How to prepare a clause-level risk assessment for Non-Disclosure Agreements

A clause-level risk assessment turns a mutual NDA into a source-linked record of exposure, uncertainty, and proposed action. Review each provision from both parties’ positions as discloser and recipient, then test the wording against the planned information exchange, permitted recipients, and actual handling practices. The deliverable is a clause risk register identifying the operative text, practical consequence, reasoned priority, and decision owner. Distinguish drafting preferences from legal uncertainty and operational obstacles so counsel can recommend targeted changes rather than rewrite the agreement indiscriminately.

When to use this workflow

Use this workflow when commercial counsel or an in-house team receives a mutual NDA for a product evaluation, supplier discussion, partnership, or transaction exploration. It is particularly useful where reciprocal wording masks different exposures: one party may disclose technical designs while the other shares pricing, or one may require more external recipients.

The scope is assessment of the proposed agreement, not a complete negotiation or compliance program. The output should support approval, targeted amendments, or escalation.

This guide uses a US commercial-contract orientation. Governing law, enforceability, and cross-border restrictions require matter-specific analysis. Contractual confidentiality also differs from federal trade-secret status: Section 1839(3) requires reasonable secrecy measures and independent economic value attributable to information not being generally known or readily ascertainable through proper means. An NDA label alone does not establish those elements. 18 U.S.C. § 1839(3). (govinfo.gov)

What you need

Collect the agreement and enough context to assess its operation:

• Authoritative documents: editable draft, PDF counterpart, schedules, incorporated terms, prior draft, and document/version identifiers.
• Exchange description: evaluation purpose, information categories, disclosure channels, anticipated timing, and any completed disclosures.
• Recipient map: participating entities, affiliates, employees, advisers, and contractors, separately for each party.
• Handling facts: marking practices, access controls, collaboration environments, backups, retention constraints, and ability to retrieve representative copies.
• Review instructions: the organization’s current checklist, preferred positions, permitted fallbacks, escalation owners, and proposed governing law.

The checklist supplies counsel’s instructions, not law or evidence of market practice. Assign unavailable facts to an owner rather than assuming the NDA accommodates the intended activity.

Use the template

The companion template is Non-Disclosure Agreements — Clause risk register. Copy this table into your working document or spreadsheet. Use one row per distinct issue; a clause may require several rows where its definition, exception, and cross-reference create different concerns.

Give each issue a stable identifier. In Text / status, record operative wording or a short excerpt linked to the complete clause. Use “not present” only after checking the full document; distinguish unreadable, unavailable, and unreviewed material.

Function / roles identifies the obligation, obligated party, and beneficiary. Trigger / limits captures conditions, exceptions, timing, and defined terms. Priority / reason states severity and consequence. Evidence / uncertainty separates source support, confirmed facts, and assumptions; include reviewer confidence here. Disposition / owner records the proposed change, acceptance rationale, or question, with its decision-maker and resolution status.

Keep governing law, checklist version, disclosure assumptions, and document inventory in a cover note. Link supporting extracts through document IDs and clause/page citations.

Step by step

1. Establish the review version and disclosure assumptions

Identify the draft being assessed and confirm that referenced schedules and incorporated documents are available. Check effective-date wording and earlier disclosures; do not presume that signing later necessarily brings earlier exchanges within scope.

Prepare a two-direction disclosure map: what each party will disclose, who will receive it, and what activities the recipient needs to perform. “Mutual” describes the drafting structure, not equal exposure.

Register output: controlling document/version details and separate findings for missing attachments, uncertain earlier-disclosure coverage, or material assumptions requiring confirmation.

2. Extract obligations and identify coverage gaps

Read definitions alongside permitted use, disclosure permissions, exclusions, duration, remedies, and miscellaneous provisions. Capture connected wording rather than assessing a sentence without its qualifications.

Test coverage of oral demonstrations, visual access, unmarked files, recipient analyses, and affiliate disclosures. The SAP–SuccessFactors NDA illustrates express treatment of oral and visual identification and recipient-created analyses; equivalent protection cannot be assumed in another NDA. SAP–SuccessFactors NDA, § 2. (sec.gov)

Identify residuals, standstills, IP restrictions, publicity controls, and similar provisions separately. Record any standard-of-care qualification or responsibility for representative breaches rather than subsuming it within a general confidentiality score.

