, the product and the site; a use clause stating solely for the Purpose; in acquisition NDAs, the Purpose is evaluating and completing the Transaction and a no-competing-use sentence appears in most seller drafts.

Watch out for

A Purpose that includes evaluating a commercial relationship of any kind, or the recipient's internal business purposes; a use clause that says primarily for the Purpose instead of solely.

In India

Purpose limitation is also a concept under the Digital Personal Data Protection Act 2023: personal data may be processed only for the specified purpose. Aligning the NDA Purpose with the DPDP purpose avoids two inconsistent definitions in one project.

Copy link to this term

What is protected

The definition, the exclusions and the categories of information that behave differently

Confidential InformationThe defined term that decides what the NDA protects; it should cover information in any form, marked or not, including oral disclosures and the recipient's own notes.

Also called: Proprietary Information, Protected Information, Evaluation Material

In plain English

The definition is the most important paragraph in the agreement. A good one covers all non-public information disclosed for the Purpose in any form, written, oral, electronic, by demonstration or by inspection, whether or not marked confidential. It lists the categories that matter on each side so there is no later argument about whether a pricing sheet shown on screen was covered, and it includes the recipient's own notes and analyses built on the information, the fact of the discussions, and any personal data. The exclusions then carve out what is public, already known, independently developed or received from a third party. A definition limited to information marked Confidential is the single biggest gap in procurement templates, because demonstrations and plant walks are never marked.

Worked example

Clause 2 of the Tungabhadra NDA listed Saffron's roadmaps, pricing, source code and demonstration environments, Tungabhadra's plant layouts, production data and shift schedules, employee personal data, the fact of the discussions, and both sides' notes. Oral disclosures were protected outright, with a soft duty to summarise in writing within 15 days.

What is normal

Broad, form-neutral definitions covering marked and unmarked information in most modern templates; 4 to 6 named categories; the fact of discussions included in acquisition NDAs; oral disclosures protected outright or subject to a 10 to 30 day written summary.

Watch out for

Marked-only definitions; definitions limited to information disclosed after signing when meetings have already happened; definitions that exclude information disclosed by the discloser's advisers or affiliates.

In India

No statutory definition in India; courts apply the definition the parties chose, supplemented by the equitable action for breach of confidence, which requires that the information had the necessary quality of confidence and was imparted in circumstances importing an obligation of confidence.

Copy link to this term

Exclusions from Confidential InformationThe four standard carve-outs: public information, information already known, information independently developed, and information received from a third party, each without breach.

Also called: Exceptions, Carve-outs, Excluded information

In plain English

The exclusions tell the recipient what it may use and make the agreement enforceable in practice. The four standard limbs are: information in the public domain other than through the recipient's breach; information the recipient already held free of any duty of confidence; information the recipient developed independently without use of or reference to the discloser's information; and information lawfully received from a third party free to disclose it. Well-drafted NDAs put the burden of proof on the recipient with contemporaneous written records, and add that a combination of public features is not public merely because each feature is. A residuals clause is sometimes disguised as a fifth exclusion and should be refused.

Worked example

When Tungabhadra said its IT team had already been designing a shift-scheduling tool before the Saffron demo, clause 3 required dated documents proving independent development without reference to Saffron's information. The team's design notes post-dated the demo, so the exclusion failed and the module could not proceed on that basis.

What is normal

All four limbs in effectively every NDA; the burden of proof on the recipient in around 7 of 10 well-drafted NDAs; written records for independent development in good templates; a fifth limb for information approved for release in writing is harmless.

Watch out for

An independent development limb that says without breach rather than without use of or reference to; an exclusion for information generally known in the industry with no public domain test; any exclusion for information retained in memory.

In India

Indian courts apply the exclusions as drafted and, in the action for breach of confidence, will not protect information that is public or trivial. The combination principle, that a product assembled from known parts can still be confidential, is recognised in Indian breach of confidence cases.

Copy link to this term

Burden of proof under an NDAThe rule that the receiving party must prove, with records made at the time, that information falls within an exclusion.

Also called: Onus of proof, Contemporaneous records requirement

In plain English

Disputes about an NDA are usually fought on the exclusions: the recipient says the information was public, or it already knew it, or it built the product itself. Without a burden of proof clause, the discloser may have to prove the negative. With one, the recipient must produce dated documents showing what it knew or developed and when. For a software vendor this is the clause that defeats a clean-room story told after the fact. It costs the recipient nothing if it behaves, which is why most counterparties accept it. Pair it with a disclosure log on your own side, so that you can prove what you disclosed and when.

Worked example

Clause 3 of the Tungabhadra NDA placed the burden on the receiving party to demonstrate an exclusion by contemporaneous written records. Saffron kept a disclosure log: date, attendees, what was shown. When a dispute threatened in 2027, the log and the burden clause together meant Tungabhadra had to show pre-demo design documents, which it could not.

What is normal

Express allocation to the recipient in around 7 of 10 well-drafted NDAs; contemporaneous written records required in good templates; a disclosure log on the discloser's side is best practice rather than a contractual term.

Watch out for

Templates that are silent on the burden; a clause that requires the discloser to prove the information was not public, which is nearly impossible for technical information.

In India

Under the Indian Evidence Act 1872, now replaced by the Bharatiya Sakshya Adhiniyam 2023, the burden ordinarily lies on the party asserting a fact; a contractual allocation to the recipient is respected by courts as an agreed term and is consistent with the general rule that the party relying on an exception must prove it.

Copy link to this term

Oral and visual disclosureInformation disclosed by speaking, demonstration or inspection; protected outright in good NDAs, lost under a strict marking rule.

Also called: Oral disclosure, Verbal disclosure, Disclosure by demonstration

In plain English

Most of what a startup discloses in a pilot or a sales process is said, not written: a roadmap discussion, an answer on the shop floor, a demo of an unreleased feature. A definition that covers only written or marked information leaves all of it unprotected. There are three drafting positions. The best protects oral and visual disclosures outright. The middle protects them if the discloser confirms them in writing within a window, 15 to 30 days, which is a condition you will sometimes forget. The worst, common in procurement templates, protects only information marked Confidential at the time of disclosure, which no demo ever is. Whatever the clause says, keep a disclosure log.

Worked example

Clause 2 of the Tungabhadra NDA protected information disclosed orally, by demonstration or by inspection of premises whether or not confirmed in writing, with a soft duty to summarise within 15 days. Saffron's sales engineer sent a one-paragraph email after each plant visit listing what was shown; the emails became the disclosure log.

What is normal

Protected outright in around half of modern templates; subject to a written summary within 10 to 30 days in most of the rest; marked-only definitions survive in procurement and government templates.

Watch out for

A written-summary condition with a short window of 5 or 10 days; a condition that the summary be countersigned by the recipient; demos given before the NDA is signed and a definition that starts at signing.

In India

No special rule; a contract term is enforceable as drafted. In the action for breach of confidence, oral disclosure in circumstances importing an obligation of confidence is protected even without a contract, but proving what was said is the practical difficulty, hence the log.

Copy link to this term

Marking requirementA clause that protects only information marked or legended as Confidential, losing every unmarked document and every oral disclosure.

Also called: Legend requirement, Marked-only definition, Designation requirement

In plain English

A marking requirement says information is confidential only if it carries a Confidential stamp or legend when disclosed, with oral disclosures protected only if summarised in writing within a set period. Large companies like it because it tells their staff exactly what to protect. For a startup it is dangerous: your demo, your whiteboard architecture, your pricing conversation and the data file an engineer emailed at midnight are all unmarked. If you cannot remove it, soften it: extend the summary window to 30 days, add that information a reasonable person would understand to be confidential is protected even if unmarked, and set up a habit of stamping every file before it leaves your systems.

Worked example

A procurement template Saffron received from another manufacturer in 2026 protected only information marked Confidential at the time of disclosure. Saffron's counsel negotiated it to the Tungabhadra form: marked or not, with oral disclosures protected and a 15-day written summary as good practice rather than a condition. The manufacturer accepted once Saffron agreed to label its own files.

What is normal

Marked-only definitions in around a quarter of procurement templates and most government formats; written summary windows of 10 to 30 days where oral disclosures are conditional; modern vendor and acquisition templates have no marking requirement.

Watch out for

A 5-day summary window; a requirement that the recipient countersign the summary; a marking rule combined with a residuals clause, which together leave almost nothing protected.

In India

No Indian rule requires marking; it is purely contractual. The action for breach of confidence does not depend on marking, so an unmarked disclosure may still be protected in equity, but relying on that is slower and less certain than a well-drafted definition.

Copy link to this term

Marked versus unmarked informationWhether the NDA protects information only when labelled, or protects everything disclosed for the Purpose regardless of label.

Also called: Marked or not, Whether or not marked confidential

In plain English

The phrase whether or not marked or identified as confidential is the one to look for in the definition. With it, everything disclosed for the Purpose is protected and labels are just helpful. Without it, the agreement may protect only what you stamped. Even with the broad wording, labelling has value: it tells the recipient's staff what to treat carefully, it helps a court see that you treated the information as secret, and it supports the trade secret carve-out from the survival period, which usually depends on the discloser identifying the information as a trade secret. Set your document templates to carry a confidentiality footer by default and mark source code and architecture documents as trade secrets.

Worked example

Saffron's standard footer reads Confidential, property of Saffron Labs Private Limited, disclosed under NDA dated 5 January 2026. Its source code repository and architecture documents carry the additional words Trade Secret. The Tungabhadra NDA protected everything regardless, but the footer made the 3-year survival and the while-secret carve-out easy to apply years later.

What is normal

Whether or not marked wording in most modern templates; a labelling habit on the discloser's side as best practice; trade secret designation by the discloser as the trigger for while-secret protection in around half of templates.

Watch out for

A definition that says marked or identified as confidential without the words whether or not; a trade secret carve-out that depends on written designation you never do.

In India

Labelling is evidence, not a legal requirement; Indian courts in breach of confidence cases look at how the discloser treated the information, so consistent marking strengthens an injunction application.

Copy link to this term

Trade secretInformation that derives value from being secret and is kept secret by reasonable steps; protected in India by contract and the action for breach of confidence, not by statute.

Also called: Know-how, Proprietary know-how, Undisclosed information

In plain English

A trade secret is information that is valuable because competitors do not have it and that you take reasonable steps to keep secret: source code, algorithms, a pricing model, a process recipe, a customer list with terms. India has no trade-secrets statute; protection rests on the NDA and on the equitable action for breach of confidence. In an NDA the term matters for the survival clause: ordinary information is protected for the survival period, while trade secrets are protected for as long as they remain secret. Your own internal discipline, access controls, labelling and a trade-secret policy, is what makes the information a trade secret in the first place and what a court will ask about.

Worked example

Clause 10 of the Tungabhadra NDA protected trade secrets, including source code and process know-how identified as such by the discloser, for as long as they remained secret, against a 3-year survival for everything else. Saffron's scheduling algorithm, kept in a restricted repository with access logs, was a trade secret; its public pricing page was not.

What is normal

A while-secret carve-out for trade secrets in most modern NDAs; designation by the discloser as the trigger in around half; an internal trade-secret policy in companies that have raised a priced round; no registration anywhere, since secrecy is the point.

Watch out for

Calling everything a trade secret, which devalues the carve-out; failing to mark or restrict access to the real secrets, so that a court doubts they were secret; disclosing a trade secret under a template with a 2-year survival and no carve-out.

In India

No statute. The Law Commission of India's Report No. 289 (March 2024) proposed a Protection of Trade Secrets Bill, not enacted as at October 2026. Protection today is contractual and equitable; remedies are injunction and damages. Patents require disclosure, so a secret process and a patent are alternatives, not companions.

Copy link to this term

Breach of confidenceThe equitable action that protects confidential information even without a contract, where information with the quality of confidence was imparted in confidence and misused.

Also called: Action for breach of confidence, Equitable duty of confidence

In plain English

Alongside the contract, Indian courts recognise a duty of confidence in equity. Three elements must be shown: the information had the necessary quality of confidence, meaning it was not public or trivial; it was imparted in circumstances importing an obligation of confidence; and it was used or disclosed without authority to the discloser's detriment. The action matters in two situations: where there is no NDA, for example a conversation that was clearly confidential, and where the NDA has a gap, such as a marked-only definition. It also supports an injunction against a third party who receives the information knowing it was confidential. It is slower and less certain than a well-drafted NDA, which is why the NDA comes first.

Worked example

If Tungabhadra had passed Saffron's architecture diagrams to a system integrator that was not a Representative, Saffron could sue Tungabhadra under the NDA and seek an injunction against the integrator for breach of confidence, provided the integrator knew the diagrams were confidential. The NDA footer on every page would be the evidence of that knowledge.

What is normal

Pleaded alongside breach of contract in most Indian confidential-information suits; relied on alone only where there is no signed NDA; the remedy is an injunction and an account of profits or damages.

Watch out for

The action does not protect information that is public, trivial or that the recipient can show it developed independently; it also requires proof of what was disclosed, so a disclosure log matters even more without a contract.

In India

Recognised by Indian High Courts following English equity; with no trade-secrets statute, it is the main non-contractual civil protection for business secrets. The Law Commission's Report No. 289 (2024) proposed codifying the position in a trade-secrets statute.

Copy link to this term

IP ownership in an NDAThe no-licence clause keeps all intellectual property with the discloser; an NDA alone never transfers or licenses IP.

Also called: No licence clause, Reservation of rights, Ownership of information

In plain English

Receiving confidential information gives the recipient no right to use the discloser's patents, copyright, trade marks or trade secrets beyond the Purpose. Good NDAs say so expressly and add that no rights arise by implication or estoppel. That protects you during a pilot, where your software sits on the customer's servers, and in diligence, where a buyer reviews your code. The flip side is that an NDA does not make anyone's output yours: if the parties will create something together, a joint development agreement must say who owns the results and in what field of use. A feedback clause, which lets the recipient use suggestions you volunteer about its product, is fair if limited and mutual.

