Confidentiality Agreement Checklist: Definitions, Exclusions, Residuals, and Return of Information

By Casey Scott McKay · 2025-08-24

Confidentiality agreements fail on provisions nobody discussed, in situations nobody anticipated. This checklist runs one from form selection through drafting, negotiation, execution, administration, and enforcement, in twelve phases. It covers the definition and the marking decision, the permitted purpose, the exclusions and the compelled-disclosure carve-out, the residuals clause and how to fence it, permitted recipients and flow-down, the standard of care floor, term and survival with the trade secret carve-out, return and destruction drafted so the certification can be true, the short clauses that prevent long arguments, and the immunity notice. It adds setting-specific boxes for transactions, joint development, vendors, and employees. Each box gives the reason, the authority where there is one, and the trap.

IP and Technology > Trade Secrets | Checklist | Published 24 August 2025 - Updated 26 December 2025 | Casey Scott McKay - marksy.us

Summary. Confidentiality agreements fail on provisions nobody discussed, in situations nobody anticipated. This checklist runs one from form selection through drafting, negotiation, execution, administration, and enforcement, in twelve phases. It covers the definition and the marking decision, the permitted purpose, the exclusions and the compelled-disclosure carve-out, the residuals clause and how to fence it, permitted recipients and flow-down, the standard of care floor, term and survival with the trade secret carve-out, return and destruction drafted so the certification can be true, the short clauses that prevent long arguments, and the immunity notice. It adds setting-specific boxes for transactions, joint development, vendors, and employees. Each box gives the reason, the authority where there is one, and the trap.

Keywords: NDA checklist, form selection, mutual versus one-way, definition of confidential information, marking discipline, permitted purpose, standard exclusions, residuals clause, permitted recipients, flow-down obligations, standard of care, compelled disclosure, term and survival, trade secret carve-out, return and destruction, no license, feedback assignment, DTSA immunity notice, agreement repository, enforcement

How to use this checklist

| Phase | What it covers | |---|---| | 1 | Form selection | | 2 | The definition | | 3 | The permitted purpose | | 4 | Exclusions and compelled disclosure | | 5 | Residuals | | 6 | Recipients, flow-down, and care | | 7 | Term and survival | | 8 | Return and destruction | | 9 | The short clauses | | 10 | Reviewing a counterparty's form | | 11 | Setting-specific terms | | 12 | Administration and enforcement |

Boxes marked [Gate] should clear before signing.

The matter. A sensor company disclosing its calibration approach to a large automotive supplier, under the supplier's standard mutual form.

Phase 1. Form selection

[ ] Determine who is disclosing, and in what proportion.
- Why. A one-way agreement can be drafted aggressively because only the counterparty bears the burden. A mutual agreement is a mirror.
[ ] [Gate] Ask whether the client will comply with what it is asking for.
- Trap. A mutual agreement with a marking requirement the client will not maintain and a return obligation it cannot certify.
[ ] Identify what is being disclosed.
- Why. Technical information needs longer survival and a trade secret carve-out. Personal data brings privacy obligations a confidentiality clause does not satisfy.
[ ] Confirm the correct legal entities.
- Trap. A group that signs through one company and discloses through another.
[ ] Consider asymmetric survival where both parties disclose but one discloses far more.

Phase 2. The definition

[ ] Choose broad, narrow, or the middle path, deliberately.
- Why. Broad captures oral and inadvertent disclosures. Narrow requires marking and is unforgiving.
[ ] [Gate] If marking is required, confirm the client will mark.
- Trap. Nobody marks the fourth slide deck, and that is where the case is.
[ ] Capture disclosures made by or on behalf of the discloser.
- Why. Advisors and affiliates disclose too.
[ ] Capture disclosure by inspection of tangible objects.
- Why. A facility tour is otherwise arguable.
[ ] Include derivative work product in transaction agreements.
- Trap. The buyer's own analyses of the target's information falling outside the definition.
[ ] If an oral-disclosure summary is required, extend the window and build it into the meeting workflow.

Phase 3. The permitted purpose

[ ] [Gate] Write it specifically.
- Why. Not "evaluating a potential business relationship." Name the product, the program, and the evaluation.
[ ] Add a trailing prohibition on competitive, commercial, and product development use.
- Why. It answers the argument that development informed by the information was not a use of it.
[ ] Cover the negotiation as well as the evaluation.
[ ] Amend when the relationship changes.
- Why. A short amendment costs less than an argument about coverage.

