What Should an NDA Include? The Five Clauses Founders Miss Before They Sign

Written by Aisha McKinney, Esq., Principal Attorney & Co-Founder at Zova Law, and Jasmine Johnson Parker, Esq., Co-Founder & Counsel at Zova Law.

Quick Answer: A properly protective NDA for founders should include five provisions: (1) a definition of confidential information that covers oral disclosures; (2) narrow permitted disclosure exceptions; (3) no residuals clause or a narrowly scoped one; (4) a duration of three to five years minimum with indefinite protection for trade secrets; and (5) mutual confidentiality obligations. Missing any one of these is a specific place where protection fails.

Most founders have signed an NDA without reading it. The NDA was drafted by the other party and presented as standard. Both parties signed. The founder assumed protection was mutual. In most cases, it wasn’t. This post covers the five provisions that determine whether an NDA actually protects you — and what to ask for when they’re missing.

What Is an NDA and Who Does It Protect?

A non-disclosure agreement (NDA) — also called a confidentiality agreement — is a legal contract that restricts one or both parties from disclosing specified information to third parties. NDAs are used in investor pitches, vendor relationships, employment agreements, and partnership negotiations.

The critical distinction most founders miss: the protection in an NDA runs in the direction the drafter designed it. An NDA drafted by an investor’s legal team is written to protect the investor’s flexibility while restricting the founder’s rights. A mutual NDA should protect both parties equally — but ‘mutual’ in the title does not guarantee mutual protection in the provisions.

The Five NDA Clauses Founders Consistently Miss

Clause 1: Definition of Confidential Information

The definition of confidential information determines what is actually protected under the NDA. Most investor NDAs define confidential information as ‘information disclosed in written form’ or ‘information marked as confidential at the time of disclosure.’

Under this definition, a verbal pitch presentation is not confidential information. A phone call is not confidential information. Any oral disclosure not followed up in writing is not covered. For most founders, this means the most important information shared during a pitch may not be protected at all.

What to ask for: ‘All information disclosed by either party, whether in oral, written, electronic, or any other form, shall be considered Confidential Information, provided that oral disclosures are confirmed in writing within thirty (30) days of disclosure.’

Clause 2: Permitted Disclosure Exceptions

The permitted disclosure exceptions clause lists who the receiving party is allowed to share confidential information with without breaching the NDA. Most investor NDAs include exceptions for ‘employees, advisors, consultants, and affiliated entities who have a need to know.’

In practice, this means the investor’s team can share what you disclosed with their co-investors, their advisory board, their portfolio company operators, and any consultant they retain — without breaching the NDA. The phrase ‘need to know’ is rarely defined and is difficult to enforce. Affiliated entities can include portfolio companies that are direct competitors.

What to ask for: Named categories of permitted recipients with a specific ‘need to know’ requirement tied to evaluating the transaction. An obligation requiring those recipients to be bound by confidentiality obligations equivalent to the NDA. No exceptions for affiliated entities without your written consent.

Clause 3: Residuals Clause

A residuals clause allows the receiving party to use information retained in the ‘unaided memory’ of their personnel without breaching the NDA. The practical effect: even if the investor’s team cannot access your documents, they can use everything they remember from your pitch and technology demonstration as long as they claim it was retained in memory rather than taken from a document.

What to ask for: Remove the residuals clause entirely. If the other party insists, negotiate a scope limited to general industry knowledge and explicitly excluding specific business plans, technology details, financial data, and customer information.

Clause 4: Duration and Post-Term Obligations

Most investor NDAs expire in 90 days to two years. After expiration, the confidentiality obligation ends — the receiving party is free to use or share what was disclosed without breaching. For founders sharing technology or early-stage business plans, a two-year NDA may expire before the information has lost its competitive value.

What to ask for: A minimum duration of three to five years for general confidential information. An indefinite survival clause for trade secrets: ‘Notwithstanding the foregoing, obligations of confidentiality with respect to information constituting a trade secret under applicable law shall survive termination of this Agreement for as long as such information remains a trade secret.’

Clause 5: Mutual vs. One-Way Protection

A one-way NDA protects only the information disclosed by one party — typically the founder. The receiving party has no confidentiality obligation regarding their own information. A mutual NDA extends confidentiality obligations in both directions.

The label on the cover page is not determinative. An agreement titled ‘Mutual Non-Disclosure Agreement’ may still contain provisions that effectively run protection in one direction. Review the obligations section, not just the title.

What to ask for: Explicit mutual confidentiality obligations. Language that reads ‘each party agrees to maintain the confidentiality of the other party’s Confidential Information’ rather than designating one party as the Receiving Party throughout.

Frequently Asked Questions About NDAs for Founders

What clauses should be in an NDA for a small business?

At minimum: a definition of confidential information covering oral disclosures, permitted disclosure exceptions with named categories and a need-to-know requirement, no residuals clause or a narrowly scoped one, a duration of three to five years with indefinite protection for trade secrets, and mutual confidentiality obligations. Beyond these five, a well-structured NDA should also include governing law, dispute resolution, equitable relief provisions, and a clear process for returning or destroying confidential materials at relationship end.

Should a founder sign an investor’s NDA?

Most institutional investors will not sign NDAs before initial pitch meetings. If an investor does send an NDA before a meeting, review it carefully. Investor-drafted NDAs are almost always structured to protect the investor’s flexibility. If you’re sharing technology or trade secrets, consult an attorney before the meeting.

What is the difference between a mutual NDA and a one-way NDA?

A mutual NDA protects both parties’ confidential disclosures. A one-way NDA protects only the disclosing party’s information. When a vendor, corporate partner, or investor hands you their standard NDA, it is almost always a one-way NDA structured to protect the disclosures you make to them, with carve-outs designed to preserve their operational flexibility.

What happens if an NDA is breached?

Remedies for NDA breach typically include injunctive relief (a court order stopping further disclosure), monetary damages for provable financial harm, and in some cases attorneys’ fees. Proving breach and calculating damages is difficult — particularly when the confidential information was disclosed verbally, when a residuals clause applies, or when the NDA has already expired. The most effective NDA enforcement strategy is a well-drafted NDA that closes these gaps before signing.

How long should an NDA last?

Three to five years is the standard range for general business confidential information. Trade secrets should be protected indefinitely under the NDA — with survival language tied to the information’s status as a trade secret under the Defend Trade Secrets Act (18 U.S.C. § 1836) or applicable state law.

If you’re entering a new investor relationship, vendor agreement, or partnership and have an NDA to sign — or one to send — the Legal Gap Consultation at Zova Law is the right starting point. In 30 minutes, I’ll review the NDA against the five provisions above, identify exactly what’s missing, and tell you what a properly structured agreement would need to say for your specific relationship. Book at legalgap.zovalaw.com.