Worked example

Clause 9 of the Tungabhadra NDA stated that nothing granted Tungabhadra any licence or interest in Saffron's intellectual property and that no right arose by implication or estoppel. When the pilot produced a custom shift report that Tungabhadra wanted to keep, ownership of that report was settled in the pilot agreement, not the NDA.

What is normal

A no-licence and reservation of rights clause in effectively every NDA; a feedback clause in around 3 of 10 software NDAs; IP ownership of joint outputs dealt with in a separate development or pilot agreement.

Watch out for

A feedback clause wide enough to capture your roadmap; a joint development project run under an NDA alone, with no agreement on who owns the output; a residuals clause that in effect licenses what the recipient remembers.

In India

Copyright vests in the author under Section 17 of the Copyright Act 1957 and passes only by a written assignment under Section 19; a licence must also be in writing. An NDA that is silent on IP transfers nothing, which is the correct position for the discloser.

Copy link to this term

Field of useIn a partnership or joint development NDA, the defined market or application within which each party may use shared information or jointly developed results.

Also called: Field restriction, Permitted field, Scope of use

In plain English

When two companies develop something together or share technology for a partnership, the NDA or the development agreement often limits each party to a field: one may use the results for automotive plants, the other for pharmaceutical plants, for example. The field of use works alongside the Purpose: the Purpose limits what the information may be used for during the project, the field limits where each party may exploit the results afterwards. For a startup partnering with a large company, a field clause stops the partner taking the joint output into your core market. Define the field by industry, geography and product, and say what happens to improvements each party makes alone.

Worked example

When Saffron and a sensor manufacturer discussed a joint shop-floor analytics module in 2027, the mutual NDA was amended to add a field of use: Saffron could exploit the results in workflow software for discrete manufacturing, the partner in sensor hardware and firmware, with neither entering the other's field for 3 years after the project.

What is normal

Found in joint development and partnership NDAs, rarely in pilots or vendor NDAs; fields defined by industry and product; 2 to 5 year restriction after the project; background IP stays with its owner.

Watch out for

A field clause that restricts you from your own existing market; no rule on improvements, so each party claims the other's; a field restriction so wide it becomes a non-compete and risks Section 27.

In India

A field of use restriction on jointly developed IP is a licence term, not a restraint of trade, provided it governs use of the shared results rather than the party's trade generally; drafted too widely it can be challenged under Section 27 of the Indian Contract Act 1872.

Copy link to this term

Obligations and limits

What the receiving party must do, who it may tell, and when the duties end

Standard of careHow carefully the recipient must protect the information: at least the same care as for its own secrets, and never less than reasonable care.

Also called: Degree of care, Duty of care clause, Reasonable care standard

In plain English

The clause sets the benchmark for how the information is guarded. The common formulation is the same degree of care the recipient applies to its own confidential information of a similar nature. On its own that lets a careless company protect your data carelessly, so good drafting adds a floor: and in no event less than a reasonable degree of care. Acquisition NDAs with a listed recipient sometimes raise the bar to the care applied to its own most sensitive information. Specific controls, ISO 27001 certification, encryption standards, penetration tests, belong in the pilot or services agreement where they can be priced, not in the NDA.

Worked example

Clause 4 of the Tungabhadra NDA required the same care as for its own information and in no event less than reasonable care, including appropriate technical and organisational measures. Clause 3 of the Kaveri agreement raised the standard to the care Kaveri applied to its own most sensitive information, since a listed buyer already runs insider-trading controls.

What is normal

Same care as own information in effectively every NDA; a reasonable care floor in around 6 of 10; a most sensitive information standard in about a third of acquisition NDAs; specific security standards in the main contract rather than the NDA.

Watch out for

A standard with no floor; a standard tied to a certification you do not hold when you are the recipient; an obligation to notify a breach within 24 hours, which is too short to confirm an incident.

In India

The DPDP Act 2023 separately requires reasonable security safeguards for personal data, with penalties for a data fiduciary of up to ₹250 crore for failing to take them; the NDA standard and the statutory standard should be aligned where personal data is involved.

Copy link to this term

Need to knowThe rule that the recipient may share the information only with people who need it for the Purpose.

Also called: Need-to-know basis, Restricted circulation

In plain English

Need to know is the internal limit on how far your information travels inside the other organisation. The plant head and the IT team who will run the pilot need it; the whole procurement department does not. In an acquisition the deal team and its advisers need it; the recipient's sales division does not. The clause works with the Representatives definition, which says which categories of people may receive the information at all, and with the clean team concept, which carves out the most sensitive categories for a smaller named group. Ask for a list of recipients on request; it costs nothing and makes a leak traceable.

Worked example

Under clause 5 of the Tungabhadra NDA, Saffron's roadmap could go to the plant managers and IT staff running the pilot and to Tungabhadra's system integrator under its own NDA, but not to the procurement team evaluating rival vendors. Tungabhadra provided a list of 11 named recipients on request.

What is normal

In effectively every NDA; a right to a list of recipients on request in around half of acquisition NDAs and a quarter of commercial ones; in acquisition NDAs the need-to-know rule is reinforced by a clean team for competitively sensitive information.

Watch out for

A Representatives definition so wide that need to know means nothing; disclosure to affiliates that compete with you; no record of who received the information, so a leak cannot be traced.

In India

Need to know is also the standard under the SEBI (Prohibition of Insider Trading) Regulations 2015 for sharing unpublished price sensitive information inside a listed company, which is why a listed recipient's compliance team will accept the clause readily.

Copy link to this term

RepresentativesThe recipient's directors, employees, advisers, affiliates and sometimes lenders who may receive the information, for whom the recipient is liable.

Also called: Authorised recipients, Permitted recipients, Authorised persons

In plain English

The Representatives definition lists who the recipient may share the information with: its own directors, officers and employees, its professional advisers, its affiliates, and in a pilot its subcontractors or in an acquisition its financiers. Three conditions apply: each must need the information for the Purpose, each must be bound by written confidentiality obligations or professional duties, and the recipient must be liable for their conduct as if it were its own. That last point is what makes the clause work: you sue the counterparty, not its consultant. In acquisition NDAs the seller usually requires consent before any lender or co-investor is added and a list of advisers on request.

Worked example

Clause 4 of the Kaveri agreement allowed disclosure to Kaveri's directors, employees, legal, financial, accounting and technical advisers and, only with Saffron's written consent naming each one, to lenders and co-investors. Kaveri was liable for all of them. Competing business units were excluded except through the clean team.

What is normal

Employees, advisers and affiliates in every NDA; subcontractors in around two thirds of pilot NDAs; financiers only with consent in around 7 of 10 seller-drafted acquisition NDAs; recipient liability for Representatives as standard, with a weaker procure compliance wording in buyer and large-company drafts.

Watch out for

A weaker obligation to use reasonable efforts to procure compliance instead of liability; lenders and co-investors added without consent; affiliates that compete with you included without a clean team.

In India

Affiliate is usually defined by reference to control under Section 2(27) of the Companies Act 2013 or the SHA's own definition; professional advisers such as advocates and chartered accountants are bound by professional duties of confidence, so no separate undertaking is needed.

Copy link to this term

Affiliates in an NDAGroup companies of the recipient that may receive the information as Representatives, and the risk when one of them competes with you.

Also called: Group companies, Related entities

In plain English

Most NDAs let the recipient share information with its affiliates, meaning companies that control it, are controlled by it or are under common control. For a conglomerate counterparty that can be dozens of companies, one of which may compete with you. Two protections help: a sentence that no disclosure may be made to an affiliate that competes with the discloser without consent, and, in acquisitions, a clean team that keeps competitively sensitive information away from any competing business unit. Also check that the entity signing is the one that will receive the information; if the plants belong to a subsidiary, bring it in as a party or a Representative.

Worked example

Tungabhadra's group included an industrial automation subsidiary that sold shop-floor software. Clause 5 of the mutual NDA barred disclosure of Saffron's information to any affiliate that competed with Saffron without written consent, which kept the automation subsidiary out of the pilot.

What is normal

Affiliates included as Representatives in most NDAs; a competing-affiliate restriction in a minority of pilot NDAs and in most acquisition NDAs where the buyer is a strategic competitor; affiliate defined by control.

Watch out for

An affiliate definition that reaches portfolio companies of a fund recipient; disclosure to a captive technology arm; a group procurement company signing while the operating subsidiary receives the data.

In India

Control is usually defined by reference to Section 2(27) of the Companies Act 2013; for a listed recipient, related party rules under the SEBI (Listing Obligations and Disclosure Requirements) Regulations 2015 may separately govern dealings with the affiliate.

Copy link to this term

Permitted disclosureDisclosures the NDA allows without breach: to Representatives on a need-to-know basis, and to named categories such as existing investors, lenders or insurers.

Also called: Authorised disclosure, Permitted recipients clause

In plain English

Beyond Representatives, many NDAs list categories of people to whom the recipient may disclose without consent: existing investors and their advisers, lenders, insurers, auditors, and in a term sheet the investor's limited partners. Each permitted recipient should be bound by confidentiality and should receive only what its function requires. In a customer pilot a permitted disclosure list is unusual and should be short; in an acquisition or a fundraising it is standard. The clause interacts with compelled disclosure, which covers disclosures the law requires, and with the clean team, which narrows permitted recipients for the most sensitive information.

Worked example

The Tungabhadra NDA had no separate permitted disclosure list beyond Representatives. The Kaveri agreement allowed Saffron, as the reverse obligation on the fact of discussions, to tell its shareholders, Representatives and other bidders, each bound by confidentiality. Marigold's term sheet confidentiality clause had earlier allowed Marigold to inform its limited partners and advisers.

What is normal

Standard in acquisition and fundraising NDAs; unusual in pilots; permitted recipients bound by confidentiality in every good draft; disclosure limited to what the recipient's function requires.

Watch out for

A permitted disclosure list that includes prospective investors or potential acquirers of the recipient; a list with no confidentiality condition; disclosure to any affiliate without need to know.

In India

No statutory list; the categories are contractual. For a listed recipient, disclosure to the stock exchanges under the SEBI (Listing Obligations and Disclosure Requirements) Regulations 2015 is a compelled, not a permitted, disclosure and should be routed through that clause with consultation.

Copy link to this term

Compelled disclosureA carve-out allowing disclosure required by law, a court, a regulator or a stock exchange, with notice, consultation and a minimum-necessary rule.

Also called: Required by law exception, Legally compelled disclosure, Disclosure under legal process

In plain English

No recipient can promise to defy a court, so every NDA allows disclosure that the law requires. The value for the discloser is in the conditions: prompt notice before disclosure where lawful, so you can seek a protective order; consultation on content and timing; disclosure of only what counsel advises is legally required; and reasonable efforts to obtain confidential treatment from whoever receives the information. A sentence that the information remains confidential for all other purposes stops a disclosure to a tax officer being treated as publication. For a listed recipient, disclosure to the stock exchanges under the listing regulations runs through this clause with consultation.

Worked example

Clause 6 of the Tungabhadra NDA allowed disclosure required by law, court order, regulator or stock exchange rules, with prompt notice, consultation, minimum necessary and confidential treatment conditions. In 2027 a GST officer sought Tungabhadra's vendor evaluation file; Tungabhadra gave Saffron 5 days' notice and produced the commercial summary without the technical annex.

What is normal

In effectively every NDA; notice where lawful and minimum necessary in most; consultation and confidential treatment in around 6 of 10; a fixed notice period, 5 business days, in a minority; a weak version with no notice in around a quarter of procurement templates.

Watch out for

Disclosure whenever required by law with no notice; disclosure where the recipient considers it required; no sentence preserving confidentiality for other purposes after the compelled disclosure.

In India

Common triggers are notices under the Income-tax Act, the CGST Act 2017, labour inspections and court summons under the Code of Civil Procedure 1908; for a listed recipient, Regulation 30 of the SEBI (Listing Obligations and Disclosure Requirements) Regulations 2015 can require disclosure of a material acquisition.

Copy link to this term

Reverse engineeringAnalysing software, a sample or equipment to learn how it works; barred by a specific clause whenever your product sits on the other side's systems.

Also called: Decompilation, Disassembly, Reverse analysis

In plain English

A pilot puts your software on the customer's network, a diligence process may give a buyer's engineers a look at your code, and a hardware partnership hands over samples. In each case the counterparty could learn your methods by taking the thing apart rather than by reading documents, and a plain confidentiality duty may not cover that. A no reverse engineering clause bars decompiling, disassembling or otherwise deriving the source code, structure, algorithms or process parameters of anything made available. For technical diligence, agree a written protocol instead: on-screen code review in a controlled environment, no copies, a named reviewer list.

Worked example

Clause 4(d) of the Tungabhadra NDA barred reverse engineering of the pilot software installed on Tungabhadra's servers. Clause 3(d) of the Kaveri agreement barred analysis of Saffron's code except as expressly permitted in writing; Kaveri's technical diligence proceeded under a protocol allowing two named engineers to review code on screen in Saffron's office.

What is normal

In most NDAs where software, samples or equipment change hands; absent from pure services NDAs; in acquisitions, replaced or supplemented by a written code review protocol with 2 to 4 named reviewers.

Watch out for

A clause barring analysis of data, which would prevent a buyer from evaluating the business at all; no clause at all when a binary or a sample is handed over; a permission to reverse engineer for interoperability that is wider than needed.

In India

Section 52(1)(ab) and (ac) of the Copyright Act 1957 permit certain acts for interoperability and for studying a program's functioning, so a contractual bar is what closes that door; the bar is a use restriction, not a restraint of trade, and is generally treated as enforceable between the parties.

