Confidentiality Agreements: Scope, Term, and the Residuals Clause

A confidentiality agreement protects only what its definition of confidential information actually reaches, minus everything the carve-outs hand back, for as long as the survival clause runs. Those three moving parts decide almost every dispute. A fourth part, the residuals clause, can quietly undo the rest by allowing the recipient's employees to use whatever they carry away in unaided memory. Confidentiality agreements are contracts, and contract law is state law, so the same wording can produce different results in different states. Read the definition, the exclusions, the term, and the residuals language together before deciding what an agreement is worth.

1.What the definition reaches

Everything starts with the definition, and two drafting styles dominate. The broad style covers all information disclosed by one party to the other, in any form, whether or not marked. Nothing has to be stamped, so it is easy to administer and easy to breach. Recipients resist it, since a court later asked to enforce it may struggle to identify what was actually secret.

The narrow style covers only information marked "confidential" when disclosed, plus oral disclosures identified as confidential and confirmed in writing within a stated number of days. It is precise, and it fails often in practice, because people forget to mark documents and nobody sends the confirming summary. Whichever style the parties choose is read like any other contract term, under the interpretation principles described in plain meaning, ambiguity, and parol evidence.

All information disclosed

No marking required. Broad protection, but the disclosing party may later have trouble proving which specific material was secret and what the recipient already had.

Marked and designated only

Protection attaches only to material stamped or confirmed in writing. Clear boundaries, and a real risk that valuable information is shared unmarked and unprotected.

Two limits sit beside the definition and matter as much. The permitted purpose states why the information may be used at all — evaluating a deal, performing a supply agreement, servicing an account — and use for any other purpose is a breach even if nothing leaks. The need-to-know limit states who inside the recipient may see the material: employees who need it for that purpose and who are bound by obligations at least as protective.

Whether the agreement is mutual or one-way follows from who is disclosing. A one-way agreement binds only the recipient. A mutual agreement binds both sides, and because each party negotiates knowing it may end up on either side of the terms, mutual drafting tends to produce more balanced language.

2.The carve-outs that give information back

Nearly every confidentiality agreement excludes four categories from protection, and a fifth clause handles legal compulsion. These exclusions are where most real fights land, because the recipient asserting one is usually asserting that it was free to use the material all along.

• Information that is already public, or that becomes public later through no fault or breach of the recipient.
• Information the recipient already knew before the disclosure, which is why written records of prior knowledge matter.
• Information the recipient develops independently without use of or reference to the disclosure.
• Information rightfully received from a third party that owed no confidentiality obligation about it.

Each carve-out carries a proof problem. Independent development is credible only with a dated development record that does not run through the disclosure, and prior knowledge only where it was documented before anything arrived. Well-drafted agreements put the burden of proving a carve-out on the recipient, by written records.

Compelled disclosure is treated differently. It is not an exclusion from confidentiality; it is permission to disclose in a specific situation. The usual clause allows disclosure required by law, regulation, or court order, but conditions it on prompt written notice to the disclosing party where notice is lawful, cooperation in seeking a protective order, and disclosure of only the portion legally required. Court procedures and protective orders are described in general terms at the United States Courts website.

Caution: A carve-out for information that "becomes publicly available" is read against the recipient where the recipient caused the disclosure, but a poorly drafted version without the "through no fault of the recipient" qualifier can be argued to excuse the very breach that made the material public. The qualifier is short, standard, and worth insisting on.

3.Term, survival, and the trade secret problem

Two clocks run in a confidentiality agreement, and people confuse them. The term of the agreement governs how long new disclosures are covered. The survival period governs how long the obligations last for information already disclosed. An agreement can have a one-year term with a five-year survival period, meaning disclosures stop being made after a year but must be protected for five years from disclosure.

The trade secret problem follows directly. A trade secret keeps its legal status for as long as it stays secret and reasonable steps are taken to protect it. If the agreement says all obligations expire five years after disclosure, the recipient can argue that the parties agreed the material may be used freely after year five — including material that would otherwise still be a protectable trade secret. Some courts have accepted that argument, treating the contract as the parties' own definition of how long protection lasts.

The standard fix is a split term: a fixed period for ordinary confidential information, and a carve-out stating that information constituting a trade secret under applicable law remains protected for as long as it qualifies as a trade secret. State trade secret statutes in most states are drawn from a uniform act published by the Uniform Law Commission, and a separate federal civil cause of action for trade secret misappropriation exists under the Defend Trade Secrets Act of 2016. The contract and the trade secret claim are different theories, and losing one does not automatically lose the other.

4.The residuals clause

A residuals clause permits the recipient's personnel to use information retained in their unaided memory — what a person remembers without referring to notes, files, or copies. Typical wording lets individuals who had rightful access use "residuals" for any purpose, sometimes with a statement that the clause creates no license to patents or copyrights.