Register output: source-linked findings identifying the relevant function, parties, qualifications, and genuinely absent protection.

3. Test permitted use, exclusions, and recipients

Translate the stated purpose into actual activities. Does it permit technical testing, financial modeling, or specialist consultation? Check every intended recipient category against authorization, need-to-know limits, downstream duties, and responsibility for breaches.

Test exclusions against evidence: prior-possession records, development histories, public availability, or a third party’s authority to disclose. Record contractual proof requirements exactly. SAP–Sybase § 4 illustrates negotiated exclusions; it does not make those exclusions mandatory or establish a universal evidentiary burden. SAP–Sybase NDA, § 4. (sec.gov)

For each mismatch, identify whose disclosure or receipt creates the exposure. A broad recipient permission may help one party operationally while increasing the other’s confidentiality concern.

Register output: permitted-use and recipient findings, together with evidence needed to establish any material exclusion.

4. Separate disclosure duration, survival, and disposal

Read effectiveness, disclosure window, termination, and survival separately. Determine which duties continue, for which information, and from what event. Preserve qualitative deadlines such as “promptly” rather than inventing a day count. Check notice method and receipt mechanics where they affect a trigger.

Test return or destruction against email, backups, analyses, legal holds, and representative copies. Determine whether certification is required, who could give it, and what restrictions apply to retained material. SAP–SuccessFactors § 9 illustrates request-triggered destruction, certification, and qualified retention exceptions—not unrestricted retention permission. SAP–SuccessFactors NDA, § 9. (sec.gov)

Register output: separate timing and disposal findings identifying triggers, exceptions, feasibility questions, and verification owners.

5. Check disclosure exceptions and remedies

Assess compelled disclosure separately from voluntary protected reporting. Trace notice, consent, and cooperation requirements throughout the NDA; an exception in one clause may be undermined elsewhere. For compelled disclosures, check whether notice is qualified where legally prohibited and whether cooperation obligations are workable.

The SEC explains that Rule 21F-17(a) prohibits impeding individuals’ direct reports of possible securities-law violations, including through confidentiality agreements, and extends beyond employment relationships. Flag potentially conflicting notice or approval language rather than treating a compelled-disclosure clause as sufficient. SEC, Whistleblower Protections. (sec.gov)

For injunction language, liability limitations, indemnities, and forum provisions, distinguish requested contractual treatment from enforceability conclusions. Assign jurisdiction-dependent questions instead of assuming an automatic remedy.

Register output: conflicting text, affected disclosure route or remedy, precise legal question, and reviewing lawyer.

6. Assign priorities with explicit reasons

Use a consistent internal scale. For example, high priority may identify material exposure of sensitive information or an obstacle to the planned exchange; medium may identify a manageable ambiguity; low may identify limited practical concern. These are review conventions, not legal standards.

Consider sensitivity, expected exposure, operational feasibility, and consequences. Explain both parties’ positions. Keep confidence separate from severity: a potentially serious issue may depend on an unconfirmed fact. Distinguish legal uncertainty, commercial preference, and operational incompatibility.

Register output: reasoned priority, issue type, and confidence statement supported by evidence. Do not average serious individual findings into a reassuring agreement-wide score.

7. Recommend a disposition and verify interactions

Recommend acceptance, clarification, amendment, or escalation for each finding. Tie the proposal to counsel’s checklist or fallback, not an unsupported claim about market standards.

Preserve defined terms and cross-references. Broadening permitted recipients requires another look at downstream duties, responsibility, and destruction. Narrowing the purpose may reduce exposure while preventing the intended evaluation.

Reconcile the register with the assessed draft before delivery. If wording changes, retain the earlier finding and identify the version supporting the revised disposition.

Register output: specific recommendation, decision owner, resolution status, and remaining uncertainty. Identify any issue that must be decided before approval.