Copy link to this term

Return or destructionThe duty to give back or securely destroy the information, including copies and notes, at the end or on request, and to certify that it has been done.

Also called: Return of information, Destruction clause, Return or destroy

In plain English

When the pilot ends, the deal dies or the discloser simply asks, the recipient must return or destroy everything it received, including its own notes and analyses built on the information, erase electronic copies and certify compliance through an officer. Deadlines of 10 to 30 days are usual. Two exceptions are market standard: one archival copy held by the legal or compliance function for regulatory purposes, and copies in automatic backups until they are overwritten, all of which remain confidential while they exist. The election between return and destruction should be the discloser's. Send the request the day the relationship ends and file the certificate.

Worked example

Clause 8 of the Tungabhadra NDA required return or destruction within 15 days of a request or 30 days of the end of the pilot, with an officer's certificate. Clause 11 of the Kaveri agreement tightened this to 10 days from a request or from the end of discussions, since a competitor's deal team moves on quickly.

What is normal

Return or destroy at the discloser's election within 10 to 30 days; an officer's certificate in around 7 of 10 templates; archival and backup exceptions in most templates drafted since 2015, with the archival copy held by legal or compliance.

Watch out for

An exception for information the recipient needs to protect its position, which can justify keeping everything; no certificate; no deadline; the recipient's own board papers excluded without redaction of your data.

In India

Where personal data is involved, erasure at the end of the purpose is also a statutory duty under the DPDP Act 2023 for the data fiduciary and, through the contract, the processor; a certificate of destruction is good evidence of compliance with both regimes.

Copy link to this term

Archival copyThe one copy the recipient's legal or compliance function may keep after return or destruction, for regulatory and record-keeping purposes only.

Also called: Retained copy, Compliance copy, Legal hold copy

In plain English

Large companies cannot destroy everything: securities law, audit requirements and litigation holds require them to show what they held and when. So the return or destruction clause allows one archival copy, held by the legal or compliance function, used only for compliance and never for business purposes, and still subject to the NDA for as long as it is kept. For a listed buyer the exception has a specific justification: its insider-trading records under the SEBI (Prohibition of Insider Trading) Regulations 2015 must show what information it received. The exception is harmless if it is narrow; it is dangerous if it lets the deal team keep its models.

Worked example

Clause 11 of the Kaveri agreement allowed one archival copy in the custody of Kaveri's legal or compliance function to the extent required by law, regulation or internal compliance policies, expressly including the PIT Regulations, and copies in backups until overwritten, all remaining confidential while retained. Kaveri's deal team kept nothing.

What is normal

Present in most templates since 2015; held by legal or compliance in good drafts; limited to compliance purposes; the backup exception alongside it; a few drafts also allow retention of board papers, which should be redacted.

Watch out for

An archival copy held by the deal team or the business; a right to retain information to evidence the recipient's rights; no statement that the retained copy stays confidential.

In India

Record-keeping obligations that justify the exception include the Companies Act 2013 (books and papers for 8 years under Section 128), the Income-tax Act and the PIT Regulations' structured digital database, which must be preserved for at least 8 years.

Copy link to this term

Certificate of destructionA signed confirmation from an officer of the recipient that all Confidential Information has been returned or destroyed as the NDA requires.

Also called: Destruction certificate, Certificate of compliance, Return certificate

In plain English

The certificate is a short letter signed by an authorised officer of the recipient confirming that the information has been returned or destroyed, electronic copies erased, and the only retained items are those the NDA permits. It matters for two reasons. It forces the recipient to actually do the work, because an officer will not sign without checking. And it is evidence: if your information surfaces later, a false certificate turns a contract dispute into something an officer signed personally. Ask for it every time, name the officer, file it with the NDA in your register, and send your own when you are the recipient.

Worked example

Had discussions with Kaveri ended before the term sheet, Saffron would have sent a return request under clause 11 the same day and expected, within 10 days, a certificate signed by Kaveri's company secretary confirming destruction of all data room downloads and models, with one archival copy retained by its compliance function.

What is normal

Required in around 7 of 10 templates; signed by an officer, often the company secretary or general counsel; delivered within the return or destruction window of 10 to 30 days; one page.

Watch out for

A certificate signed by a junior employee; a certificate that does not list the retained items; no certificate requested because the relationship ended amicably, which is exactly when it is cheapest to get.

In India

Where personal data is involved, the certificate is evidence of erasure under the DPDP Act 2023 for both the fiduciary and the processor; a false certificate by an officer could also attract Section 72A of the Information Technology Act 2000 if personal information was in fact disclosed in breach of contract.

Copy link to this term

Term and survivalThe term is how long disclosures are covered; survival is how long the duty of secrecy lasts after the term ends. Two clocks, often confused.

Also called: Duration, Survival period, Confidentiality period

In plain English

The term of the NDA is the disclosure window: information handed over during it is protected, and anything disclosed after it ends is not unless the agreement is renewed. Survival is how long the recipient must keep the information secret after the term expires or is terminated. A 2-year term with 3-year survival means the duty on the last disclosure runs for 5 years from signing. Trade secrets are usually carved out to be protected while they remain secret, and personal data while it is held. Early termination on notice ends the term, not the survival. Check that the clause lists which other provisions survive: return, non-solicit, remedies and legal.

Worked example

Clause 10 of the Tungabhadra NDA: term 2 years from the Effective Date, early termination on 30 days' notice, survival 3 years from expiry, trade secrets while secret, personal data while held. The Kaveri agreement used the same shape, with the standstill and non-solicit on their own 18-month clock from signing, listed as surviving clauses.

What is normal

Term 2 to 3 years; survival 3 to 5 years from expiry; 1-year terms in vendor evaluations; 5-year survival in regulated sectors; a while-secret carve-out for trade secrets in most modern templates; perpetual obligations on all information unusual and resisted.

Watch out for

Survival running from each disclosure instead of from expiry, which is unworkable to track; no survival at all, so obligations end with the term; a survival clause that forgets to list the standstill and non-solicit, so they die at expiry.

In India

A suit for breach of contract must be filed within 3 years of the breach under the Limitation Act 1963; the survival period governs when the duty exists, the limitation period governs how long you have to sue once it is broken.

Copy link to this term

Term versus survival: the worked timelineHow the term, the survival period, the trade secret carve-out and the non-solicit clock line up on a calendar.

Also called: Confidentiality timeline, NDA clocks

In plain English

Founders sign a 2-year NDA and assume everything ends in 2 years. It does not. Put the dates in your register: the effective date, the expiry of the term, the end of survival for ordinary information, and separate end dates for any non-solicit or standstill that runs from signing rather than from expiry. Trade secrets and personal data have no end date on the calendar; they end when the secret becomes public or the data is erased. Disclosures made after the term expires are unprotected unless you renew, so set a reminder 60 days before expiry to decide whether to extend. A one-page register of NDAs with these dates is the cheapest compliance tool a startup can run.

Worked example

Tungabhadra NDA signed 5 January 2026: term ends 5 January 2028, survival for ordinary information ends 5 January 2031, employee non-solicit ends 12 months after expiry on 5 January 2029, source code protected while secret. Kaveri agreement signed 10 January 2029: term ends 10 January 2031, survival ends 10 January 2034, standstill and non-solicit end 10 July 2030.

What is normal

A register of NDAs with effective date, expiry, survival end and non-solicit end dates is maintained by most funded startups' finance or legal teams; renewal of pilot NDAs by a one-page amendment is common where a contract follows.

Watch out for

Continuing to disclose after the term has expired; a non-solicit that runs from expiry in one draft and from signing in another, so the dates differ by the length of the term; forgetting that early termination does not shorten survival.

In India

No statutory periods; all contractual. The Limitation Act 1963 gives 3 years from a breach to sue, so a breach in the last year of survival can be litigated up to 3 years after survival ends.

Copy link to this term

Perpetual confidentialityAn obligation with no end date; appropriate for trade secrets while they remain secret, unreasonable for ordinary business information.

Also called: Indefinite confidentiality, Evergreen obligation, No sunset

In plain English

A perpetual obligation says the recipient must keep the information secret forever. For true trade secrets that is right: a process recipe or a source code base does not become fair game after 5 years. For ordinary business information, pricing that changes every quarter, a roadmap that is public within a year, it is unreasonable and large counterparties resist it because they cannot track an obligation with no end. The market compromise is a fixed survival period of 3 to 5 years for everything, with a carve-out that trade secrets identified by the discloser are protected for as long as they remain secret. That gives you perpetual protection where it matters and a clean end date everywhere else.

Worked example

A buyer's draft received by Saffron in 2028 proposed a 2-year survival for all information with no carve-out, which would have freed Saffron's scheduling algorithm by 2032. Saffron countered with the Tungabhadra formulation: 3-year survival for ordinary information and while-secret protection for source code and process know-how identified as trade secrets. The buyer accepted.

What is normal

Perpetual obligations on all information in a minority of templates and often negotiated down; a while-secret carve-out for trade secrets in most modern NDAs; 3 to 5 year fixed survival for everything else.

Watch out for

Perpetual obligations imposed on you as recipient for ordinary information, which your team cannot track; a trade secret carve-out that depends on written designation you never make; a counterparty refusing any carve-out when you are disclosing code.

In India

A perpetual confidentiality obligation is not a restraint of trade under Section 27 of the Indian Contract Act 1872 and is enforceable, but a court granting an injunction decades later will ask whether the information is still secret; if it is public, the obligation has nothing left to protect.

Copy link to this term

Residual knowledge clauseA clause letting the recipient use whatever its people retain in unaided memory; for a software vendor it can swallow the whole agreement.

Also called: Residuals clause, Residuals, Unaided memory exception

In plain English

A residuals clause says the recipient may freely use information retained in the unaided memory of its employees who had access, without reference to documents. Large technology companies insist on it to protect engineers who see many vendors from accidental infringement claims. For a startup disclosing architecture, data models and pricing logic, all of which a good engineer remembers without notes, the clause removes the protection the NDA was meant to give. The best answer is an express exclusion of residuals, as in Saffron's agreements. If a large platform partner insists, limit it: carve out source code, pricing, customer data and personal data; exclude intentional memorisation; state that no patent or copyright licence arises; and reduce what you disclose.

Worked example

Clause 12 of the Tungabhadra NDA expressly excluded any residuals exception while allowing the use of general skills and experience that did not use or disclose Confidential Information. When a global platform partner later insisted on residuals in 2027, Saffron agreed only with source code, pricing and customer data carved out and intentional memorisation excluded.

What is normal

Present in perhaps 1 in 5 Indian commercial NDAs but in most templates from large global technology companies; an express exclusion in around a third of vendor-side templates; where residuals survive, the standard limits are no intentional memorisation, no use of code, pricing or personal data, and no IP licence.

Watch out for

Residuals disguised as an exclusion for information retained in memory or generally known in the industry; a residuals clause combined with a marking requirement; a residuals clause in a freelancer or developer agreement, where it hands over the architecture.

In India

No Indian case law specific to residuals; the clause is enforced as drafted. Because India has no trade-secrets statute, a residuals clause removes the only protection you have for what the recipient's staff remember, which is why Indian counsel treat it as the most dangerous clause in a template.

Copy link to this term

Employee non-solicit in an NDAA promise by each party not to poach the other's staff who worked on the project for 12 to 18 months; usually enforceable in India because it restrains the company, not the employee.

Also called: Non-solicitation of employees, No-poach clause, No-hire clause

In plain English

A pilot or a diligence process shows the counterparty exactly who your best people are. A non-solicit clause stops it recruiting them, and a no-hire version stops it hiring them even if they apply, for a period after the relationship ends. It is usually enforceable in India because it restrains the counterparty, not the employee: the engineer remains free to seek any job, and courts have generally not treated such a clause as a restraint of trade under Section 27 of the Indian Contract Act 1872. A no-hire limb is less certain than a no-solicit limb: in Wipro v Beckman Coulter (2006) the Delhi High Court stopped further solicitation but would not stop the hiring of staff who applied, leaving the claim to damages. The standard exceptions are general advertisements not aimed at the other side and people who left more than 6 months earlier. Limit it to employees with material contact so that it is proportionate, and make it mutual where fair.

Worked example

Clause 11 of the Tungabhadra NDA barred either party, for 12 months after expiry, from soliciting or hiring employees of the other with whom it had material contact, with general advertising and 6-month exceptions. Clause 8 of the Kaveri agreement extended this to 18 months from signing, named key employees in a schedule and added a customer limb.

What is normal

12 to 18 months in commercial NDAs and 18 to 24 months in acquisition NDAs; limited to employees with material contact in around half of templates; no-hire wording in around 4 of 10 pilot NDAs and most acquisition NDAs; general advertising exception near-universal.

Watch out for

A non-solicit that is really a non-compete, barring the counterparty from your market; a one-way clause when both teams work together; a period longer than 24 months, which a court may find unreasonable; a clause binding individual employees rather than the company.

In India

Non-solicitation of employees and customers for a reasonable period is generally treated as enforceable because it does not restrain the restricted party's own trade; the reasoning in Niranjan Shankar Golikari v. Century Spinning (1967) distinguishing restraints during and after a relationship is the usual starting point.

Copy link to this term

Special situations

Acquirers, listed buyers, personal data and data rooms

StandstillA promise by a potential acquirer not to approach the target's shareholders, customers, suppliers or employees, or make an offer, except through the agreed process, for a fixed period.

Also called: Standstill undertaking, No-approach clause, Process protection

In plain English

Once a buyer has seen your cap table and your customer list, it could go around you: offer to buy Marigold's stake directly, email your angels, or tell your largest customer it is about to own you. A standstill stops that for a fixed period, usually 12 to 18 months. The buyer may deal only with the named founders or deal team, may not make or announce an offer outside the process, may not do side deals with shareholders about voting or transferring shares, and may not try to influence the board. It falls away if you sign a sale of control to someone else. In a listed-target deal a standstill also stops the buyer building a stake on market; for a private target like Saffron it is pure contract.

