Employee NDAs vs Vendor NDAs in India: Same Word, Different Rules
Confidentiality obligations on employees and on vendors are enforced differently in India. What works in an employment context, what works with a vendor, the clause that survives exit in each, and how to execute and manage both at scale.
A company protects its information from two directions: people inside (employees, contractors) and parties outside (vendors, partners, prospects). The same template is often used for both, and it fits neither. Employment confidentiality operates inside an employment relationship with its own statutory frame; vendor confidentiality is a commercial contract between businesses. This guide sets out what works in each and how to run both at scale. Position as of October 2026.
Employees
What binds. A confidentiality clause in the employment contract, or a separate employee NDA, binding during employment and surviving exit. Courts enforce confidentiality obligations on former employees as to genuinely confidential information and trade secrets, through injunctions where the information is identified with precision.
What does not. A post-employment non-compete. Section 27 of the Indian Contract Act, 1872 voids restraints of trade; the Supreme Court in Percept D'Mark (India) Pvt. Ltd. v. Zaheer Khan (22 March 2006) stated that a restrictive covenant extending beyond the term "is void and not enforceable", while confirming that restraints during the contract are not caught. Delhi High Court decisions on garden leave (VFS Global Services v. Suprit Roy) treated post-payroll restrictions as restraints. So the employee NDA should carry: a clear definition of confidential information and trade secrets; use and disclosure limits; return of materials on exit; survival for a stated period (longer for trade secrets); and a narrow non-solicitation of clients and colleagues. Not a non-compete.
Employee data. The NDA governs the company's information; the employee's own personal data is processed under the DPDP Act, 2023, where section 7(i) permits processing for employment purposes as a legitimate use, subject to notice and security duties from 13 May 2027. Keep the two separate.
Execution. Sign at joining with the employment contract (Aadhaar eSign or platform signature with OTP), and again when an employee moves into a role with greater access. Store with the employee record; the audit trail matters most at exit.
Vendors
What binds. A commercial NDA between businesses, governed by ordinary contract law. Both the obligation and the remedies are negotiated.
What to add. Beyond the standard clauses: a flow-down obligation (the vendor's staff and sub-contractors bound on equivalent terms); a data-processing clause or a separate processing agreement where the vendor handles personal data (section 8(2), DPDP Act); audit rights for sensitive engagements; and an indemnity for losses caused by the vendor's breach, including regulatory penalties. In-term exclusivity is enforceable; post-term non-compete is not, for the same section 27 reason.
Execution. Mutual or one-way NDA signed before the first disclosure, with DSC or Aadhaar eSign by an authorised signatory; stamp where the state schedule charges agreements; term and survival tracked.
Side by side
| Employee NDA | Vendor NDA | |
|---|---|---|
| Legal frame | Employment contract + Contract Act | Commercial contract |
| Post-term restraint | Confidentiality and narrow non-solicit only | Same |
| Data | Company data under NDA; employee's data under DPDP s. 7(i) | Company data under NDA; personal data under DPDP s. 8(2) processing terms |
| Flow-down | To the employee personally | To vendor's staff and sub-contractors |
| Remedy | Injunction; damages | Injunction; damages; indemnity |
| Signature | At joining and on role change | Before first disclosure |
Managing both at scale
- Two templates, each versioned; a change in law or policy triggers a re-sign campaign.
- A register that shows every current employee and vendor with an NDA on the current version, and every former employee and expired vendor whose obligations are still running.
- Exit process for employees: return and deletion confirmation, access revoked, NDA reminder letter dispatched with a delivery log.
- Vendor offboarding: return or destruction certificate, data erasure confirmation, survival period noted.
Where Legatio fits. Legatio holds both templates, runs bulk re-sign campaigns, executes with audit trails, and reports on NDA coverage and running survival periods across employees and vendors. What the templates say is your policy, within section 27's limits.
Position stated as of October 2026. General information, not legal advice.