Phase 4. Exclusions and compelled disclosure

[ ] Include the four standard exclusions.
- Why. Already public; already known without obligation; received from a third party without restriction; independently developed.
[ ] Tighten the third-party exclusion.
- Why. Require that the recipient have no reason to believe the third party was itself bound, or the exclusion becomes a route around the agreement.
[ ] Require contemporaneous written records for prior knowledge and independent development.
- Why. It converts an assertion into a burden.
[ ] Add "or reference to" in the independent development exclusion.
- Why. Closes the argument that the information was consulted but not copied.
[ ] Put compelled disclosure in as a carve-out, not an exclusion.
- Why. Information does not stop being confidential because a subpoena arrived.
- Trap. No carve-out at all, which puts a recipient served with a subpoena in breach either way.
[ ] Require notice, cooperation, and disclosure limited to what is legally required.

Phase 5. Residuals

[ ] [Gate] Read for it before anything else in a counterparty's form.
- Why. It is usually one sentence in the obligations paragraph and it is close to a complete defense.
[ ] Strike it if you are the discloser.
[ ] If it cannot be struck, fence it four ways.
- Why. Exclude trade secrets. Limit to individuals with authorized access. Require memory to be genuinely unaided rather than refreshed by notes. Exclude use for competing products.
[ ] Understand why the recipient wants it.
- Why. A company with hundreds of engineers cannot prove nobody recalled anything. The concern is legitimate and can be met without giving away the trade secrets.

Phase 6. Recipients, flow-down, and standard of care

[ ] Define permitted recipients.
- Why. Employees, contractors, professional advisors, and affiliates with a need to know for the purpose.
[ ] [Gate] Require flow-down with responsibility.
- Why. Bound by written obligations at least as protective, with the receiving party responsible for their breach as though it were its own.
- Trap. The most commonly missing provision, and the reason supply chains leak.
[ ] Set a floor on the standard of care.
- Why. The same degree of care used for the recipient's own confidential information of similar importance, and in no event less than reasonable care.
- Trap. No floor, so a recipient with poor practices has agreed to very little.
[ ] Consider a named-individuals list where the information is highly sensitive and the group small.
[ ] Consider audit or certification rights for extended holdings.

Phase 7. Term and survival

[ ] Distinguish the agreement's term from the obligations' survival.
- Trap. Treating them as one period.
[ ] [Gate] Carve out trade secrets.
- Why. Obligations run for the stated period generally, and for so long as the information remains a trade secret as to trade secrets.
- Authority. 18 U.S.C. § 1839(3).
- Trap. A flat three-year period, which supports an argument that protection ends on a calendar date.
[ ] Match the general period to the information's useful life.
[ ] Do not make everything perpetual.
- Why. A recipient asked to hold all information forever will refuse or will sign and ignore it.

Phase 8. Return and destruction

[ ] [Gate] Draft it so it can be performed.
- Why. Carve out routine electronic backup and archival copies, with obligations continuing until deletion in the ordinary course.
- Trap. A clause requiring complete destruction and a certification that is therefore false.
[ ] Permit one retained copy for legal and compliance purposes.
[ ] Require certification by an officer.
[ ] Prefer destruction over return for voluminous electronic material.

Phase 9. The short clauses

[ ] No license. Disclosure conveys no license under any patent, copyright, or other right.
[ ] No warranty. Information is provided as is.
[ ] No obligation to proceed. Neither party must enter any transaction.
[ ] Feedback. Comments on the discloser's product assigned or licensed broadly.
[ ] Injunctive relief acknowledgment.
- Authority. Fed. R. Civ. P. 65.
- Why. It does not bind a court and it is quoted in nearly every successful motion.
[ ] [Gate] The immunity notice.
- Authority. 18 U.S.C. § 1833(b).
- Why. Its omission forfeits exemplary damages and fees under 18 U.S.C. § 1836(b)(3).
- Trap. Discovered at the remedies stage, when nothing can be done.
[ ] Assignment and change of control.
[ ] Governing law and forum.
- Why. These decide which state's trade secret statute applies to the contract claim and where suit is brought.
[ ] Notices, entire agreement, amendment, counterparts, severability, and signature authority.