Worked example

Clause 7 of the Kaveri agreement imposed an 18-month standstill from 10 January 2029: no contact with Saffron's shareholders, customers, suppliers, lenders or employees about the company except through Ananya Rao and Vikram Menon, no offer outside the process, no agreements with shareholders, no attempt to influence the board, falling away on a signed sale of control to a third party.

What is normal

12 to 18 months in most seller-drafted acquisition NDAs for private targets, 24 months where the shareholder base is large; contact routed through named founders; fall-away on a signed sale to a third party in around half of drafts; a customer and supplier contact bar where the buyer is a competitor.

Watch out for

A standstill that falls away on a mere announcement or on the end of discussions; no bar on side agreements with shareholders, which lets the buyer pick off your angels; a standstill that also binds you, which is pointless in a one-way NDA.

In India

For an unlisted target the SEBI (Substantial Acquisition of Shares and Takeovers) Regulations 2011 do not apply and no public offer is possible, so the standstill is purely contractual and enforceable by injunction. Because Indian law follows privity of contract, the shareholders who are meant to enforce it should sign, as parties or by a deed of adherence; signing as trustee for them is a fallback, not a guarantee.

Copy link to this term

Clean teamA small named group of the buyer's advisers and non-commercial staff who alone may see competitively sensitive information such as pricing, customer contracts and individual pay, until signing.

Also called: Clean room, Clean team arrangement, Competitively sensitive information protocol

In plain English

When the buyer competes with you, its sales and pricing staff must never see your customer contracts, discount matrix or pipeline, because if the deal dies they will use what they learned and no injunction can make them forget. A clean team arrangement routes that information only to the buyer's external advisers and a few named employees who make no commercial decisions in the competing business. They report to the deal team only in aggregated or redacted form approved by your counsel, and the full information is released on signing or at completion. The arrangement also manages competition law risk: exchanging pricing between competitors before a deal completes can look like coordination, and a clean team is the accepted way to avoid that.

Worked example

Clause 5 of the Kaveri agreement defined Competitively Sensitive Information as customer identities and contract terms, pricing, discounts and pipeline, and individual employee compensation, disclosed only to a clean team of Kaveri's external advisers and three named corporate development and finance staff approved by Saffron, with aggregated summaries to the deal team until signing on 15 March 2029.

What is normal

Present in most acquisition NDAs where the buyer is a direct competitor; external advisers plus 2 to 5 non-commercial employees; aggregated reporting approved by the seller's counsel; release at signing in most drafts, at completion in some; individual undertakings from each clean team member.

Watch out for

A clean team that includes the buyer's head of sales because he is on the deal team; summaries not approved by your counsel; release of identities before signing; no clean team at all because the buyer says it is not a competitor when it sells into the same customers.

In India

The Competition Act 2002 can treat coordination between competitors before completion as an anti-competitive agreement under Section 3, whether or not the deal needs CCI approval. For a deal that must be notified, Section 6(2A) also bars completion until the CCI approves it or 150 days pass, and Section 43A allows a penalty of up to 1 percent of turnover, assets or deal value for failing to notify. A clean team is the accepted safeguard. Saffron's sale needed no CCI filing because Saffron fell within the small-target exemption in the Competition (Minimum Value of Assets or Turnover) Rules 2024 (assets in India up to ₹450 crore or turnover in India up to ₹1,250 crore) and the ₹450 crore price was below the ₹2,000 crore deal value threshold, but the Section 3 risk remains. Check the thresholds in force on the day you sign.

Copy link to this term

Data room and click-through termsThe virtual data room's own online terms govern only the platform; the NDA must say it prevails over them and that circumventing the room's controls is a breach.

Also called: Click-wrap terms, Data room rules, VDR terms

In plain English

Diligence runs through a virtual data room whose provider presents click-through terms to every user. Those terms are written to protect the provider, and because they are accepted after the NDA, a buyer could argue they replaced it. The NDA should say that click-through terms govern only the use of the platform, that the NDA prevails in any conflict, and that the room's access rules on printing, downloading and screen capture are contractual obligations, so a phone photograph of the screen is a breach. Where the information is sensitive, disable downloads for customer contracts and source code, and make the data room index part of the disclosure record so that what was disclosed is provable later.

Worked example

Clause 6 of the Kaveri agreement provided that the data room provider's click-through terms governed only the platform, that the agreement prevailed in any inconsistency, and that Kaveri would not circumvent any technical control. Downloads were enabled only for the management accounts folder; customer contracts and the code review were view-only.

What is normal

A prevail-over-click-through sentence in most acquisition NDAs since virtual data rooms became standard; compliance with access rules and no circumvention as standard; downloads enabled for financial folders and disabled for contracts and code in most seller-run processes.

Watch out for

A data room opened before the NDA is signed; click-through terms that grant the provider a licence over your documents; a buyer that insists on bulk download for its model, which defeats the room's controls.

In India

Click-through terms are enforceable in India as electronic contracts under Section 10A of the Information Technology Act 2000, which is why the NDA must expressly override them; the data room index is also the usual record of what was fairly disclosed for the share purchase agreement's warranty regime.

Copy link to this term

Personal data under the DPDP Act in an NDAWhere the information includes personal data, the Digital Personal Data Protection Act 2023 adds statutory duties the NDA must sit alongside, including a written processor contract.

Also called: DPDP clause, Personal data clause, Data protection clause

In plain English

An NDA treats personal data as a secret; the Digital Personal Data Protection Act 2023 treats it as something the individual has rights over. Both apply at once. The company that decides why and how the data is processed is the data fiduciary; a company processing it on the fiduciary's behalf is a data processor and may be engaged only under a valid written contract. The NDA should identify the roles, require reasonable security safeguards, set a breach notification duty between the parties, limit cross-border transfer to what the Act permits, and require erasure when the purpose is served. The Rules notified on 13 November 2025 phase obligations in over 12 to 18 months, with most applying from around 13 May 2027, so pilots signed in 2026 often say each party will comply as provisions come into force.

Worked example

Clause 7 of the Tungabhadra NDA made each party the fiduciary for its own employees' data, made Saffron the processor for Tungabhadra's shift and attendance data under a separate written contract signed before any transfer, required breach notice without undue delay, barred transfer outside India except as permitted, and required erasure at the end of the pilot.

What is normal

A personal data clause in most NDAs where employee or customer data will be handled; a processor contract or schedule where one party processes for the other; breach notice between parties within 24 to 72 hours; erasure at the end of the purpose or within 30 to 90 days.

Watch out for

An NDA that treats the processor contract as unnecessary because the NDA covers confidentiality; a 24-hour breach notice you cannot meet; no right to retain anonymised data, so the pilot teaches your product nothing; cross-border transfer to a cloud region the Act may not permit.

In India

The DPDP Act 2023 is coming into force in stages from 13 November 2025, when the Rules were notified, and most duties of data fiduciaries, including security safeguards, breach notification, processor contracts and erasure, apply from around 13 May 2027. Section 8(2) requires a valid contract where a processor works on activities related to offering goods or services to individuals; an employer's own staff data sits awkwardly with that wording, but the fiduciary stays responsible for its processor under Section 8(1) and Rule 6 expects safeguards to be written into the processor contract, so sign one anyway. Penalties for a fiduciary run up to ₹250 crore for security failures. Section 72A of the Information Technology Act 2000 remains a backstop for disclosure in breach of contract, now a penalty of up to ₹25 lakh.

Copy link to this term

Data fiduciaryUnder the DPDP Act, the person who alone or with others decides the purpose and means of processing personal data; it carries the statutory duties.

Also called: Controller (in other jurisdictions), Fiduciary

In plain English

The data fiduciary is the company responsible for the personal data: it decides why the data is processed and how, obtains consent or relies on a legitimate use, gives notice to the individuals, implements security safeguards, notifies breaches to the Data Protection Board and to affected individuals, erases data when the purpose is served, and answers for its processors. In a customer pilot the customer is the fiduciary for its employees' data; in an acquisition the target is the fiduciary for its employee files until completion. The fiduciary's duties are statutory and cannot be shifted onto the processor by contract, though the contract can make the processor liable to the fiduciary for its failures.

Worked example

Tungabhadra was the data fiduciary for the shift and attendance data of its plant workers. Once the Act's fiduciary duties apply, from around 13 May 2027, it must have a lawful basis to let Saffron process the data, give its employees notice, and carry the duty to notify the Data Protection Board if Saffron reports a breach. Saffron's NDA obligations ran to Tungabhadra, not to the employees directly.

What is normal

Roles identified expressly in most NDAs and pilot agreements involving personal data since the Act; the customer as fiduciary for its own employees and customers; each party as fiduciary for its own staff; a processor schedule where one party processes for the other.

Watch out for

A clause that purports to make the vendor the fiduciary for the customer's employee data, which does not match reality and misallocates statutory duties; a fiduciary that has not given its employees notice, leaving the processor handling data with no lawful basis.

In India

Defined in Section 2(i) of the Digital Personal Data Protection Act 2023; duties in Sections 4 to 10 including notice, consent or legitimate use, security safeguards, breach notification and erasure; a Significant Data Fiduciary notified by the Central Government carries additional duties such as a data protection officer and audits.

Copy link to this term

Data processorUnder the DPDP Act, a person who processes personal data on behalf of a data fiduciary, which may engage it only under a valid contract.

Also called: Processor, Service provider (data)

In plain English

A data processor handles personal data for a fiduciary and on its instructions: a payroll vendor, a cloud host, a software company running a pilot on the customer's employee data. From around 13 May 2027 the fiduciary stays responsible for anything its processor does and must have the processor's safeguards in writing, so the written processor terms are a legal necessity, not a nicety. The contract typically covers processing only on documented instructions, security safeguards, assistance with breach notification and individual requests, sub-processors only with consent, return or erasure at the end, and audit or assurance rights. For a startup acting as processor, the practical points are a breach notice window you can meet, a right to retain anonymised data, and a liability cap that matches the pilot fee.

Worked example

Saffron acted as data processor for Tungabhadra's shift and attendance data under a processor schedule to the pilot agreement, processing only on Tungabhadra's written instructions, notifying any breach without undue delay and within 72 hours, hosting in an Indian cloud region, and erasing the data within 30 days of the pilot ending while retaining anonymised aggregates.

What is normal

A processor contract or schedule wherever one party processes for the other; breach notice to the fiduciary within 24 to 72 hours; sub-processors with consent or on a notified list; erasure within 30 to 90 days of the end; liability capped at 12 months of fees in most vendor negotiations.

Watch out for

Acting as processor under an NDA alone with no processor contract, which puts the fiduciary in breach of the Act from around 13 May 2027; an uncapped indemnity for data breaches in a pilot worth ₹10 lakh; processor terms that forbid anonymised retention, so the pilot teaches your product nothing.

In India

Defined in Section 2(k) of the Digital Personal Data Protection Act 2023; Section 8(2) permits a fiduciary to engage a processor only under a valid contract; the fiduciary remains responsible for compliance in respect of processing by its processors, which is why fiduciaries push liability into the contract.

Copy link to this term

Breach notification under the DPDP ActThe duty to report a personal data breach to the Data Protection Board and affected individuals, carried by the fiduciary, with a contractual duty on the processor to tell the fiduciary first.

Also called: Data breach notice, Incident notification

In plain English

Under the DPDP Act a personal data breach, meaning unauthorised processing, disclosure, loss or alteration of personal data that compromises confidentiality, integrity or availability, must be notified by the data fiduciary to the Data Protection Board of India and to each affected individual in the manner the Rules prescribe. The processor has no direct duty to the Board; its duty is contractual, to tell the fiduciary without undue delay so that the fiduciary can comply. The NDA or processor contract should set the window between the parties, 72 hours is workable, and what the notice must contain. A breach of the NDA that involves personal data is therefore two events: a contract breach and a statutory incident.

Worked example

Clause 7 of the Tungabhadra NDA required each party to notify the other without undue delay of any personal data breach affecting the other's data. Saffron's processor schedule fixed that at 72 hours with a description of the data, the individuals affected and the containment steps. Tungabhadra, as fiduciary, would carry the notification to the Board and its employees once that duty under the Act applies, from around 13 May 2027.

What is normal

Processor-to-fiduciary notice within 24 to 72 hours in most contracts; fiduciary notification to the Board and individuals in the form and time the DPDP Rules 2025 prescribe; a contractual duty to cooperate in the fiduciary's notification and any Board inquiry.

Watch out for

A 24-hour window you cannot meet with a two-person engineering team; a definition of breach so wide that every failed login is notifiable; no cooperation clause, so the fiduciary cannot get the facts it needs for its own notice.

In India

Section 8(6) of the Digital Personal Data Protection Act 2023 requires the fiduciary to give intimation of a personal data breach to the Board and each affected Data Principal; the DPDP Rules notified on 13 November 2025 prescribe the form, content and timing. Penalties for failing to notify run up to ₹200 crore.

Copy link to this term

Cross-border transfer under the DPDP ActPersonal data may be transferred outside India except to countries the Central Government restricts by notification, subject to the Rules; the NDA should say where the data will sit.

Also called: Data transfer restriction, Data localisation clause, Offshore hosting

In plain English

The DPDP Act permits transfer of personal data outside India except to countries or territories the Central Government restricts by notification, and the Rules may add conditions. For a pilot or a diligence process the practical question is where the data will physically sit: your cloud region, your offshore development team, the buyer's advisers abroad. The safest drafting during the phase-in period is either an India-only hosting commitment, which most Indian cloud regions make easy, or a transfer clause permitting named countries as permitted under the Act. Sectoral rules may be stricter: the Reserve Bank of India's payment data localisation directions, for example, apply regardless of the DPDP position.