Read plainly, this can swallow the agreement. Most valuable business information travels in people's heads, not in documents. If an engineer may use whatever she remembers of a competitor's architecture, the confidentiality obligation covers the documents she leaves behind and little else. That is why the clause is heavily negotiated and why disclosing parties in competitive situations often refuse it outright.

Where a residuals clause cannot be removed, several narrowing moves are common: limiting it to individuals who did not intentionally memorize the material, excluding trade secrets, excluding categories such as source code or customer data, stating that the clause licenses no patents or copyrights, and confirming that it permits use but never further disclosure. Each narrowing is a negotiation, and none fully restores what an unqualified clause gives away.

5.Handling, remedies, and the clauses around the edges

Flow-down determines who else is bound. If the recipient may share with affiliates, contractors, or advisors, the agreement should bind those recipients to equivalent obligations and make the original recipient responsible for their breaches. Without that second half, the disclosing party may have no contract with the person who actually leaked.

Return-or-destroy clauses meet reality at the backup tape, since no recipient can promise deletion from every archive. The workable version permits retention of routine backup copies and one archival copy for legal or compliance, while confirming that retained copies stay subject to the confidentiality obligations for as long as they are kept.

Two short provisions prevent misunderstandings. A no-license clause confirms that disclosure grants no ownership, patent, copyright, or other right in the information. A no-obligation-to-proceed clause confirms that neither side must enter the transaction being discussed, which keeps a failed negotiation from becoming a claim. Some agreements add non-solicitation riders barring the hiring of the other side's employees; those riders are restrictive covenants, and state law on restrictive covenants varies sharply, with several states limiting or banning categories of them outright.

On remedies, most agreements recite that a breach would cause irreparable harm for which money damages are inadequate and that the disclosing party is entitled to injunctive relief without posting a bond. A recital helps, but it does not bind a court. Injunctive relief is equitable, and the judge decides whether the standards are met on the actual record, as outlined in the overview of specific performance at Cornell LII. The same instinct that produces these recitals is discussed in specific performance and injunctions in contract disputes.

6.Questions this raises

If information is in an employee's memory, is it still covered?

It depends entirely on whether the agreement contains a residuals clause. Without one, the confidentiality obligation applies to the information regardless of the medium, including what a person remembers, though proving the source of remembered knowledge is difficult. With a residuals clause, use of unaided memory is expressly permitted for anyone who had rightful access, subject to whatever exclusions the clause carries.

Does an expired NDA end trade secret protection?

Not by itself. Trade secret status comes from state statute and, separately, from federal law, and it lasts while the information stays secret and reasonable protective steps continue. But a recipient will argue that a flat expiry shows the parties agreed use was permitted afterward, and some courts have credited that reading. A trade secret carve-out from the expiry avoids the argument.

Is a mutual NDA always the safer choice?

Mutual drafting is usually fairer, not automatically safer. If only one side is disclosing anything sensitive, a mutual agreement gives the other side reciprocal rights it does not need and can create obligations that complicate later work. The better question is who is actually disclosing what. Where information genuinely flows both ways, mutual terms tend to produce more balanced carve-outs and survival periods.

Can the agreement stop a disclosure ordered by a court?

No. A contract cannot override a subpoena, a regulator's demand, or a court order. What the compelled disclosure clause does is set the process: prompt notice to the disclosing party where the law permits notice, reasonable cooperation in seeking a protective order or other confidential treatment, and disclosure limited to the portion legally required. Failing to give notice where notice was required is itself a breach.

7.Reviewing a draft agreement

Read the definition first and decide which style it uses, then check whether your own disclosure practice matches it. If the agreement requires marking and your team will not mark anything, change the clause or change the practice. Next read the carve-outs, confirming that the public-information exclusion carries the "no fault of the recipient" qualifier and that the recipient bears the burden of proving any exclusion.

Then find both clocks: the term for new disclosures, the survival period for past ones, and whether survival runs from disclosure or from termination. Confirm that trade secrets are carved out of any fixed expiry. Search the document for the words "residual" and "memory," because that clause is short, easy to miss, and larger in effect than most of the pages around it.

Finally, check the mechanics. Confirm that affiliates and contractors are bound and that the recipient answers for them, that return-or-destroy language survives contact with backup systems, and that no-license and no-obligation-to-proceed language is present. Note which state's law governs and where disputes must be brought, using the analysis in choice of law and forum selection, since these agreements are governed by state contract law and the governing state can change the answer. Guidance on handling sensitive business data sits at FTC business guidance, and the vocabulary of contract formation at Cornell LII on contracts.