Phase 10. Reviewing a counterparty's form

Six checks, in this order, before signing.

[ ] Is there a residuals clause?
[ ] What is the definition, and will the client comply?
[ ] How broad is the permitted purpose?
[ ] What survives, for how long, and are trade secrets carved out?
[ ] Is there a non-solicitation or standstill hiding in it?
- Trap. An NDA signed to receive a pitch deck that restricts hiring.
[ ] What law governs and where is the forum?
[ ] When the form cannot be changed, calibrate the disclosure instead.
- Why. An NDA that cannot be negotiated is information about how much to share.

Phase 11. Setting-specific terms

Transactions

[ ] Evaluation material defined to include the recipient's notes and analyses.
[ ] Standstill, with a fall-away on a third-party offer.
[ ] Non-solicitation with carve-outs for general advertising and unsolicited approaches.
[ ] No contact with customers, suppliers, or employees except through designated representatives.
[ ] Clean team protocol where the parties compete.
[ ] Destruction rather than return.

Joint development

[ ] Background and foreground information distinguished.
[ ] Ownership of foreground stated, with a license to the other party.
- Why. Joint patent ownership is the default nobody wants: each co-owner may practice and license independently, and all must join to sue.
[ ] Who may file, on what.
- Authority. 35 U.S.C. § 291; 35 U.S.C. § 135; 35 U.S.C. § 256.
[ ] Recognition that filing ends secrecy.
- Authority. 35 U.S.C. § 122.
[ ] Improvements addressed.
[ ] Publication review window for research collaborators.

Vendors and suppliers

[ ] Security requirements and breach notification with a stated deadline.
[ ] Audit rights.
[ ] Flow-down to subcontractors.
[ ] Return on termination.
[ ] A separate data processing addendum where personal data is involved.

Employees and contractors

[ ] Present-tense assignment language.
- Authority. 35 U.S.C. § 261.
- Why. A promise to assign in the future does not itself transfer title.
[ ] Written copyright assignment for contractors.
- Why. Copyright does not vest in the hiring party by default and the work made for hire categories are narrow.
[ ] The immunity notice in every such agreement.
[ ] Signed before the first day.
[ ] Interviewers instructed not to ask about a candidate's former employer's technology, with the instruction recorded.

Phase 12. Administration and enforcement

[ ] Maintain a repository.
- Why. Counterparty, date, form, permitted purpose, survival period, and the executed copy. It answers the first question in every dispute.
[ ] Maintain a short approved form set.
- Why. One-way outbound, one-way inbound, mutual, and vendor, with guidance on which to use.
[ ] Calendar survival expirations for meaningful disclosures.
[ ] Log disclosures.
- Why. A data room index or disclosure log turns an evidentiary problem into an exhibit.
[ ] Set signature authority by deviation from the standard form, not by transaction value.
[ ] Store the executed version, not the draft.
[ ] On breach, move within days.
- Authority. Fed. R. Civ. P. 65.
- Why. Delay undercuts the irreparable harm showing.
[ ] Plead the contract claim alongside the statutory one.
- Authority. 18 U.S.C. § 1836.
- Why. It survives preemption, reaches information that is not a trade secret, and does not require proving reasonable measures.
[ ] Expect a protective order in any litigation.
- Authority. Fed. R. Civ. P. 26(c).

Phase 13. Model language, with the reason for each phrase

Keep these formulations at hand. Each box notes why it reads the way it does.