Worked example

Clause 7 of the Tungabhadra NDA barred transfer of the customer's employee data outside India except as permitted under the DPDP Act; Saffron hosted the pilot in an Indian cloud region. Clause 6 of the Kaveri agreement applied the same limit to Saffron's employee data in the data room, which mattered because one of Kaveri's financial advisers worked from Singapore.

What is normal

An India-only or as-permitted-by-law transfer clause in most NDAs and processor schedules involving personal data since the Act; named-country lists where the counterparty's advisers or infrastructure are offshore; sector-specific localisation for payment and some financial data.

Watch out for

A silent clause when your cloud region or support team is outside India; a buyer's offshore advisers downloading employee files; a localisation commitment you cannot meet because your stack runs in a foreign region.

In India

Section 16 of the Digital Personal Data Protection Act 2023 permits transfer outside India except to countries restricted by Central Government notification; the DPDP Rules 2025 may impose conditions; sectoral localisation rules, such as the RBI's directions on payment system data, continue to apply.

Copy link to this term

Unpublished price sensitive information (UPSI)Information about a listed company or its securities that is not generally available and would be likely to affect the price if it were; a planned acquisition can be UPSI for the buyer.

Also called: UPSI, Price sensitive information, Inside information

In plain English

Under the SEBI (Prohibition of Insider Trading) Regulations 2015, unpublished price sensitive information is information relating to a listed company or its securities that is not generally available and that, once available, is likely to materially affect the price. The regulations list examples, including mergers, acquisitions and disposals. When a listed company looks at acquiring your startup, the fact of the talks and what it learns can be UPSI about its own shares. That is why a listed buyer's compliance team insists on an insider-trading acknowledgement in the NDA, logs every person who sees your data in its structured digital database, and controls the timing of any announcement. Your unlisted company has no UPSI of its own, but anyone on your side who knows of the talks may not trade in the buyer's shares or tip others.

Worked example

Kaveri's proposed acquisition of Saffron for ₹450 crore was material to Kaveri and so was UPSI for Kaveri's own shares. Clause 9 of the agreement had Kaveri acknowledge this, share the information only for legitimate purposes on a need-to-know basis, record recipients in its structured digital database, and close its trading window for the deal team.

What is normal

An insider-trading acknowledgement in most NDAs with a listed Indian recipient, usually drafted by its compliance team; the structured digital database and trading window commitments as standard; a sentence that the unlisted seller gives no undertaking about the buyer's compliance in around half of drafts.

Watch out for

Anyone on your side trading in the buyer's shares, or tipping a friend, while they know of the deal, which is insider trading even in a cash deal; a buyer that leaks the deal to analysts, forcing an early disclosure that unsettles your customers and team; no consultation right before the exchange announcement.

In India

Regulation 2(1)(n) of the SEBI (Prohibition of Insider Trading) Regulations 2015 defines UPSI; Regulation 3 bars communication except for legitimate purposes and requires the structured digital database under Regulation 3(5); Regulation 4 bars trading while in possession of UPSI; the listed company's code of conduct closes the trading window.

Copy link to this term

SEBI (Prohibition of Insider Trading) Regulations 2015The regulations that govern how a listed company and its insiders handle and trade on unpublished price sensitive information; they shape the NDA when the recipient is listed.

Also called: PIT Regulations, Insider trading regulations, SEBI PIT

In plain English

The regulations bar insiders from trading in a listed company's securities while in possession of UPSI, bar communication of UPSI except for legitimate purposes, require every listed company to maintain a structured digital database of the people with whom UPSI is shared, and require a code of conduct that closes the trading window around UPSI events. For an NDA the consequences are practical: a listed recipient will add an acknowledgement clause, will insist on need-to-know distribution, will record each of its advisers and employees who see your data, and will control the announcement of any deal. These compliance duties do not bind an unlisted discloser, and the NDA should say so, but the trading ban does: anyone on your side who knows of the deal is an insider for the buyer's shares, in a cash deal or a share deal.

Worked example

Clause 9 of the Kaveri agreement referenced the PIT Regulations by name, required Kaveri to maintain its structured digital database under Regulation 3(5), to prevent trading by persons in possession of the information, and to route any stock exchange disclosure through the compelled disclosure clause after consulting Saffron. Saffron gave no undertaking about Kaveri's compliance; the clause records that people on Saffron's side who knew of the deal could not trade in Kaveri shares, and doubles as Kaveri's notice to them under Regulation 3(2B) that they were insiders.

What is normal

Referenced expressly in most NDAs with a listed recipient; the acknowledgement usually drafted by the listed company's compliance officer; where the target itself is listed, the clause grows into a wall-crossing agreement with trading restrictions on both sides.

Watch out for

A clause that imports the buyer's entire code of conduct onto your founders; an obligation on you to maintain a structured digital database, which applies only to listed companies and their intermediaries; no named compliance officer on the buyer's side.

In India

Issued by SEBI under the SEBI Act 1992; Regulation 3(5) structured digital database introduced by the 2018 amendments and effective from April 2019, with preservation for 8 years; the codes of conduct bind listed companies, intermediaries and fiduciaries; an unlisted target and its shareholders carry no such duties, but once they know of the deal they are insiders, so the bans on trading and on passing on UPSI apply to them.

Copy link to this term

Structured digital databaseThe tamper-proof register a listed company must keep under Regulation 3(5) of the PIT Regulations, recording who received UPSI, when and from whom.

Also called: SDD, UPSI database, Regulation 3(5) database

In plain English

Every listed company must maintain an internal structured digital database with time-stamped, audit-trailed, non-tamperable records of the nature of UPSI shared, the names and PAN or other identifiers of the persons who received it, and the person who shared it. When a listed company looks at acquiring your startup, every adviser, banker and employee who sees your data room is logged. For you this is helpful discipline: a leak can be traced to a name. It also explains why a listed buyer cannot agree to destroy every record of the process; the database is a regulatory record kept for at least 8 years, which is a legitimate archival copy exception in the NDA.

Worked example

Kaveri logged 23 persons in its structured digital database for the Saffron transaction between January and March 2029: its deal team, two external law firms, a financial adviser, its auditors, a lender's team and, as recipients of the deal itself, Saffron's founders and counsel. When Saffron asked for a list of Representatives under clause 4, Kaveri produced it from the database.

What is normal

Maintained by every listed company and by intermediaries and fiduciaries handling UPSI; populated with the name and PAN of each recipient; preserved for 8 years; the basis for the recipient list a seller can request under the NDA.

Watch out for

A listed buyer that cannot produce the list promptly, which suggests its controls are weak; resisting the buyer's logging of your founders and advisers as recipients, which is its regulatory duty and adds nothing to the trading ban they already carry; confusion between the database and your own NDA register, which are different documents.

In India

Regulation 3(5) of the SEBI (Prohibition of Insider Trading) Regulations 2015, introduced by the 2018 amendments effective from 1 April 2019; the database must be maintained internally with adequate controls, and preserved for not less than 8 years after completion of the relevant transactions; stock exchanges verify compliance through quarterly compliance certificates.

Copy link to this term

Trading windowThe period during which a listed company's insiders may trade in its securities; the company closes it when UPSI, such as a planned acquisition, exists.

Also called: Trading window closure, Blackout period, Closed period

In plain English

A listed company's code of conduct under the PIT Regulations requires it to close the trading window for designated persons when they are in possession of UPSI, and in any event from the end of each quarter until 48 hours after the results are published. During an acquisition process the company closes the window for its deal team and anyone else who knows about the deal. For the NDA the point is that a listed buyer will want the deal confined to a small, logged group precisely so that it does not have to close the window for the whole company, which would itself signal that something is happening. It also means the buyer's deal team cannot sell or buy the buyer's shares until the deal is announced or abandoned.

Worked example

Kaveri's compliance officer closed the trading window for the designated persons on its deal team from 10 January 2029 until 48 hours after the acquisition was announced to the stock exchanges on 15 March 2029. Clause 9 of the agreement required Kaveri to ensure persons in possession of the information did not trade while it remained unpublished.

What is normal

Window closure for designated persons in possession of UPSI as standard under every listed company's code of conduct; quarterly closures from quarter end to 48 hours after results; deal-specific closures for the logged group only, to avoid signalling.

Watch out for

A buyer that proposes closing its window company-wide for your deal, which can leak the existence of the deal to the market; assuming that your founders or Marigold may trade the buyer's shares because they sit outside its trading window; while they know of the deal, they may not.

In India

Schedule B to the SEBI (Prohibition of Insider Trading) Regulations 2015 sets the minimum standards for the code of conduct, including trading window closure when designated persons can reasonably be expected to have UPSI and from the end of every quarter until 48 hours after results; contra-trade restrictions of 6 months also apply to designated persons.

Copy link to this term

Law, remedies and signing

What a court will do, what it will not, and how to sign and stamp the document

InjunctionA court order stopping a party from using or disclosing information; the only remedy that matters in a live leak, granted under the Specific Relief Act 1963.

Also called: Injunctive relief, Interim injunction, Restraining order

In plain English

Damages arrive years after a leak, by which time the information is public and the harm is done. An injunction is an order from a court, or an arbitral tribunal, that the recipient must stop using or disclosing the information now. Indian courts grant temporary injunctions under Order 39 of the Code of Civil Procedure 1908 where the applicant shows a prima facie case, that the balance of convenience favours an order, and that it would suffer irreparable injury without one, and permanent injunctions under the Specific Relief Act 1963. The NDA helps by having both parties acknowledge in advance that damages may be inadequate. Where disputes go to arbitration, Section 9 of the Arbitration and Conciliation Act 1996 lets you get interim relief from a court before the tribunal exists.

Worked example

Clause 13 of the Tungabhadra NDA recorded that damages may not be adequate and entitled the discloser to seek injunctive relief under the Specific Relief Act 1963 without proving special damage. Clause 12 of the Kaveri agreement added a specific acknowledgement that a breach of the standstill or non-solicit called for an injunction as the primary remedy, with Section 9 relief from the Bengaluru courts.

What is normal

An injunction acknowledgement in effectively every NDA; interim relief applications heard within days in most High Courts and commercial courts; Section 9 relief preserved expressly where arbitration is chosen; permanent injunctions at trial, often years later.

Watch out for

A dispute clause requiring 30 or 60 days of negotiation or mediation before any proceedings, which delays an injunction unless interim relief is carved out; a liability cap drafted so widely that it arguably excludes equitable relief; no disclosure log, so the prima facie case is weak.

In India

Temporary injunctions under Order 39 Rules 1 and 2 of the Code of Civil Procedure 1908; perpetual injunctions under Sections 37 to 42 of the Specific Relief Act 1963, as amended in 2018; interim measures under Section 9 of the Arbitration and Conciliation Act 1996 and, within arbitration, Section 17. Commercial courts hear disputes above ₹3 lakh under the Commercial Courts Act 2015.

Copy link to this term

Liquidated damages and penaltiesA sum fixed in advance as payable on breach; under Section 74 of the Indian Contract Act 1872 it is recoverable only as reasonable compensation, never as a penalty.

Also called: LD clause, Agreed damages, Stipulated sum

In plain English

Some NDAs name a figure, ₹25 lakh or ₹1 crore, payable on any breach. Indian law treats such a figure differently from English law: under Section 74 of the Indian Contract Act 1872 the party claiming it may recover only reasonable compensation not exceeding the stated sum, whether the clause calls it liquidated damages or a penalty, and must usually still show that loss was suffered unless the loss is impossible to prove. So a large figure buys little, signals distrust, and gives the other side a number to negotiate down to. For a leak the real remedy is an injunction. If a counterparty insists on a figure, make it mutual, keep it modest, and make sure it is in addition to, not instead of, injunctive relief and actual damages.

Worked example

Neither of Saffron's NDAs carried a liquidated damages figure. A procurement template Saffron received in 2026 proposed ₹50 lakh payable by the vendor alone for any breach; Saffron's counsel pointed out that Section 74 would reduce it to proven reasonable compensation, and the clause was replaced by a mutual indemnity for direct loss and legal costs.

What is normal

Liquidated damages in around 1 in 4 Indian commercial NDAs, usually ₹10 lakh to ₹1 crore, and in perhaps 1 in 5 acquisition NDAs where listed buyers nearly always strike them; mutual indemnities for direct loss as the common alternative; caps on liability uncommon in NDAs.

Watch out for

A one-way figure running only against you; a figure expressed as a penalty payable without proof of loss, which Section 74 will not enforce as written; a figure drafted as the sole remedy, which can be read as excluding an injunction.

In India

Section 73 of the Indian Contract Act 1872 gives compensation for loss naturally arising from a breach; Section 74 limits a stipulated sum to reasonable compensation not exceeding that sum. Forfeiture of earned amounts as a sanction for breach is a penalty. The Supreme Court's approach since Fateh Chand (1963) and Kailash Nath (2015) requires proof of loss save where loss is difficult or impossible to prove.

Copy link to this term

Section 72A of the Information Technology Act 2000The penalty for disclosing personal information in breach of a lawful contract: up to ₹25 lakh since 2023, when imprisonment was removed.

Also called: IT Act 72A, Penalty for disclosure of information in breach of lawful contract

In plain English

Section 72A makes liable any person, including an intermediary, who, while providing services under a lawful contract, has secured access to material containing personal information about another person and, with intent to cause or knowing they are likely to cause wrongful loss or wrongful gain, discloses it without consent or in breach of the contract. Since 30 November 2023 the consequence is a penalty of up to ₹25 lakh, not imprisonment. It is a statutory backstop to the civil NDA, but only where personal information is involved and only where the disclosure is in breach of the contract. It does not cover leaks of commercial information such as pricing or source code; those remain contract claims. Keep the Section 72A route open in the NDA wherever personal data is shared.

