How to extract obligations with source references for Non-Disclosure Agreements

Extract mutual NDA obligations by reading the executed agreement in both directions: each party’s duties as recipient and any duties imposed on it as discloser. Separate independently performable requirements, preserve definitions and exceptions, and attach document, section, and page references to every entry. Then identify triggers, timing, responsible owners, and evidence of completion. The deliverable is a source-linked obligations register that distinguishes contractual duties from permissions, internal controls, and unresolved interpretations, so business teams can act without losing the qualifications that govern performance.

When to use this workflow

Use this workflow when commercial counsel or an in-house legal team hands a signed mutual NDA to the business, prepares for sensitive disclosures, or reviews an existing NDA before expanding access. It also helps when discussions end and the parties must identify surviving protection, notice, and destruction duties.

The task is extraction, not renegotiation or a complete compliance program. Review both directions even when drafting is symmetrical: technical designs shared with contractors may require different implementation from financial forecasts shared with advisers.

This is a general US transactional guide. Contract rights depend on actual language, governing law, facts, and deal context. State-law enforceability and cross-border questions require separate analysis; the federal sources below support only the identified trade-secret and SEC reporting propositions.

What you need

Start with the executed agreement, incorporated schedules, amendments, and notices affecting its operation. Preserve signatures and attachments rather than relying solely on extracted text. Label the register provisional if execution status is uncertain.

Gather these NDA-specific inputs:

• Expected disclosures, including oral demonstrations, technical files, and recipient-created analyses.
• Proposed recipients, including employees, affiliates, advisers, and contractors.
• Repositories, collaboration systems, backups, and retention constraints.
• Requests, termination notices, disclosure events, and delivery evidence.
• Business and legal contacts responsible for access, notices, deletion, and certification.

Use your organization’s checklist as a review baseline, not evidence that a duty exists. Give each source a stable document ID and version designation. Keep performance records separate from agreement sources: a deletion report may evidence action, but it does not establish what the NDA required.

Use the template

Copy the Non-Disclosure Agreements — Obligations register into your working document or spreadsheet. Add rows rather than combining duties that require different actions or evidence.

In Source / exact text, record document ID, version, section, PDF page, and operative wording. Include definition and exception references. For a lengthy clause, retain a checked excerpt and a pointer to the full passage rather than substituting a paraphrase.

Duty / direction identifies the obligated party, beneficiary, and normalized action. ID / type distinguishes duties, permissions, conditions, and internal controls. Trigger / timing preserves contractual wording and verified event dates. Evidence / status identifies supporting records, performance status, and extraction confidence.

Use the row ID to connect follow-up evidence and related duties. Keep interpretation uncertainty separate from performance: “not triggered,” “source unreadable,” and “performance unverified” are different statuses.

Step by step

1. Establish the controlling source and reference system

Confirm the governing document set, including amendments and incorporated material. Compare the execution copy with the approved draft where available, checking signatures, dates, schedules, and attachments as well as text. If an amendment changes only one duty, preserve references to both documents rather than replacing the original reference wholesale.

Choose a consistent page convention, such as PDF page numbers, and retain section numbers. For scans, verify extracted wording against the image before calling it exact text.

Record: source ID and version in every row. Identify missing attachments and uncertain execution status as source gaps. Do not silently supply missing wording from an earlier draft.

2. Map protected information and both disclosure directions

Read definitions before extracting duties. Determine whether coverage depends on marking, oral identification, written confirmation, subject matter, or another condition. Check recipient-created analyses and whether the existence of discussions is separately protected.

The historical SAP–SuccessFactors NDA addresses oral and visual identification and includes recipient-created analyses in § 2. These illustrate coverage choices, not terms to import into another NDA (filed agreement, § 2). (sec.gov)

Map each company as recipient and discloser. Where the discloser must identify oral information as confidential, extract that action too. Shared rows are appropriate only if both owners and separate performance evidence remain clear.

Record: protected information, coverage conditions, direction, and definition references beside each affected duty. Flag uncertain coverage rather than treating all exchanged material identically.

