Download editable text · Use your browser’s Print command to save a PDF.

Mutual Non-Disclosure Agreement — review draft

Version 0.1 • 7 November 2026 • Business-to-business discussions

DRAFT FOR DISCUSSION — NOT AN EXECUTED AGREEMENT. Complete all bracketed fields, confirm legal identities and authority, and obtain legal review before signature. Durations and dispute provisions are proposals for negotiation. Downloading this sample does not create confidentiality obligations by itself.

1. Parties, effective date and purpose

Party A: IT Service International, trading as RELAY / n0hup, Tomasso Albinonistraat 94, 1083HM Amsterdam, the Netherlands; KvK 72316185; VAT NL422256031B01; email engage@n0hup.nl.
Legal form and full legal contracting identity: [confirm; identify the proprietor if applicable]. Authorised signatory: [name and capacity].
Party B: [full legal name, legal form, registered address, registration number, contact email and authorised signatory].
Effective date: [complete].
Purpose: evaluating, negotiating and, if separately agreed, performing [specific infrastructure assessment, engineering project or other described engagement]. Each party may disclose and receive information; the obligations apply equally in each direction. No unrelated use is permitted.

2. Confidential Information

Confidential Information is non-public information disclosed for the Purpose in any form which is marked confidential or which a reasonable recipient would understand to be confidential given its nature or context. This includes system architecture, security findings, configuration, source code, access information, commercial terms, client or employee information, reports, extracts and notes derived from it. The existence and substance of discussions and the parties’ involvement in the proposed project are also confidential unless agreed otherwise.
Oral or visual disclosures need not be marked where their confidentiality is apparent; the discloser should confirm material points in writing where practical. This Agreement covers disclosures from the effective date. Any earlier disclosures covered must be identified here: [dates and description, or “none”].

3. Exclusions

The recipient must be able to demonstrate that information: (a) is or becomes public without breach; (b) was lawfully known to it without confidentiality restriction before disclosure; (c) was independently developed without use of the Confidential Information; or (d) was lawfully obtained from a third party entitled to disclose it without restriction. A combination of public elements is not excluded merely because its individual elements are public.

4. Use, access and security

The recipient uses Confidential Information only for the Purpose and protects it with at least reasonable care and no less care than it uses for its own comparable information. Access is limited to employees, professional advisers and expressly approved contractors who need it for the Purpose and are bound by confidentiality obligations at least as protective, or equivalent professional duties. The recipient is responsible for their compliance.
No disclosure to an affiliate, other client or external service provider is permitted merely because it is convenient. Do not upload Confidential Information to public repositories, public AI services or unapproved external processing tools. Any external processing requires the discloser’s written approval and appropriate contractual safeguards. Use agreed secure channels, least-privilege access and data minimisation. No publicity, logo use, testimonial or client reference is permitted without prior written consent.

5. Compelled and protected disclosure

If disclosure is legally required, the recipient, to the extent permitted, promptly notifies the discloser, cooperates with reasonable protective measures and discloses only what is legally required. Nothing restricts lawful reporting to regulators or law-enforcement authorities, protected whistleblowing, obtaining legal advice, or disclosures that cannot lawfully be prohibited. Notice is not required where prohibited by law.

6. Incidents

The recipient notifies the discloser without undue delay after discovering unauthorised access, loss, use or disclosure, provides available facts and updates, takes reasonable containment and remediation steps, and cooperates in addressing the incident. Neither party delays legally required notices because information is incomplete. Personal-data incident procedures and deadlines may additionally be set by applicable law and a separate DPA.
Security contacts: Party A [name / monitored email]; Party B [name / monitored email].

7. Ownership and no obligation to proceed

Information remains the discloser’s property. Disclosure grants only a limited right to use it for the Purpose and no intellectual-property licence for other use. Neither party is obliged to disclose information, buy services, enter a project, grant exclusivity or refrain from independent competition. Neither may use Confidential Information to compete. No “residual knowledge” exception permits reuse of protected information.
Information provided for evaluation is supplied without a warranty of completeness or suitability; this does not exclude fraud or obligations expressly undertaken in a separate services agreement. Each party remains responsible for having authority to disclose the information it supplies.

8. Term and survival

Proposed disclosure period: two years from the effective date, unless extended in writing. Either party may end future disclosures on 30 calendar days’ written notice. Ending discussions does not release confidentiality obligations for information already received.
Proposed protection period: five years from each disclosure. Trade secrets remain protected for as long as they qualify as trade secrets under applicable law. Personal data remains subject to applicable law and agreed retention limits; a confidentiality period is not permission to retain it for that period.

9. Return and deletion

On written request or when the Purpose ends, the recipient stops use and, at the discloser’s choice, returns or deletes Confidential Information and derived copies within 30 calendar days and confirms completion in writing on request. Records required by law or professional retention duties may be retained only for those duties. Routine backups not reasonably accessible for selective deletion may remain until overwritten under documented normal cycles; no active use is permitted and any restored copies must again be protected and deleted when no longer required. Retained copies remain subject to this Agreement.

10. Personal data

An NDA is not a data processing agreement, a lawful basis for processing or an international-transfer safeguard. Before processing personal data for the other party, the parties determine their actual roles and agree any required Article 28 GDPR DPA, security arrangements, subprocessors and transfer safeguards. Minimise or redact personal data until these arrangements are complete.

11. Breach and remedies

A party may seek remedies available under applicable law, including proven damages and appropriate urgent court relief. Such relief is subject to the court’s requirements; it is not automatic. This NDA contains no automatic fine, contractual penalty, indemnity or liability cap. Any proposed cap or penalty must be separately reviewed and expressly agreed in writing. A limitation in a later services agreement applies to this NDA only if that agreement expressly identifies this NDA and the agreed amendment.

12. Law, notices and relationship with other agreements

Proposed governing law: the Netherlands. Proposed forum: the competent courts of Amsterdam, subject to mandatory law. Confirm these choices before signing, particularly for cross-border counterparties. The parties first seek an amicable resolution through their named contacts, without delaying urgent protective relief.
Notices go to the designated contact emails with acknowledgement or other evidence of receipt. This Agreement is the entire agreement about confidentiality for the Purpose and may be amended only by written agreement of authorised representatives. It does not replace a DPA. Any later service contract must expressly identify an intended amendment to this NDA. If a provision is unenforceable, the remaining provisions continue and the parties seek a lawful replacement reflecting the original purpose. Electronic signatures may be used by mutual agreement.
Party A notice contact: [name and email]. Party B notice contact: [name and email].

13. Signatures

Party A full legal contracting identity: [complete]
Name / capacity: [complete]
Signature / date: [complete]
Party B full legal contracting identity: [complete]
Name / capacity: [complete]
Signature / date: [complete]