Worked example

Clause 14 of the Tungabhadra NDA preserved all rights under Section 72A, because the pilot involved plant workers' shift and attendance data. If a Saffron engineer had sold that data to a staffing agency, Tungabhadra could have sought a penalty of up to ₹25 lakh under Section 72A as well as suing Saffron under the NDA and reporting a breach under the DPDP Act.

What is normal

Referenced expressly in a minority of NDAs, usually where personal data is central; implicitly available in every case involving personal information under a contract; since 2023 pursued as a penalty under the Information Technology Act alongside a civil suit, no longer as a police complaint.

Watch out for

Treating Section 72A as a remedy for leaks of commercial secrets, which it is not; relying on the penalty route alone, which does not stop the leak the way an injunction does; templates and older guides that still describe it as a crime punishable with 3 years' imprisonment.

In India

Section 72A was inserted by the Information Technology (Amendment) Act 2008. The Jan Vishwas (Amendment of Provisions) Act 2023 replaced its punishment of up to 3 years' imprisonment or a ₹5 lakh fine with a penalty of up to ₹25 lakh from 30 November 2023. Section 43A on compensation for negligent handling of sensitive personal data is omitted by Section 44(2) of the DPDP Act 2023 once that provision commences, 18 months after the Rules were notified.

Copy link to this term

Jurisdiction clause: courts or arbitrationThe clause choosing Indian law and either the exclusive jurisdiction of named courts or arbitration; small NDAs usually choose courts, acquisition NDAs arbitration.

Also called: Dispute resolution clause, Forum selection clause, Governing law and jurisdiction

In plain English

Every NDA chooses a governing law, Indian law for a domestic deal, and a forum. For a small commercial NDA, the courts of your city are usually the better choice: an injunction is what you need, a court grants one in days, and court fees are modest compared with an arbitrator's fees for a dispute worth a few lakh. For an acquisition NDA with a listed or large counterparty, arbitration keeps the dispute private, which both sides want, with a sole arbitrator, a seat in India, an institutional fallback and Section 9 interim relief from the courts preserved. Whichever you choose, add a carve-out letting the discloser seek an injunction wherever the breach is happening, and refuse any mandatory negotiation period that would delay urgent relief.

Worked example

The Tungabhadra NDA chose Indian law and the exclusive jurisdiction of the courts at Bengaluru, with a carve-out for injunctions elsewhere. The Kaveri agreement chose a sole arbitrator seated in Bengaluru under the Mumbai Centre for International Arbitration Rules, with Section 9 interim relief from the Bengaluru courts, because a public dispute with a listed buyer would have damaged both sides.

What is normal

Courts in roughly 7 of 10 domestic commercial NDAs and arbitration in 3 of 10; arbitration in around 7 of 10 acquisition NDAs with listed or large counterparties; the discloser's city as the forum in seller or vendor drafts; a sole arbitrator with an institutional fallback where arbitration is chosen.

Watch out for

A foreign governing law or seat for a purely domestic deal; a 30 or 60 day negotiation period before proceedings with no carve-out for interim relief; a neutral third city that adds travel cost for both; an arbitration clause with no institution named and no appointment mechanism.

In India

Exclusive jurisdiction clauses are given effect where the chosen court would otherwise have jurisdiction under Section 20 of the Code of Civil Procedure 1908; arbitration under the Arbitration and Conciliation Act 1996 with the seat determining the supervising court; Section 9 interim relief and Section 17 tribunal-ordered measures; commercial courts for disputes above ₹3 lakh.

Copy link to this term

Notice of breachThe recipient's duty to tell the discloser promptly of any actual or suspected leak, and the discloser's formal notice demanding that a breach stop.

Also called: Breach notification clause, Incident notice, Notice of unauthorised disclosure

In plain English

Two different notices share the name. The first is the recipient's duty to report: if it learns of an unauthorised use or disclosure, it must tell the discloser promptly, or within a fixed window such as 48 or 72 hours, and help contain it. That early warning is what lets you seek an injunction before the information spreads. The second is the discloser's notice to the recipient demanding that a breach stop and the information be returned; it is the first step before court or arbitration and it should follow the notices clause exactly, by email with a hard copy to the registered office, so that nobody can argue it was not received. Where personal data is involved, a third regime applies: breach notification under the DPDP Act.

Worked example

Clause 4 of the Tungabhadra NDA required each party to notify the other promptly of any unauthorised use or disclosure and cooperate in remedying it. When a Tungabhadra contractor's laptop with pilot files was stolen in 2026, Tungabhadra notified Saffron within 24 hours under that clause and the DPDP clause, and Saffron's notice demanding remote wipe confirmation followed the notices clause.

What is normal

A duty to notify leaks promptly in around half of Indian commercial NDAs and most acquisition NDAs; fixed windows of 48 to 72 hours in data-heavy agreements; formal notices by email with a hard copy, deemed received on sending or the next business day.

Watch out for

A 24-hour window you cannot meet; a notice clause requiring registered post alone, so a breach notice to a factory takes a week; a formal notice sent to the wrong entity or address, which the recipient will use to argue it was never on notice.

In India

No statutory form for a contractual breach notice; it must follow the agreement's notices clause. Under the DPDP Act 2023 the data fiduciary must separately notify the Data Protection Board and affected individuals of a personal data breach as the DPDP Rules 2025 prescribe. The 3-year limitation period under the Limitation Act 1963 runs from the breach, not from the notice.

Copy link to this term

Stamp duty on an NDAAn NDA is an agreement under the State Stamp Act; duty is nominal and State-specific, a few hundred rupees, payable by e-stamp before signing; notarisation is not required.

Also called: E-stamping, Stamp paper for NDA, Agreement stamp duty

In plain English

An NDA is an agreement not otherwise provided for under the Stamp Act of the State where it is first executed, and the duty is nominal: ₹500 in Karnataka (Article 5(j)) and in Maharashtra (Article 5(h)(B)), and ₹200 in Tamil Nadu (Article 5(j)), with other amounts elsewhere. Pay it by e-stamp or franking before or at signing, as Section 17 of the Karnataka Stamp Act 1957 requires (Maharashtra also allows the next working day), and record the e-stamp certificate number on the document. An unstamped or under-stamped agreement is still valid, but it cannot be admitted in evidence until the duty and a penalty of up to ten times are paid under Section 35 of the Indian Stamp Act 1899 or the State equivalent, which is an avoidable delay when you need an injunction urgently. Notarisation is not required for validity or admissibility.

Worked example

Clause 15 of the Tungabhadra NDA made Saffron responsible for the Karnataka stamp duty; Saffron bought a ₹500 e-stamp certificate under Article 5(j) through the Karnataka portal and quoted its number on the first page before e-signing. The Kaveri agreement was executed in Mumbai and used in Bengaluru, so Kaveri paid Maharashtra duty and Saffron's counsel checked the Karnataka differential.

What is normal

A few hundred rupees in most States; paid by the party in whose State the document is first executed, or as agreed; e-stamping available in Karnataka, Maharashtra, Tamil Nadu and most other States; the e-stamp number quoted on the agreement; no notarisation; no registration.

Watch out for

Signing first and stamping never, then discovering the admissibility problem at the injunction hearing; a document executed in one State and used in another, which may attract differential duty; a counterparty insisting on physical stamp paper when e-stamping is available.

In India

Stamp duty on agreements is a State subject; the Indian Stamp Act 1899 applies directly in some States and as adapted in others, with Karnataka and Maharashtra having their own Acts and Tamil Nadu applying the 1899 Act as amended by the State. Section 35 of the 1899 Act, and Section 34 of the Karnataka and Maharashtra Acts, bar admission of an unstamped instrument in evidence until duty and penalty are paid. The 0.005 percent and 0.015 percent rates under the 2020 amendments apply to securities, not to NDAs.

Copy link to this term

Counterparts and electronic signatureEach party may sign a separate copy, and may sign electronically under the Information Technology Act 2000; the copies together form one agreement.

Also called: Counterparts clause, E-signature clause, Execution in counterparts

In plain English

A counterparts clause lets each party sign its own copy of the agreement, so that two companies in different cities need not pass one paper document between them; the signed copies together are the agreement. An electronic signature clause confirms that signing through a recognised method is as good as ink. In India, Section 5 of the Information Technology Act 2000 gives legal recognition to electronic signatures, and Section 10A confirms that contracts formed electronically are enforceable. Aadhaar e-sign and digital signature certificates issued by licensed certifying authorities are the methods the Act recognises directly; commercial signing platforms are widely used and accepted as evidence of consent, so name the method in the clause to avoid argument. Stamp duty still has to be paid.

Worked example

Both of Saffron's NDAs were executed in counterparts by electronic signature. Ananya Rao signed the Tungabhadra NDA by Aadhaar e-sign from Bengaluru on 5 January 2026 and Tungabhadra's authorised signatory signed from Hosur the same day; the e-stamp certificate number was quoted on the first page and the signed PDF with audit trail was filed in Saffron's NDA register.

What is normal

Counterparts and electronic signature clauses in most templates since 2020; Aadhaar e-sign or DSC for documents that may need to be produced to a regulator; commercial signing platforms for ordinary commercial NDAs; physical signatures still required by some banks and government bodies.

Watch out for

Documents the Information Technology Act excludes from electronic execution, such as powers of attorney, negotiable instruments and documents of title to immovable property; a counterparty signing with an image of a signature pasted in a document, which is weak evidence; forgetting stamp duty because the document never existed on paper.

In India

Section 5 of the Information Technology Act 2000 recognises electronic signatures; Section 10A validates electronic contracts; the First Schedule excludes certain instruments. Aadhaar e-sign and digital signature certificates under the Act are presumed valid under Section 85B of the Indian Evidence Act 1872, now carried into the Bharatiya Sakshya Adhiniyam 2023.

Copy link to this term

Authority to sign and the effective dateThe signatory must be authorised by a board resolution or a delegation; the agreement takes effect on the date of the last signature unless it says otherwise.

Also called: Authorised signatory, Signing authority, Effective date clause

In plain English

A company acts through authorised people. A director usually signs under a general board resolution; an employee of a large company signs under a power of attorney or a delegation matrix. If the signatory had no authority, the company's first defence to an injunction application is that it was never bound. Ask a public company or a large group to name the resolution or power of attorney its signatory acts under and to provide a copy. Keep a standing resolution in your own minute book authorising the chief executive to sign NDAs and contracts up to a stated value. The effective date clause fixes when the agreement starts: with signatures on different days, the date of the last signature, unless the parties backdate the effective date to cover meetings already held.

Worked example

Clause 16 of the Tungabhadra NDA had each party warrant its authority and allowed either to request the board resolution or power of attorney. Tungabhadra's signatory, a general manager, signed under a board power of attorney dated 2024, which Saffron's company secretary checked. Ananya Rao signed under Saffron's standing resolution of March 2024 authorising the CEO to sign commercial agreements up to ₹5 crore.

What is normal

An authority warranty in most NDAs; a right to request the resolution in around a third, worth adding for public companies and groups; the last-signature rule for the effective date as standard; two witness lines in many templates though not legally required for a company's execution; no notarisation.

Watch out for

A plant manager or procurement executive signing with no delegation; a document dated at the head and signed weeks later with no effective date rule; a backdated effective date that shortens survival because survival is measured from a fixed date rather than from expiry.

In India

A company's board may delegate authority to sign under Section 179 of the Companies Act 2013 and its Articles; a power of attorney for signing agreements attracts its own State stamp duty; a director signing without authority may bind the company under the indoor management rule where the counterparty acted in good faith, but relying on that in an injunction hearing is a poor position.

Copy link to this term

Effective dateThe date the NDA starts to operate and from which its term and survival run; usually the date of the last signature.

Also called: Commencement date, Start date, Date of this Agreement

In plain English

An NDA can carry three dates: the date typed at the head, the date each party signs, and the effective date. The effective date is the one that matters, because the term, the survival period and usually the non-solicit are counted from it. Clause 16 of the Tungabhadra NDA fixes it as the date of the last signature, whatever the heading says, which settles the question when signatures land days apart. Pre-signing meetings do not need a backdated effective date: a definition that covers information disclosed before or after the date of the agreement protects them more cleanly, without moving the expiry and survival dates.

Worked example

Both signatures on the Tungabhadra NDA landed on 5 January 2026, so the Effective Date was 5 January 2026: the term ends on 5 January 2028 and survival for ordinary information on 5 January 2031. Had Tungabhadra's general manager signed on 12 January 2026, every date would have moved a week later. Any demonstration Saffron gave in December 2025 was still protected, because clause 2 covers information disclosed before the date of the agreement.

What is normal

The last-signature rule is standard in well-drafted Indian NDAs; older templates rely on 'the date first written above', which invites argument when the second signature arrives a week or a month later. Covering pre-signing disclosures in the definition is common and preferred to backdating. E-signature platforms timestamp each signature, so the audit trail fixes the date to the minute.

Watch out for

Clocks tied to different dates: a term that runs from the Effective Date and a standstill that runs from 'the date of this Agreement' can end on different days when the heading and the last signature differ, so define one date and use it everywhere. Watch for a backdated effective date that quietly pulls expiry and survival earlier, and for an e-stamp certificate dated after the signatures, which suggests the document was signed unstamped.

In India

Indian law lets parties agree that a contract takes effect from a date before signing, so long as the backdating does not mislead a court, a regulator or a tax authority. Stamp law expects an instrument to be stamped before or at the time of execution, so buy the e-stamp before the first signature. Electronic signatures are valid under Section 5 of the Information Technology Act 2000, and the platform's audit trail is the best evidence of each signing time.

Copy link to this term

Indemnity in an NDAA promise to make good the other party's losses and legal costs caused by a breach; fair when mutual and limited to direct loss.