3. Extract separate duties without losing qualifications

Read operative clauses for actor, action, object, trigger, timing, and qualification. A paragraph may contain use restrictions, access restrictions, representative undertakings, and responsibility for representative conduct. Separate them when implementation or proof differs.

Distinguish prohibitions from affirmative tasks and permissions. Permission to share with advisers does not require disclosure, but its conditions still matter. Check any stated standard of care, reproduction restrictions, confidentiality legends, and misuse-notification duties.

The SAP–SuccessFactors example limits representative access by participation or need-to-know and requires representatives to be informed and agree to comply (filed agreement, § 3). (sec.gov)

Record: one independently actionable requirement per row, with supporting wording and cross-references. Preserve defined terms. Keep unusual restrictions, such as standstills or non-solicitation clauses, visible for separate legal assessment rather than overlooking them because the document is titled an NDA.

4. Attach exclusions and disclosure exceptions

An exclusion may determine whether a duty applies. Capture stated conditions for prior knowledge, independent development, public availability, or authorized third-party receipt. Request supporting records without importing an evidentiary burden from another agreement.

Separate compelled disclosure from voluntary protected reporting. SEC guidance explains that Rule 21F-17(a) prohibits impeding individuals’ direct reports to the SEC about possible securities-law violations, including through confidentiality agreements. The protection extends beyond employment relationships, and conflicting notification requirements can raise concerns (SEC Whistleblower Protections). (sec.gov)

Record: each exclusion or qualification beside affected duties, together with supporting evidence or uncertainty. Flag consent, notice, and cooperation wording for legal review; do not issue an unconditional instruction to notify the counterparty before every disclosure. Identify any residual-memory permission separately so the use restriction is not summarized more broadly than the agreement supports.

5. Separate term, survival, and event-triggered timing

Identify effectiveness, disclosure window, termination mechanics, survival, and event-based deadlines independently. Do not infer that ending discussions ends protection or triggers destruction.

The SAP–Sybase example separates a one-year term and 30-day written early-termination mechanism from surviving disclosure, protection, and use provisions. Its compelled-disclosure notice requires prompt notice unless legally prohibited (filed agreement, §§ 7 and 18). These are example-specific provisions, not default deadlines. (sec.gov)

Preserve qualitative timing. Label any business response target as an internal control. For notices, capture delivery method, address, receipt mechanics, and relevant defined terms, including “business day” if supplied.

Record: source-backed trigger, timing, verified event evidence, and calculation assumptions. An unconfirmed trigger calls for prompt investigation, not indefinite deferral. Assign an owner to resolve it without inventing a contractual date.

6. Assign work and completion evidence

Assign owners by action, not merely by party name. A relationship manager may control disclosures, IT may address repositories, and legal may coordinate notices. These assignments implement the contract without changing its allocation of responsibility.

For return or destruction, inventory originals, email, analyses, representative copies, and backups. Check the actual exceptions and restrictions on retained copies. The SAP–SuccessFactors example makes return or destruction request-triggered, requires destruction certification, and contains specified proceeding, backup, and legal-retention exceptions (filed agreement, § 9). (sec.gov)

Record: owner, dependencies, and expected proof, such as an undertaking, delivery receipt, or repository-specific deletion confirmation. Extract certification separately if required. Do not add it as a contractual duty when absent; an internal completion record can still be useful if labeled accordingly.

7. Validate the register against the agreement

Check backward from every row to its sources, then forward from every operative clause to the register. This catches unsupported summaries and omissions. Confirm that amendments, qualifications, and incorporated definitions have carried through.

Test realistic events: a contractor joins, an oral demonstration occurs, discussions stop, a request arrives, or backups remain. Ask whether the register identifies the next action without overstating the contract.

Record: extraction confidence and the disposition of open issues. Distinguish absent language from unreadable or unreviewed material. Assign unresolved questions to a named role before handoff, and mark provisional interpretations so they do not become definitive instructions.

