What is NDA?
A non-disclosure agreement (NDA), also called a confidentiality agreement, is a contract that defines certain information as confidential and legally obligates the receiving party not to disclose it or use it outside the agreed purpose. NDAs protect material such as trade secrets, product plans, customer lists, pricing, source code, network designs and security details.
One-way NDA and mutual NDA (MNDA)
- Unilateral (one-way) NDA: only one party shares confidential information, and only the receiving party is bound. An employee, intern or contractor signing an NDA with an employer is the typical case.
- Mutual NDA (MNDA): also called a bilateral or two-way NDA. Both parties expect to share confidential information, so both are bound by the same terms. Two companies evaluating a partnership, or a managed service provider and a prospective client exchanging network and business details before signing a contract, commonly use an MNDA.
What an NDA typically contains
- Definition of confidential information, sometimes limited to material marked confidential.
- Exclusions, such as information that is already public, already known to the recipient, independently developed, or required to be disclosed by law or court order.
- Permitted use: what the recipient may do with the information, and who else, such as employees with a need to know, may see it.
- Duration: how long the obligation lasts, which can continue after the business relationship or employment ends.
- Return or destruction of confidential materials when the relationship ends.
- Remedies for a breach, which can include court orders and damages.
Why NDAs matter in IT work
IT staff and contractors see more confidential information than most employees: administrator passwords, network diagrams, firewall rules, customer records, unreleased products and details of security incidents. Organizations therefore often have technicians, consultants and vendors sign NDAs before granting access. A technician working on a client's servers may be bound by the client's NDA as well as by their own employer's.
An NDA is a legal control, not a technical one. It does not stop anyone from copying data; it creates consequences, such as termination and lawsuits, for disclosing it. Technical controls such as permissions, encryption and DLP work alongside it.
NDA compared with other agreements
| Document | Purpose |
|---|---|
| NDA / MNDA | Keep specific shared information confidential |
| AUP | Define acceptable use of an organization's IT resources |
| EULA | Set the license terms for using a software product |
| SLA | Define measurable service levels a provider promises a customer |
NDA on the CompTIA A+ exam
NDA and MNDA are both on the shared A+ acronym list. They belong to the policy and documentation side of Core 2 operational procedures rather than to any hardware objective.
- If a question describes a document a contractor signs promising not to reveal a client's information, think NDA.
- If both companies will share secrets and both promise to protect them, think MNDA.
- If the document covers proper use of company computers and internet, that is an AUP, not an NDA.
- If the question is about software license terms, think EULA.