Also called: Indemnification clause, Hold harmless clause, Indemnity for breach

In plain English

An indemnity turns a breach claim into a promise to pay. Without one, the discloser must prove its loss under Section 73 of the Indian Contract Act 1872 and bears its own lawyers' fees beyond whatever costs a court awards. With one, the recipient has agreed in advance to cover losses, legal costs and third-party claims caused by its own breach or its Representatives' breach. In an NDA the fair version is mutual, covers direct loss and reasonable legal costs, and excludes indirect loss. A one-way, uncapped indemnity for consequential loss is the clause to refuse.

Worked example

Clause 13 of the Tungabhadra NDA makes each party indemnify the other for direct losses and reasonable legal costs caused by its own or its Representatives' breach. If a Tungabhadra contractor leaked Saffron's pricing and Saffron spent ₹6 lakh on lawyers to win an injunction, it could claim that ₹6 lakh from Tungabhadra, not just the costs the court awarded. In the Kaveri agreement the indemnity also runs to Saffron's shareholders, so Marigold could recover its own fees.

What is normal

Many short NDAs carry no indemnity and rely on damages and an injunction. Where one appears in a commercial NDA, a mutual indemnity for direct loss and reasonable legal costs is the market position; in acquisition NDAs the buyer indemnifies the company and often its shareholders. Caps are uncommon; where agreed, 12 months of fees or ₹50 lakh to ₹2 crore is typical, with wilful misconduct and personal data breaches outside the cap.

Watch out for

A one-way indemnity inside a 'mutual' NDA; cover for indirect, consequential or punitive loss; 'all losses howsoever arising', which can reach a customer's lost contracts; and, where you process the other side's personal data, an uncapped indemnity for Data Protection Board penalties, which can reach ₹250 crore for a security failure. Limit that last one to penalties caused by your own breach, and cap it.

In India

Sections 124 and 125 of the Indian Contract Act 1872 cover indemnity, and courts also enforce wider contractual indemnities. An indemnity tied to Sections 73 and 74, as in both of Saffron's NDAs, keeps the ordinary measure of damages and mainly adds legal costs and liability for Representatives. Under the DPDP Act the data fiduciary stays responsible for processing done on its behalf by a processor, which is why a customer asks its processor for this indemnity.

Copy link to this term

Limitation periodThe time you have to sue for a breach: 3 years from the breach under the Limitation Act 1963, whatever the NDA's own term.

Also called: Time bar, Limitation, Period to sue

In plain English

Survival decides how long the recipient must keep quiet; limitation decides how long you have to sue once it does not. Under Article 55 of the Limitation Act 1963, a suit for compensation for breach of contract must be filed within 3 years of the breach, not of the day you find out, unless fraud concealed it. For a continuing breach, such as ongoing use of your code, Section 22 starts a fresh period every moment it continues. The same 3 years apply in arbitration. A court must dismiss a late suit even if the other side never raises the point, so log leaks with dates.

Worked example

Survival for ordinary information under the Tungabhadra NDA ends on 5 January 2031. If a Tungabhadra engineer emailed Saffron's pricing model to a rival on 1 December 2030, Saffron could sue until 1 December 2033, almost 3 years after survival ended. If Saffron learned of a one-off leak from June 2029 only in August 2032, its damages claim would already be time-barred, unless fraud had concealed the leak or the misuse was continuing.

What is normal

3 years from the breach for a damages claim under Article 55; for a continuing breach, time runs from when it ceases; the same period in arbitration under Section 43 of the Arbitration and Conciliation Act 1996. Most NDAs say nothing about limitation, which is right: the statutory period applies. A 2-year term, 3-year survival and 3 years to sue mean a breach late in survival can be litigated up to 8 years after signing.

Watch out for

A clause barring claims not brought within 6 or 12 months of expiry: Section 28 of the Indian Contract Act 1872 makes an agreement that shortens the time to enforce rights, or extinguishes them on a fixed date, void to that extent. Also watch slow discovery: time runs from the breach, not from when you learn of it, so a disclosure log and an annual compliance confirmation from the recipient narrow the gap.

In India

The Limitation Act 1963 binds courts under Section 3 and arbitral tribunals through Section 43 of the Arbitration and Conciliation Act 1996. Delay in filing a suit cannot be excused: Section 5 condonation covers appeals and applications, not suits. Where fraud concealed the breach, time runs from discovery under Section 17. Interim injunctions have no fixed deadline, but courts refuse them for delay, so move within days of finding a leak.

Copy link to this term

Penalty versus liquidated damagesEnglish law enforces a genuine pre-estimate and strikes down a penalty; India's Section 74 treats both alike: reasonable compensation up to the named sum.

Also called: Penalty clause, Genuine pre-estimate rule, In terrorem clause

In plain English

Templates built on English or US models often say the sum payable on breach 'is a genuine pre-estimate of loss and not a penalty'. That sentence matters in London, where a pre-estimate is enforced and a sum out of all proportion to the innocent party's legitimate interest is struck down. It matters much less in India. Section 74 of the Indian Contract Act 1872 applies one rule to both labels: the court awards reasonable compensation not exceeding the named sum. So the label decides nothing. Two results follow: an inflated figure is cut down to real loss, and a low figure can act as a ceiling on what you recover.

Worked example

Suppose the Tungabhadra NDA had named ₹1 crore as 'liquidated damages, a genuine pre-estimate and not a penalty'. If a Saffron engineer mistakenly forwarded one Tungabhadra drawing to a vendor and the proven loss was ₹3 lakh, a court would award about ₹3 lakh, not ₹1 crore. Reverse it: with a figure of ₹10 lakh, if Tungabhadra's team passed Saffron's code to a rival that then won a ₹1 crore contract, Saffron's claim under the clause could stop at ₹10 lakh.

What is normal

Most Indian NDAs name no sum. Templates that do usually add a pre-estimate recital and pick ₹10 lakh to ₹1 crore; the recital helps only where loss is hard to prove, when a court may award the named sum as reasonable compensation. Listed buyers strike these clauses from acquisition NDAs. Forfeiture of fees already earned, or interest that steps up on breach, is tested the same way.

Watch out for

A low figure that becomes your cap; a figure drafted as the sole remedy, which reads like a price for breach and weakens your case for an injunction; and a 'penalty' payable without proof of loss. Section 23 of the Specific Relief Act 1963 keeps specific performance available only where the sum was named to secure performance, not to give the other side an option to pay instead.

In India

Section 74 of the Indian Contract Act 1872 removes the English distinction, as the Supreme Court held in Fateh Chand (1963); Kailash Nath (2015) added that loss must still be proved wherever it can be proved. The Explanation to Section 74 treats increased interest from the date of default as a possible penalty. English law asks whether the sum is out of all proportion to a legitimate interest; Indian courts ask only what compensation is reasonable.

Copy link to this term

Sections 73 and 74 of the Indian Contract Act 1872Section 73 measures damages for breach by the loss that naturally follows; Section 74 limits any sum named for breach to reasonable compensation.

Also called: Damages for breach of contract, Compensation for breach, Contract Act damages

In plain English

Section 73 is the default money rule. You recover loss that arose naturally in the usual course from the breach, or that both parties knew at signing was likely to result, but not remote or indirect loss, and the court considers what you could have done to reduce it. Section 74 applies when the contract names a sum for breach: reasonable compensation up to that sum, whatever the label. In an NDA the hard part is proof: what was disclosed, how it was misused and what it cost you. That is why the injunction usually matters more than the damages.

Worked example

If Tungabhadra's planning head shared Saffron's pricing model with a rival vendor, which then undercut Saffron on a ₹40 lakh contract with another forge, Saffron could claim the profit lost on that contract, say ₹12 lakh, as loss arising naturally from the breach. A claim for ₹2 crore of business it hoped to win from that forge over 5 years would probably fail as too remote, unless Tungabhadra knew of that prospect at signing.

What is normal

Many NDA disputes in India settle once an interim injunction is granted or refused, so damages trials are rare. Contracts that track Section 73 cover direct loss and reasonable legal costs and exclude indirect and consequential loss. Many templates also exclude 'loss of profit' outright; accept that only if lost profit flowing directly from a leak stays recoverable. Any claim must be filed within 3 years of the breach.

Watch out for

An exclusion of all 'loss of profit' or 'loss of business', which can leave a leak with no recoverable loss; a sum named for breach, which caps you under Section 74; and no disclosure log, which makes loss hard to prove. Excluding indirect loss is fair, but say expressly that the lost value of a trade secret is direct loss, as clause 13 of the Tungabhadra NDA does.

In India

Section 73 restates the remoteness rule of Hadley v Baxendale (1854): loss arising naturally, or loss both parties contemplated at signing. Its Explanation makes the means you had to remedy the breach part of the measure. Section 74 governs any named sum. Where the recipient profited from misuse, plead breach of confidence as well and ask for rendition of accounts of its profits, which Section 73 does not give.

Copy link to this term

Specific Relief Act 1963The statute under which Indian courts order a party to perform or to stop, including the injunctions that protect confidential information.

Also called: SRA 1963, Law of specific performance and injunctions

In plain English

Damages pay for a breach afterwards; the Specific Relief Act 1963 lets a court stop or undo it. Part II covers specific performance, an order to do what the contract says, which courts now grant as the rule rather than at discretion after the 2018 amendment. Part III covers injunctions: a perpetual injunction under Section 38 to stop disclosure or use, a mandatory injunction under Section 39 to make the recipient return or delete your files, and Section 42, which lets a court enforce a negative promise, such as not to disclose, even where it would not enforce the rest of the contract.

Worked example

If a Tungabhadra engineer copied Saffron's demonstration environment to a personal drive and began showing it to a rival, Saffron would sue in the Bengaluru courts for a perpetual injunction under Section 38, seek a mandatory injunction under Section 39 to make Tungabhadra delete every copy and certify it, and apply on the first day for a temporary injunction under Order 39 of the Code of Civil Procedure 1908 to stop the showings until trial.

What is normal

An acknowledgement that damages may be inadequate, plus a right to seek relief under the Act without proving special damage, appears in almost every Indian NDA; courts treat it as relevant, not decisive. Interim applications in a live leak are usually heard within days; a perpetual injunction comes only after trial. Section 40 lets the court award damages as well as, or instead of, an injunction.

Watch out for

Wording that the discloser 'shall be entitled to' an injunction does not bind the court; relief stays discretionary. Section 42 helps only if you have performed your own side of the contract. Section 41 lists cases where an injunction is refused, such as where equally efficacious relief is available by another usual proceeding, and a liquidated sum drafted as the sole remedy invites the argument that money is enough.

In India

The 2018 amendment made specific performance the rule rather than a discretion and added Section 20A, which bars injunctions that would delay the infrastructure projects named in its Schedule and does not touch an ordinary NDA. Temporary injunctions are governed by Order 39 of the Code of Civil Procedure 1908, as Section 37 provides. In arbitration, interim measures come from Section 9 or Section 17 of the Arbitration and Conciliation Act 1996 on the same principles.

Copy link to this term

Before you sign

Fourteen checks to run on every NDA, whether you drafted it or the other side did. They follow the order of the clauses in the two samples above, so a no on any line points you to the clause to fix.

The Purpose names the actual project, and the parties are the legal entities that will exchange information, not brand names or a group parent.
Any use outside the Purpose is a breach, so a narrow Purpose is your main protection. If a parent signs but a subsidiary runs the pilot, the company holding your information may not be bound at all.
The definition of Confidential Information covers oral, visual and unmarked disclosures, with at most a reasonable-efforts duty to confirm oral ones in writing.
Pilots and plant visits are mostly talk and demonstration. A marked-only definition loses all of it, and a strict 15-day written confirmation turns one missed email into lost protection.
The exclusions are the standard four (public, already known, independently developed, received from a third party) and the recipient bears the burden of proof.
Extra exclusions such as information 'generally known in the industry' quietly shrink the definition, and without a stated burden you may end up proving a negative in court.
Need to know is the test for sharing, Representatives are bound by written terms at least as strict, and the recipient is liable for their breaches.
Leaks usually come through a consultant, an affiliate or a subcontractor. Back-to-back terms and liability for Representatives give you one party to sue instead of a chain of strangers.
Compelled disclosure to a court, regulator or stock exchange needs prompt notice where lawful, only what is required, and a request for confidential treatment.
Without notice you learn of the disclosure afterwards and cannot seek a protective order. Without the minimum-disclosure limit, an order for one document becomes a reason to hand over the whole file.
Where personal data moves, each party's role under the DPDP Act is named and a written processor contract is signed before any data is transferred.
From around 13 May 2027 a data fiduciary stays responsible for anything its processor does and must have the processor's safeguards in writing. The DPDP Rules notified on 13 November 2025 phase these duties in over 12 to 18 months, so draft to the full standard now.
The term is 2 to 3 years, obligations survive 3 to 5 years after expiry, trade secrets are protected while secret and personal data while held.
With no survival, protection ends on expiry; a perpetual duty on ordinary information is resisted by large counterparties. The trade secret carve-out protects source code without asking for forever on everything.
There is no residuals clause and no non-compete, including a confidentiality clause drafted so widely that it works as one.
A residuals clause makes whatever an engineer remembers free to use. A restraint that bites after the relationship ends is void under Section 27 of the Indian Contract Act 1872 and colours how a court reads the rest.
Any non-solicit covers employees with material contact, runs 12 to 18 months, is mutual where both teams work together and excepts general advertising.
A reasonable non-solicit is usually upheld because it stops nobody working or trading. A longer or group-wide no-hire clause invites a Section 27 challenge.
Remedies are an injunction and damages for direct loss, with no penalty, no one-way liquidated damages and no uncapped indemnity for consequential loss.
Only an injunction stops a live leak. Under Section 74 of the Indian Contract Act 1872 a named sum is reasonable compensation at most, and a low figure can cap what you recover.
The dispute clause fits the deal: your city's courts for a pilot, a sole arbitrator seated in your city for an acquisition, interim relief kept either way.
A small NDA does not justify arbitration fees, and a forum in the other side's city adds travel and local counsel to every hearing. Section 9 of the Arbitration and Conciliation Act 1996 keeps urgent court relief open.
Stamp duty is paid under the right State's Stamp Act before or at signing, ideally by e-stamp, and the e-signature method (Aadhaar e-sign or DSC) is agreed.
An unstamped NDA cannot be acted on in court until the duty and a penalty are paid under Section 35 of the Indian Stamp Act 1899 or the State equivalent, which is the wrong moment to find out.
The other side's signatory has authority under a board resolution or power of attorney you have seen, and your own signatory has a standing resolution covering NDAs.
If the signatory had no authority, the other company's first defence to an injunction is that it was never bound. Asking for the paper takes a day; arguing about it later takes months.
The NDA goes into a register with its effective date, expiry, survival end, non-solicit end and owner, with a reminder 60 days before expiry.
Disclosures after expiry are unprotected unless you renew, and a return-or-destroy request is easy to forget once a pilot ends. A one-page register is the cheapest confidentiality control a startup can run.

