Startup NDA and Confidentiality Agreement Checklist for India: Founders, Employees, Vendors and Investors
An NDA protects information only when the definition, permitted use, access controls and evidence trail work together.
Direct answer
A startup NDA should answer five questions without ambiguity: what information is protected, why it may be used, who may receive it, how it must be secured, and what happens when the discussion or relationship ends. A downloaded template that cannot be followed operationally creates confidence, not protection.
Indian NDAs are assessed through general contract principles under the Indian Contract Act, 1872. Electronic records and contracts are recognised under the Information Technology Act, 2000. Where personal data is shared, map the arrangement to the official Digital Personal Data Protection Act, 2023 and applicable commencement rules. The Best CS Firm In India approach is simple: protect the smallest useful information set, share it for a named purpose, and retain proof of access and return.
First decide whether an NDA is the right document
| Situation | Recommended approach | Main risk |
|---|---|---|
| Early investor pitch | Share a non-confidential deck first; use an NDA only where the investor accepts one | Delaying outreach or disclosing too much |
| Vendor product build | NDA plus services agreement, data terms and IP assignment | NDA alone does not transfer deliverables |
| Employee onboarding | Confidentiality and IP clauses in the employment agreement | Separate documents may conflict |
| Strategic partnership | Mutual NDA with a tightly stated evaluation purpose | Information used outside the proposed collaboration |
| Customer security review | Mutual or one-way NDA plus controlled data-room access | Sensitive architecture copied or widely circulated |
| Acquisition discussion | Mutual NDA, clean-team protocol and staged disclosure | Competitively sensitive data reaching operating teams |
Choose one-way or mutual protection
A one-way NDA is suitable where the startup is the only meaningful discloser. A mutual NDA is appropriate where both parties will exchange sensitive material. “Mutual” should not mean mechanically identical: each party’s information, representatives, permitted use and regulatory duties may differ.
- Name the correct legal entities, not only brand names.
- State whether founders, affiliates, advisers and financing sources are covered representatives.
- Make the recipient responsible for permitted representatives on a defined basis.
- Do not add group companies that have no role in the discussion.
Define confidential information precisely
Use categories that match what will actually be shared: source code, architecture, algorithms, product roadmap, pricing, customer lists, contracts, financial models, cap tables, security reports, personal data, prototypes, designs, supplier terms and deal discussions.
| Drafting choice | Why it matters | Founder action |
|---|---|---|
| Written material | Easy to identify and preserve | Mark files and use controlled folders |
| Oral disclosure | Harder to prove later | Require written confirmation within an agreed period |
| Visual/demo access | Screens and prototypes may reveal unmarked information | Record the session and attendee scope |
| Derived information | Analysis may expose the original data | Cover notes, models and extracts containing confidential content |
| Existence of discussions | Market or employee impact may be sensitive | State whether the negotiation itself is confidential |
Include sensible exclusions
A defensible NDA usually excludes information the recipient can evidence was already public, already lawfully known, independently developed without using the disclosure, or lawfully obtained from a third party without a confidentiality restriction.
- Place the evidence burden on the party relying on the exclusion.
- Clarify that a combination is not public merely because individual elements are known.
- Do not exclude information simply because it was not marked if the context made confidentiality obvious.
- Preserve lawful disclosure duties while requiring notice where legally permitted.
State one permitted purpose
“For business purposes” is too broad. Use a purpose such as evaluating a named investment, conducting a security review, negotiating a distribution arrangement or delivering a defined implementation project.
- Describe the transaction or workstream.
- Prohibit competitive use, reverse engineering and unrelated model training where relevant.
- Restrict copying to what the purpose reasonably requires.
- Require purpose-based access rather than organisation-wide access.
- Make a new use subject to written approval.
Build an access and security schedule
| Control | Minimum evidence |
|---|---|
| Need-to-know access | Named user or role list |
| Authentication | SSO/MFA and access logs |
| Download restriction | Data-room settings and exception approval |
| Storage | Approved repository and retention rule |
| Incident reporting | Notice trigger, channel, contact and timeline |
| Subcontractors/advisers | Equivalent duty and documented access |
| Exit | Return, deletion and access-revocation confirmation |
A contract cannot compensate for indiscriminate sharing. Watermark sensitive decks, separate customer-level data, disable public links and stage disclosure according to diligence progress.