[ ] Definition, discloser-favorable.
- "Confidential Information means all information disclosed by or on behalf of the Disclosing Party, whether orally, in writing, or by inspection of tangible objects, that is either designated as confidential at the time of disclosure or that a reasonable person would understand to be confidential given its nature or the circumstances of disclosure."
- Why. "By or on behalf of" captures advisors and affiliates. "By inspection of tangible objects" captures a facility tour. The disjunctive prevents an unmarked document from falling out.
[ ] Permitted purpose with a trailing prohibition.
- "The Receiving Party may use Confidential Information solely for the Purpose and for no other purpose, including without limitation any competitive, commercial, or product development purpose."
- Why. The enumeration answers the argument that development informed by the information was not a use of it.
[ ] Flow-down with responsibility.
- "...only to those of its employees, contractors, and professional advisors who have a need to know for the Purpose and who are bound by written obligations at least as protective as those in this Agreement. The Receiving Party is responsible for any breach by such persons as though it were its own."
- Why. Without the last sentence the discloser must sue a subcontractor it never contracted with.
[ ] Standard of care with a floor.
- "...at least the same degree of care it uses for its own confidential information of similar importance, and in no event less than a reasonable degree of care."
- Why. "Of similar importance" prevents comparison to the recipient's least sensitive material.
[ ] Independent development, tightened.
- "...independently developed without use of or reference to Confidential Information, as evidenced by contemporaneous written records."
- Why. "Or reference to" closes the consulted-but-not-copied argument; the records requirement converts assertion into burden.
[ ] Survival with the trade secret proviso.
- "...survive for five years following disclosure, provided that with respect to any Confidential Information that constitutes a trade secret under applicable law, those obligations continue for so long as the information remains a trade secret."
- Authority. 18 U.S.C. § 1839(3).
[ ] Return and destruction, performable.
- "...except that the Receiving Party may retain copies contained in routine electronic backup or archival systems, and one copy retained by its legal department for compliance purposes, in each case subject to the continuing obligations of this Agreement."
- Why. This is what makes the officer's certification true.
[ ] Immunity notice.
- "An individual shall not be held criminally or civilly liable under any federal or state trade secret law for the disclosure of a trade secret that is made in confidence to a federal, state, or local government official, either directly or indirectly, or to an attorney, solely for the purpose of reporting or investigating a suspected violation of law; or is made in a complaint or other document filed in a lawsuit or other proceeding, if such filing is made under seal."
- Authority. 18 U.S.C. § 1833(b).

Phase 14. What to spend negotiating capital on

[ ] The residuals clause, first.
- Why. The one provision that can render everything else decorative.
[ ] The trade secret carve-out to survival, second.
- Why. One clause, rarely resisted, and it prevents an argument that protection expired on a calendar date.
[ ] Flow-down with responsibility, third.
- Why. The gap that leaves supply chains unprotected, and it is granted more often than not.
[ ] A specific permitted purpose, fourth.
- Why. Cheap to obtain because the recipient perceives no cost.
[ ] The immunity notice, fifth.
- Why. Almost never resisted, and its absence is expensive.
[ ] Do not spend it on the general survival length once trade secrets are carved out.
[ ] Do not spend it on governing law unless the chosen state has an unusual rule on preemption, covenants, or limitations. Check, then move on.
[ ] Do not spend it on reciprocity for terms the client will never invoke.
[ ] Do not spend it on boilerplate.
- Why. Nobody has lost a confidentiality case on the counterparts clause.
[ ] Calibrate the effort to the disclosure.
- Why. For a routine vendor conversation, sign and move. For the disclosure of the thing the company is built on, the fifteen minutes and one redline are the cheapest insurance available.

Phase 15. Failure modes, collected

[ ] The standard mutual form used for a one-way technical disclosure. The client accepts a marking discipline it will not maintain and a return obligation it cannot certify.
[ ] A residuals clause signed without being read.
[ ] The permitted purpose written as "a potential business relationship."
[ ] A marking requirement accepted by a client that does not mark.
[ ] No follow-up summary after an oral disclosure, where the form requires one within thirty days.
[ ] Flow-down omitted, so the subcontractor owes nothing.
[ ] The wrong entity signs.
[ ] Standard of care set at the recipient's own practices with no floor.
[ ] No compelled-disclosure carve-out, putting a recipient served with a subpoena in breach either way.
[ ] A flat survival period applied to trade secrets.
[ ] Return obligations that cannot be performed, with a certification signed anyway.
[ ] Derivative work product omitted from a transaction agreement's definition.
[ ] A two-page NDA used for an eighteen-month joint development, so ownership of what the collaboration produced was never addressed.
[ ] Future-tense assignment language in an employee agreement.
- Authority. 35 U.S.C. § 261.
[ ] No written copyright assignment from a contractor.
[ ] A non-solicitation absorbed rather than negotiated.
[ ] No repository, so nobody knows what has been signed or on what terms.
[ ] The immunity notice omitted.