From first draft to the end of survival

An NDA takes about a week to sign and 5 years or more to run. These eight steps follow the Tungabhadra pilot NDA. There are no government filings, but signing authority, the stamp and the register are where founders slip. BizExpress handles this for clients as a package, from the first redline to the register.

When	What happens	Who	Form or document
Day 0	One side asks for an NDA and sends its template, or you send yours. Settle the Purpose, the parties and the type first: mutual for a pilot or partnership, one-way for a vendor or a buyer. The decision table above covers the usual situations.	Founder or business lead, with your company secretary or counsel	Draft NDA (your template or theirs)
Days 1 to 7	Exchange redlines on the definition, exclusions, Representatives, term and survival, residuals, non-solicit, remedies and jurisdiction. A pilot NDA usually settles in one or two rounds; a listed buyer's NDA takes longer because of the standstill and the clean team.	Counsel or company secretaries for both sides	Tracked-changes draft and an issues list
Day 7	Check the other side's signatory against its board resolution or power of attorney, confirm your own signatory's standing resolution, and buy the e-stamp in the State where the first signature will happen, before anyone signs.	Company secretary or finance lead	Board resolution or power of attorney; e-stamp certificate
Day 8	Both parties sign electronically, by Aadhaar e-sign or a digital signature certificate, valid under Section 5 of the Information Technology Act 2000. The later signature fixes the effective date, from which the 2-year term runs.	Authorised signatories of both parties	Signed PDF with the e-signature audit trail
Days 8 to 10	Enter the NDA in your register: effective date, expiry, survival end, non-solicit end, the categories of information shared and the person who owns the relationship. Set a reminder 60 days before expiry to renew or close.	Finance or legal owner of the NDA register	NDA register entry
During the 2-year term	Disclose under the NDA: mark documents where you can, summarise oral and plant-visit disclosures in writing within 15 days, share personal data only after the processor contract is signed, and keep a log of what went to whom.	Project teams on both sides	Disclosure log, written summaries, processor contract
End of the pilot or expiry	Send a written request to return or destroy your information, with a certificate of destruction signed by an officer. One archival copy for legal compliance is allowed, and backups are deleted as they are overwritten.	Your project lead; an officer of the other side certifies	Return or destroy request; certificate of destruction
Expiry plus 3 years (5 January 2031 for Tungabhadra)	Survival for ordinary information ends; trade secrets stay protected while secret and personal data while held. A breach late in survival can still be sued on for 3 years under the Limitation Act 1963, so archive the file rather than delete it.	Owner of the NDA register	Register entry closed; file archived

How this page was put together

The BizExpress team, who handle the stamp duty, data protection and company filings around founders' contracts, wrote this page. Every India-specific statement was checked against the Indian Contract Act 1872, the Specific Relief Act 1963, the Information Technology Act 2000, the Digital Personal Data Protection Act 2023 and its Rules, the State stamp laws and SEBI's insider trading regulations as they stood on 4 November 2026, and an expert reviewed each point the law turns on before publication.

The sample documents are composites: the clauses are typical of Indian startups in 2026, but Saffron Labs, its founders, its investors and every other company, fund, incubator, adviser and person in the samples are invented, as are the figures. Any resemblance to a real business is unintended. The calculators simplify on purpose.

The page is reviewed after each Union Budget and whenever a rule it relies on changes; the date of the last review sits at the top. It is general information for founders reading these documents, not advice on any particular deal.

Questions founders ask about NDAs

What is an NDA?

A non-disclosure agreement (NDA) is a contract in which one or both parties promise to use the other's confidential information only for a stated purpose and to keep it from everyone else. A mutual NDA binds both sides; a one-way NDA binds only the side receiving the information. In India it is an ordinary contract under the Indian Contract Act 1872, enforced mainly through injunctions and damages, and it cannot stop someone working for a competitor, which Section 27 of that Act forbids.

Will an investor sign an NDA before I pitch?

No, and asking usually costs you the meeting. Angels and funds see hundreds of decks a year, often in the same sector, and cannot sign something that could later be used to claim they took an idea they had already seen elsewhere. Protect yourself by staging disclosure: the deck and a demo first, then source code, customer contracts and unit economics only after a term sheet, whose confidentiality clause is binding. Saffron pitched Marigold with no NDA and opened its data room only after the term sheet was accepted on 15 September 2026.

Is an NDA enforceable in India?

Yes, an NDA is enforceable in India. A promise to keep information confidential and use it only for an agreed purpose is an ordinary contract under the Indian Contract Act 1872. It is not a restraint of trade under Section 27, so it can survive the end of the relationship. Courts enforce it mainly through injunctions under the Specific Relief Act 1963 and damages under Sections 73 and 74. What courts will not enforce is a non-compete dressed up as confidentiality, or a penalty figure as written. India has no trade-secrets statute, so the contract and the action for breach of confidence do the work.

Can an NDA stop a former employee from joining a competitor?

No, an NDA cannot stop a former employee from joining a competitor. A covenant that stops someone working for a competitor after they leave is void under Section 27 of the Indian Contract Act 1872, whether it sits in an NDA or an employment agreement. The Supreme Court in Niranjan Shankar Golikari v. Century Spinning (1967) upheld a restriction operating during employment and distinguished restraints after it ends. What you can enforce is the confidentiality duty itself, which survives employment, and, often, a reasonable non-solicit of colleagues for about 12 months; courts are divided on customer non-solicits against former employees. If the employee takes your code to the competitor, the remedy is an injunction against the misuse, not against the job.

How long should an NDA last?

An NDA runs on two clocks, and each needs its own length. The term, usually 2 to 3 years, is the window in which disclosures are covered. Survival, usually 3 to 5 years after expiry, is how long the duty of secrecy lasts. Trade secrets such as source code should stay protected for as long as they remain secret, and personal data for as long as it is held. Saffron's pilot NDA with Tungabhadra Forge runs 2 years from 5 January 2026 with 3-year survival, so ordinary information is protected until 5 January 2031. A perpetual duty on everything is resisted by large companies and rarely needed.

What is the difference between a mutual and a one-way NDA?

In a mutual NDA both sides disclose and both carry identical duties, which suits pilots, partnerships and joint development. In a one-way NDA only one side discloses and only the other is bound, which suits vendors, contractors and acquirers. A one-way NDA can be stricter, because the discloser does not pay for strictness with its own obligations. Read a mutual draft twice, once as discloser and once as recipient, since you accept every duty you impose. In an acquisition, refuse mutuality: Saffron gave Kaveri a one-way NDA with only a limited reverse duty about the existence of the talks.

Do we need stamp paper for an NDA?

You need to pay stamp duty, but not on physical paper. An NDA is an agreement chargeable under the Stamp Act of the State where it is executed, and the duty is nominal, a few hundred rupees in most States, payable by e-stamp. Pay before or at signing. An unstamped NDA is not void, but a court will not act on it until the duty and a penalty are paid under Section 35 of the Indian Stamp Act 1899 or the State equivalent, which is the wrong moment to find out. Notarisation is not required, and nor are witnesses for a company's signature.

Is an e-signed NDA valid?

Yes, an e-signed NDA is valid in India. Section 5 of the Information Technology Act 2000 gives an electronic signature the same legal recognition as a handwritten one, and an NDA is not among the documents the Act excludes, such as wills, powers of attorney and contracts for the sale of immovable property. Use Aadhaar e-sign or a digital signature certificate, keep the platform's audit trail with the signed PDF, and let the last signature fix the effective date. A counterparts clause lets each side sign its own copy. Stamp duty still applies, so buy the e-stamp before anyone signs.

What should we do if the other side breaches the NDA?

When the other side breaches an NDA, move in days, not weeks. First collect the evidence: what was disclosed, when, to whom, and how you know it was misused; your disclosure log and written summaries of oral disclosures matter here. Then send a written notice of breach demanding that the use stop and that every copy be returned or destroyed and certified. If the misuse continues, apply for an interim injunction under Order 39 of the Code of Civil Procedure 1908, or under Section 9 of the Arbitration and Conciliation Act 1996 where the NDA has arbitration. Damages under Section 73 come later, and you have 3 years from the breach to sue.

Can we put a penalty or a fixed damages figure in the NDA?

You can, but in India it buys little. Under Section 74 of the Indian Contract Act 1872 a court awards only reasonable compensation not exceeding the named sum, whether the clause calls it a penalty or liquidated damages, and you must still prove loss where it can be proved. A large figure gets cut down and signals distrust; a small one can cap what you recover. Neither of Saffron's NDAs names a figure. Ask instead for an acknowledgement that damages may be inadequate, a right to seek an injunction, and a mutual indemnity for direct loss and reasonable legal costs.

What is a residuals clause, and should we accept one?

A residuals clause lets the recipient's people use information they retain in unaided memory without breaching the NDA. Large technology companies and some enterprise customers insist on one because their engineers see many vendors' material. For a startup it can swallow the agreement: whatever an engineer remembers about your architecture, algorithms or pricing becomes free to use. Refuse it, as Saffron's pilot NDA does expressly. If a large counterparty will not sign without one, confine it to general skills and experience, exclude source code, trade secrets and personal data, and state that it grants no licence under your patents or copyright.

What changes when personal data is shared under the NDA?

The Digital Personal Data Protection Act 2023 applies on top of the NDA. Decide who is the data fiduciary and who is the data processor: in Saffron's pilot, Tungabhadra stays fiduciary for its employees' shift and attendance data, and Saffron processes it on written instructions under a processor contract signed before any transfer. Add security safeguards, breach notice to the other party within 24 to 72 hours, erasure at the end of the pilot and limits on transfers outside India. The DPDP Rules notified on 13 November 2025 phase in over 12 to 18 months, with most of these duties applying from around May 2027, so draft to the full standard now; until then they bind you only because the NDA says so.

What is a standstill, and when do we need one?

A standstill stops a would-be buyer from going around you while it studies your books: no approaching your shareholders, customers or employees, no offers outside your process and no attempt to influence the board, for a fixed period. You need one whenever a strategic buyer or a competitor gets into your data room. Saffron's agreement with Kaveri Industrial Software runs a standstill and an employee and customer non-solicit for 18 months from 10 January 2029, with contact only through the founders. A customer pilot or a vendor NDA does not need one.

When you are ready, we do the filing

The full price is on every page, government fees disclosed upfront. Expert assigned on WhatsApp from the first call.

More free tools

Company Cost Estimator Business Structure Finder Co-founder Prenup Compliance Calendar Late Fee Calculator GST Calculator ESOP Pool Calculator Startup India Eligibility Check GST HSN and SAC Code Finder International Trademark Cost Calculator Term Sheet Explainer Shareholders' Agreement Explainer Share Subscription Agreement Explainer ESOP Scheme and Grant Letter Explainer Share Purchase Agreement Explainer iSAFE, Convertible Note and CCD Explainer Incubation and Accelerator Agreement Explainer Trademark Class Finder

Want an expert to read your NDA with you?

An expert will reach out within 2 working hours. Mon to Sat, 10am to 7pm IST. Bring the clause that worries you and we pick it up from there.

Call an expert WhatsApp us

NDA explainer: every clause of a non-disclosure agreement in plain English (2026)

In short

Look up a term

On this page

Before the clauses

An NDA protects information, not an idea

Section 27 draws the line: confidentiality yes, non-compete no

The definition and the exclusions decide every later argument

An acquirer's NDA is three agreements in one, plus insider-trading rules

NDA, confidentiality clause, non-compete, non-solicit and trade-secret policy compared

The sample documents, clause by clause

Mutual Non-Disclosure Agreement between Saffron Labs Private Limited and Tungabhadra Forge Industries Limited

1. Parties and Purpose

What it says

What it means for you

What is normal

How to negotiate it

2. Confidential Information

What it says

What it means for you

What is normal

How to negotiate it

3. Exclusions

What it says

What it means for you

What is normal

How to negotiate it

4. Use and standard of care

What it says

What it means for you

What is normal

How to negotiate it

5. Need to know and Representatives

What it says

What it means for you

What is normal

How to negotiate it

6. Permitted and compelled disclosure

What it says

What it means for you

What is normal

How to negotiate it

7. Personal data

What it says

What it means for you

What is normal

How to negotiate it

8. Return or destruction

What it says

What it means for you

What is normal

How to negotiate it

9. No licence, no warranty, no obligation to transact

What it says

What it means for you

What is normal

How to negotiate it

10. Term and survival

What it says

What it means for you

What is normal

How to negotiate it

11. Non-solicitation of employees

What it says

What it means for you

What is normal

How to negotiate it

12. Residual knowledge

What it says

What it means for you

What is normal

How to negotiate it

13. Remedies

What it says

What it means for you

What is normal

How to negotiate it

14. Governing law and jurisdiction

What it says

What it means for you