Worked example

Fictional scenario: Alder Circuit LLC and Harborfield Devices Inc. are evaluating a sensor integration. Alder will disclose prototype architecture; Harborfield will disclose cost forecasts. Their fictional NDA-07 v3 limits coverage to marked information, permits employees and professional advisers to receive information on a need-to-know basis, and requires destruction of all copies within ten days of request. It contains no destruction-certification requirement.

The sponsor confirms an unrecorded prototype demonstration and Harborfield’s use of an outside engineering contractor. IT has not confirmed backup deletion or representative-copy retrieval capabilities. All parties, documents, clauses, and facts below are fictional.

The assessment changes the recommendation from approval based on reciprocity to targeted revision and factual confirmation. Alder’s concern follows from its demonstration; Harborfield’s follows from its evaluation method. Neither justifies rewriting every clause.

R3 remains provisional. The reviewer does not invent a certification duty, presume retention rights, or assert that deletion is impossible. Counsel should resolve the operational question—or expressly identify the authorized decision on it—before recommending approval.

Common mistakes

• Treating reciprocity as equivalence. Compare actual disclosures and recipient networks, not merely matching obligations.
• Equating confidentiality with trade-secret status. Separate contractual coverage from statutory elements and supporting secrecy evidence.
• Importing exclusions or residual rights. Read actual permissions and proof requirements; another NDA does not supply missing terms.
• Scoring without consequences. Replace “high risk—duration” with the affected information, survival problem, and resulting exposure.
• Inventing operational duties. Distinguish destruction from certification, and verify feasibility before proposing either.

Final quality check

• Every finding identifies the reviewed version and verifiable clause/page.
• Excerpts preserve relevant qualifications, definitions, and cross-references.
• Missing provisions are distinguished from unavailable or unreviewed text.
• Both parties’ discloser and recipient positions have been tested.
• Duration, survival, disposal triggers, and retained-copy restrictions are reconciled.
• Priorities separate consequences, confidence, and issue type.
• Legal propositions have supporting sources; every open issue has a decision or named owner.

Complete the workflow with DecoverAI

DecoverAI is the Legal Intelligence Platform for litigation and transactions. Its contract review workflow supports selecting the represented party—or neither—and providing deal-specific instructions in Word. Findings quote clauses, rank severity, locate text, and identify missing language as not present. The lawyer edits or inserts suggestions as ordinary tracked changes in the signed-in Word user’s name and can dismiss findings with reasons. Tabular review supports work across documents; the register and legal judgments remain counsel’s responsibility. Book a demo to discuss your mutual-NDA assessment process.

Frequently asked questions

Does every clause need a register row?

No. Record material issues and express acceptances requiring explanation. Maintain a coverage checklist so omitted rows do not conceal an incomplete review. Split findings where separate decisions or owners are needed.

How should we assess an NDA without business context?

Make the assessment provisional. Identify missing information about disclosures, recipients, purpose, and disposal capability. Assign those questions and distinguish confirmed drafting issues from fact-dependent concerns.

Should a residuals provision automatically receive high priority?

No. Assess the permission against expected information, use restrictions, and qualifications. The residual-memory provision in SAP–SuccessFactors § 6 is a negotiated example, not a default right or recommended position. Sensitive technical disclosures may justify rejection or escalation. (sec.gov)

Can the register cover successive drafts?

Yes, with clear version history. Preserve the original finding, add revised citations and dispositions, and reopen connected issues when wording changes. Never overwrite the evidence explaining an earlier objection.

Sources

• 18 U.S.C. § 1839 — Definitions, official 2024 Code edition
• SEC — Whistleblower Protections
• SAP–Sybase Mutual Non-Disclosure Agreement
• SAP–SuccessFactors Mutual Non-Disclosure Agreement

Scope: General professional workflow guidance, not advice for a particular matter. The statutory citation uses the official 2024 Code edition; historical agreements illustrate wording, not market standards.

This guide is general information about legal workflows, not legal advice for any matter. It was drafted and reviewed with AI assistance. The worked example is fictional. Contract rights and procedure depend on the governing law, the actual wording, and the facts, so check the cited sources and the rules that apply in your jurisdiction before relying on it.