Phase 16. Two scenarios that show how these fail

[ ] The pitch that became a product.
- What happened. A component maker presented a sensor design to a manufacturer over four meetings under the manufacturer's standard mutual form. Eighteen months later the manufacturer launched a product using the approach.
- Why the claim failed. The form required marking; the first deck was marked and the three later ones were not, and the detail that mattered was in the fourth. A residuals clause with no trade secret carve-out was present. The permitted purpose was "evaluating a potential business relationship." And the manufacturer produced a development record showing parallel internal work predating the first meeting.
- The lesson. All four problems were fixable in a fifteen-minute negotiation before the first meeting, and none was noticed because the form was presented as standard.
[ ] The vendor that subcontracted.
- What happened. A software company gave a systems integrator its architecture documentation under a well-drafted mutual agreement with a specific purpose, no residuals clause, and a proper survival structure. The integrator engaged an offshore subcontractor, which received the documentation.
- Why the claim was difficult. No flow-down provision. The subcontractor owed nothing contractually and had a plausible argument that it received the information without notice of any restriction. The claim had to run on trade secret theory, which required proving reasonable measures for information the client had handed to an unbound third party through its own contract.
- The lesson. One sentence requiring permitted recipients to be bound by obligations at least as protective would have avoided the entire dispute.
[ ] The pattern in both.
- Why. These agreements fail on provisions nobody discussed, in situations nobody anticipated, and the fifteen minutes spent reading the form is the cheapest work in the relationship.

Phase 17. What the agreement cannot do

Worth reviewing with any client who expects more from the document than it delivers.

[ ] It cannot protect what you disclose publicly.
- Why. A conference presentation, a published specification, or a feature visible on inspection is outside any agreement.
[ ] It cannot prevent independent development.
- Why. The exclusion is standard and the statute recognizes independent derivation as proper. 18 U.S.C. § 1839(6).
[ ] It cannot prevent reverse engineering of a lawfully obtained product, unless it expressly prohibits it and the prohibition is enforceable in the jurisdiction.
[ ] It cannot make general knowledge proprietary.
- Why. An employee's accumulated skill and experience are theirs.
[ ] It cannot substitute for access controls.
- Why. Reasonable measures means practices, not paperwork. An agreement covering information that circulates freely inside the company will not establish the element on its own. 18 U.S.C. § 1839(3).
[ ] It cannot bind someone who never signed it.
- Why. Flow-down exists for this reason.
[ ] It cannot override the statutory immunity.
- Authority. 18 U.S.C. § 1833(b).
[ ] It cannot transfer ownership or grant a license.
- Why. Separate provisions do that, and their absence is why the no-license clause exists.
[ ] It cannot preserve secrecy through a patent filing.
- Authority. 35 U.S.C. § 122.
- Why. Publication at eighteen months ends the secret in the disclosed subject matter, and the choice between regimes is made long before any dispute.

Phase 18. The pre-signature read

Five minutes, in this order, on any agreement about to be signed.

[ ] Read the definition. Does it capture what will actually be disclosed, in the form it will be disclosed?
[ ] Read the obligations paragraph for residuals.
[ ] Read the permitted purpose. Could the counterparty's later use be described as within it?
[ ] Read the exclusions. Is the third-party exclusion tightened? Does independent development require records?
[ ] Read the survival provision. Are trade secrets carved out?
[ ] Read the recipients clause. Is flow-down present, with responsibility?
[ ] Scan for a non-solicitation, a standstill, or a non-compete.
[ ] Confirm the entities and the signature authority.
[ ] Confirm the immunity notice is present.
[ ] Confirm the return clause can be complied with.

If all ten are satisfactory, sign. If one is not, decide whether to negotiate it or to calibrate the disclosure around it. Those are the only two responses, and choosing between them consciously is the whole of the discipline.

Phase 19. Building the form set

Most organizations need four forms and no more. Building them once prevents most of the administrative failures.

