How to Review an NDA in India: A Clause-by-Clause Checklist for Business Teams

Most NDAs are signed in a hurry. A prospect wants a demo, a vendor wants a spec sheet, a candidate wants to see the product roadmap, and someone in sales or HR forwards a template with "please sign and return". The problem is not that NDAs are complicated. It is that the same three or four clauses cause nearly every dispute, and nobody checked them because the document looked standard.

This checklist is written for founders, operations leads, HR and procurement teams who sign NDAs regularly and want to know what actually matters under Indian law, as of October 2026.

1. Start with the definition of "Confidential Information"

Everything else in the NDA hangs off this definition, so read it first.

• Is it marked-only or all-information? A clause that protects only information "marked confidential" will not cover a verbal disclosure in a meeting or a screen-share. If you are the disclosing party, you want a broad definition with a catch-all for information a reasonable person would treat as confidential. If you are the receiving party, a marked-only definition limits your exposure.
• Are the standard exclusions present? Information that is already public, that you already had, that you received lawfully from someone else, or that you developed independently should be carved out. Without these, the receiving side can be accused of "using" information it never needed the NDA for.
• Does it cover personal data? If the exchange includes customer lists, employee records or patient data, the NDA alone is not enough. Under the Digital Personal Data Protection Act, 2023, a Data Fiduciary may only hand personal data to a Data Processor "under a valid contract" (section 8(2)), and the Data Fiduciary stays responsible for safeguards on processing done on its behalf (section 8(5)). Those obligations apply once sections 3 to 17 of the Act commence on 13 May 2027 under the phased timetable in the DPDP Rules, 2025. Add a short data-handling clause or a separate processing agreement rather than stretching the NDA.

2. Check the purpose and permitted use

An NDA should say why the information is being shared and limit use to that purpose. "For the purpose of evaluating a potential business relationship" is standard. Watch for:

• Purpose language wide enough to let the counterparty use your pricing or roadmap in its own business.
• No restriction on who inside the receiving organisation can see the information. A "need-to-know" clause plus a requirement that employees and advisers are bound by equivalent obligations is normal and reasonable.
• Subcontractors and affiliates quietly included as permitted recipients.

3. Know what Indian law will not enforce

This is where Indian NDAs differ from templates downloaded from US or UK sites.

Non-compete clauses. Section 27 of the Indian Contract Act, 1872 makes "every agreement by which any one is restrained from exercising a lawful profession, trade or business of any kind" void, with a narrow exception for the sale of goodwill. The Supreme Court in Percept D'Mark (India) Pvt. Ltd. v. Zaheer Khan (22 March 2006) stated that "a restrictive covenant extending beyond the term of the contract is void and not enforceable", while confirming that the doctrine "does not apply during the continuance of the contract". So a clause that stops a counterparty from competing with you after the NDA ends will generally fail. A confidentiality obligation, by contrast, is not a restraint of trade and can survive termination.

Non-solicitation of employees. Treated more cautiously by courts than confidentiality but less harshly than non-competes. Keep it narrow, time-limited and tied to employees the counterparty actually met through the engagement.

Injunctions. The usual remedy for a threatened leak is an injunction. Section 41(e) of the Specific Relief Act, 1963 bars an injunction "to prevent the breach of a contract the performance of which would not be specifically enforced", which is one more reason to keep restrictive clauses to what a court can actually police: confidentiality, return and destruction of materials, and use limits.

Practical rule: if a clause reads like it is trying to stop someone from doing business rather than from misusing your information, expect it to be unenforceable in India and negotiate accordingly.

4. Term, survival and what happens to the data afterwards

• Term of the agreement vs term of confidentiality. These are different. A 1-year NDA with a 3-year confidentiality survival period is common. Trade secrets (formulas, source code, pricing models) can justify an obligation that lasts as long as the information stays secret.
• Return or destruction. Require return or certified destruction on request or termination, with a reasonable carve-out for archival backups that are not accessed.
• No implied licence. State that nothing in the NDA transfers IP or grants a licence beyond the stated purpose.

5. Remedies, governing law and dispute resolution

• Governing law and courts. For two Indian parties, name Indian law and a specific court or arbitral seat. Section 28 of the Contract Act voids clauses that bar a party from legal proceedings altogether, but an arbitration clause is expressly saved by its first exception.
• Liquidated damages. Under section 74 of the Contract Act, a stipulated sum is recoverable only as reasonable compensation not exceeding the amount named, so an inflated penalty figure will not be awarded as written.
• Indemnity for third-party claims. Reasonable for breaches that expose the disclosing party to regulatory action (for example, a personal data breach caused by the recipient).

6. Execution: how the NDA is signed matters

Under section 5 of the Information Technology Act, 2000, where a law requires a signature, that requirement is met by an electronic signature affixed in the manner prescribed by the Central Government, and section 10A confirms that contracts formed electronically are not unenforceable merely because electronic means were used. An NDA is not among the documents excluded from electronic execution in the Act's First Schedule (which, after the 26 September 2022 amendment, covers certain negotiable instruments, certain powers of attorney, trusts and wills). So NDAs can be executed with Aadhaar eSign, a Digital Signature Certificate, or another electronic method, provided you keep the audit trail: who signed, when, from where and against which version of the document. Since 1 July 2024, electronic records are proved under section 63 of the Bharatiya Sakshya Adhiniyam, 2023, which requires a certificate identifying the record and the device that produced it, so a complete execution log is what makes the NDA usable in court.

A two-minute review routine

1. Read the definition of Confidential Information and the exclusions.
2. Read the purpose clause and the list of permitted recipients.
3. Strike or narrow any post-term non-compete; keep non-solicit short and specific.
4. Confirm the survival period and the return/destruction clause.
5. Confirm governing law, forum and that any damages figure is a genuine pre-estimate.
6. Sign electronically through a workflow that records the audit trail and stores the executed version centrally.

Where Legatio fits. Teams that handle NDAs in volume keep a pre-approved template with the clause positions above, route exceptions to legal automatically, and execute through an e-signature workflow that captures the audit trail and files the signed copy. That is what a contract lifecycle platform like Legatio is built for; the legal positions in this article apply regardless of the tool you use.

Position stated as of October 2026. This article is general information for business readers, not legal advice.