Worked example

Fictional scenario. Alder Circuit LLC and Bracken Analytics Inc. execute fictional NDA-17, version E1, for a joint sensor evaluation. Alder shares designs; Bracken shares forecasting methods. Section 1 includes recipient analyses within Confidential Information. Section 6 requires destruction within ten business days after receipt of a written request, except legally required copies; retained copies remain subject to protection and use restrictions. Section 8 preserves those restrictions after termination. There is no contractual destruction-certification requirement.

Alder proposes giving Bracken’s methods to a testing contractor. Bracken has a copy of Alder’s destruction request, but confirmed receipt evidence and a complete repository inventory have not been supplied. All parties, documents, wording, and facts below are fictional.

These entries change the decisions. Contractor access remains pending despite contractors being a permitted category. Bracken must investigate the destruction trigger promptly while preparing the inventory; missing receipt evidence does not justify waiting to organize performance. Deleting project files alone does not establish completion because analyses and other repositories remain unchecked. Any internal completion statement must reflect those gaps, not imply a contractual certification duty.

Common mistakes

• Treating mutual language as one assignment. Identify both organizations’ owners and separate performance evidence.
• Extracting duties without definitions. Attach coverage conditions, exclusions, and cross-references to affected rows.
• Turning “promptly” into a day count. Preserve contractual wording; label internal targets separately.
• Using termination as the deletion trigger. Check destruction and survival clauses independently.
• Recording absence after extraction failure. Inspect original pages and attachments before declaring language absent.

Final quality check

• Every operative row identifies controlling document, version, section, and page.
• Exact excerpts match source images and preserve operative qualifications.
• Both parties’ recipient and discloser roles are covered.
• Definitions, exceptions, and amendments remain connected to affected duties.
• Timing separates contractual requirements, verified events, and internal targets.
• Completion claims identify evidence and remaining dependencies.
• Open issues are resolved or expressly assigned, with provisional instructions marked.

Complete the workflow with DecoverAI

DecoverAI is the Legal Intelligence Platform for litigation and transactions. In its contract review workflow, choose the represented party or neither in Word and give deal-specific instructions. Findings quote clauses, locate text, rank severity, and identify missing language as not present. Tabular review supports work across multiple documents. Lawyers verify sources, maintain the register, resolve interpretation, and assess performance evidence. Book a demo to assess support for your team’s NDA extraction workflow.

Frequently asked questions

Should every clause become an obligation row?

No. Extract actionable duties and prohibitions; separately label permissions and conditions. Definitions usually qualify other rows. Keep remedies and unusual restrictions visible for legal assessment without describing them as recurring tasks.

Does every protected item qualify as a trade secret?

No. Section 1839(3) requires reasonable secrecy measures and independent economic value from information not being generally known or readily ascertainable through proper means by someone who can obtain value from its use or disclosure. NDA coverage and statutory status require distinct analysis (18 U.S.C. § 1839(3)). (govinfo.gov)

Can one row cover both parties?

Yes, if the duty, trigger, and implementation are genuinely symmetrical. Identify both owners and retain separate evidence. Split the row when recipients, systems, or coverage conditions make a shared status misleading.

What if destruction is required but backups cannot be removed?

Read the actual exception and continuing restrictions. Record affected copies, technical constraints, and the legal question. Operational difficulty is not a substitute for source-backed permission; do not close the row without a verified basis.

Sources

• 18 U.S.C. § 1839 — Definitions, official 2024 Code edition
• SEC — Whistleblower Protections
• SAP–Sybase mutual NDA — SEC-filed agreement
• SAP–SuccessFactors mutual NDA — SEC-filed agreement

Historical agreements illustrate negotiated wording, not market standards. The statutory reference is the official 2024 Code edition, not a comprehensive intervening-law update through October 13, 2026.

This guide is general information about legal workflows, not legal advice for any matter. It was drafted and reviewed with AI assistance. The worked example is fictional. Contract rights and procedure depend on the governing law, the actual wording, and the facts, so check the cited sources and the rules that apply in your jurisdiction before relying on it.