[ ] One-way outbound. Used when the client discloses and the counterparty does not. Drafted aggressively: broad definition, no residuals, long survival with a trade secret carve-out, strict flow-down, narrow permitted purpose.
[ ] One-way inbound. Used when the client receives. Drafted defensively: narrow definition with a marking requirement, standard exclusions with the independent development exclusion preserved, a residuals clause, moderate survival, and a return clause with the backup carve-out.
[ ] Mutual. Used for ordinary two-way commercial discussions. Balanced, because every term is a mirror. This is the form that most often needs a compliance judgment about marking.
[ ] Vendor and supplier. Confidentiality plus security requirements, breach notification with a deadline, audit rights, flow-down to subcontractors, and return on termination. Cross-referenced to a data processing addendum where personal data is involved.
[ ] Write guidance on which to use, in a page, for the people who send them. Sales, procurement, engineering, and corporate development all send NDAs and none of them will read a memorandum longer than a page.
[ ] Set an approval rule by deviation. Anyone may send an unmodified form; any redline goes to legal.
[ ] Review the set annually, and after any dispute. A failure in one matter is information about the form.
[ ] Keep a fallback position sheet listing, for each key term, the preferred language, the acceptable compromise, and the walk-away. It turns a negotiation into a lookup and it lets business people resolve most of them without counsel.

Phase 20. Where the agreement meets the rest of the program

[ ] Confirm the agreement is one measure among several.
- Why. Reasonable measures under 18 U.S.C. § 1839(3) means access controls, marking, monitoring, onboarding, and exit procedures as well as paperwork.
[ ] Tie the agreement to an information inventory.
- Why. A company that cannot say what its secrets are will not be able to identify them in litigation, and the agreement does not supply that.
[ ] Tie it to the exit process.
- Why. The return obligation is only real if someone runs it, and the departure is where a confidentiality program is tested.
[ ] Tie it to the onboarding process for incoming hires.
- Why. A written instruction that a new employee must bring nothing from a former employer protects against the mirror-image claim.
[ ] Coordinate with the patent strategy.
- Why. Filing publishes at eighteen months and ends the secret. 35 U.S.C. § 122.
[ ] Review the agreement set after any dispute.
- Why. A failure in one matter tells you what to change in every form.

Outcome. The residuals clause was fenced four ways rather than struck. The marking window was extended and a carve-out added for information obviously confidential by its nature. The permitted purpose was narrowed to the specific integration, granted without discussion. Survival stayed at three years with a trade secret carve-out, which was the term that mattered. Flow-down was strengthened. The one-way non-solicitation was left alone. The immunity notice was inserted, with a question about what it was. One redline, one call, four days.

Key Authorities at a Glance

| Authority | Proposition | Phase | |---|---|---| | 18 U.S.C. § 1839(3) | Trade secret definition; reasonable measures | 7 | | 18 U.S.C. § 1839(5) | Misappropriation; breach of duty | 12 | | 18 U.S.C. § 1839(6) | Improper means; reverse engineering | 4 | | 18 U.S.C. § 1836 | Civil action; remedies | 12 | | 18 U.S.C. § 1833(b) | Immunity and required notice | 9 | | 18 U.S.C. § 1832 | Criminal theft of trade secrets | 12 | | 18 U.S.C. § 1030 | Computer access | 12 | | 35 U.S.C. § 122 | Publication; ends secrecy | 11 | | 35 U.S.C. § 135 | Derivation proceedings | 11 | | 35 U.S.C. § 256 | Correction of inventorship | 11 | | 35 U.S.C. § 261 | Assignment in writing | 11 | | 35 U.S.C. § 291 | Derived patents | 11 | | Fed. R. Civ. P. 65 | Injunctive relief | 9, 12 | | Fed. R. Civ. P. 26(c) | Protective orders | 12 | | Fed. R. Civ. P. 34 | Inspection of systems | 12 |

The five things people get wrong

One: they never read for the residuals clause. It is one sentence in the middle of the obligations paragraph, it permits use of anything a person remembers, and it is close to a complete defense. If only one term can be changed, change this one.

Two: they accept a marking requirement they will not meet. Nobody marks the fourth slide deck and nobody writes the summary after the technical call. The decision belongs to whoever knows how the client actually works.

Three: they omit flow-down. Subcontractors and advisors see the information and owe nothing, which is the most common structural gap in supply chain agreements and the easiest to close.

Four: they apply a flat survival period to trade secrets. A three-year obligation on trade secret information supports an argument that the parties agreed protection ends after three years. One proviso fixes it. 18 U.S.C. § 1839(3).

Five: they leave out the immunity notice. One paragraph, almost never resisted, and its absence forfeits exemplary damages and fees against that person — discovered at the remedies stage when nothing can be done. 18 U.S.C. § 1833(b). See Drafting and Negotiating a Confidentiality Agreement.