Separate confidentiality, data protection and IP
- Confidentiality restricts disclosure and use of protected information.
- Data protection governs personal-data processing, roles, lawful purpose, security, retention and rights workflows.
- IP ownership determines who owns pre-existing material and new output.
- Licence rights permit limited use of software, documentation or trademarks.
An NDA does not automatically assign code, inventions, designs or deliverables. If a vendor or employee will create work, use an express IP assignment and invention-obligation clause in the substantive agreement.
Free Weekly Newsletter
Subscribe to BSA startup funding alerts
- Every Sunday, all Indian startup funding alerts in one place
- Monthly funding report on the last day of the month
- Free, concise, founder-focused, and easy to unsubscribe
Get the complete Indian startup funding roundup in your inbox, covering deals, sectors, investor moves, and founder readiness notes from the week.
Built for founders, investors, CFOs, and advisors
No spam. Unsubscribe anytime.
Handle compelled disclosure properly
Allow disclosure required by law, court, regulator or stock exchange, but require advance notice where lawful, reasonable cooperation and disclosure of only the minimum required material. A recipient should not have to breach a legal duty to preserve secrecy.
Set duration and survival deliberately
| Information type | Practical treatment |
|---|---|
| Ordinary commercial information | Defined confidentiality period based on business shelf life |
| Source code and security credentials | Longer protection while secret and sensitive |
| Personal data | Retain only for the documented purpose and legal need |
| Transaction discussions | Shorter but explicit protection may be appropriate |
| Trade-secret know-how | Protection tied to continued secrecy may be justified |
Do not turn the NDA into an accidental non-compete
Section 27 of the Indian Contract Act makes broad restraints of trade a sensitive issue. Protect specific information and prevent its misuse; do not assume an overbroad clause can stop normal competition or a former employee from using general skill and experience. Non-solicit, non-dealing and non-compete language should receive fact-specific legal review.
Remedies and dispute clauses
- Preserve the right to seek urgent protective relief where legally available.
- Avoid declaring an arbitrary penalty automatically payable for every breach.
- Define liability consistently with the main commercial agreement.
- Choose governing law, courts or arbitration consciously.
- Include a notice channel that works during an incident.
- Do not let the NDA’s dispute clause conflict with the later definitive agreement.
Return, deletion and residual copies
At request or termination, require return or deletion within a practical period. Address automatic backups, legal holds, regulatory archives, email systems and adviser files. Any retained copy should remain protected and inaccessible for commercial use.
Common NDA mistakes founders should avoid
- Using the wrong company or an unincorporated brand as the contracting party.
- Calling everything confidential without a clear permitted purpose.
- Sharing customer personal data before a data-processing arrangement exists.
- Assuming an NDA transfers IP created by a vendor.
- Giving an entire deal room to every recipient.
- Failing to capture oral or demo disclosures.
- Using perpetual restrictions for information with a short commercial life.
- Forgetting return, deletion, compelled-disclosure and representative clauses.
- Signing an investor NDA that blocks the investor from reviewing similar businesses.
- Keeping no proof of what was shared, when, with whom or under which NDA.
A founder’s pre-disclosure checklist
- Confirm the recipient’s legal name and authority.
- Select one-way or mutual form.
- Write the permitted purpose in one sentence.
- Classify information into share now, share later and never share.
- Remove unnecessary personal data and customer identifiers.
- Set access, download, expiry and watermark controls.
- Record every file and attendee.
- Review substantive IP, data and commercial agreements separately.
Founder / Business Takeaway
A strong NDA is short enough to operate and precise enough to enforce. Pair it with staged disclosure, access logging, data minimisation and the correct substantive contract. The objective is not to label every fact secret; it is to protect the information that creates genuine competitive or legal risk.
Suggested internal links
FAQ
When should a startup use an NDA?
Use one before disclosing genuinely sensitive non-public information where the recipient does not already owe a sufficient confidentiality duty.
Should every NDA be mutual?
No. Mutual protection is useful only when both parties expect to disclose protected information.
Does an NDA transfer intellectual property?
No. Use express assignment or licence language in the relevant employment, services or transaction agreement.
Can an NDA prevent a former employee from joining a competitor?
Confidentiality protection is different from a non-compete. Broad post-employment restraints require careful review under Indian law.
